# Leonidas | Automated Attack Simulation In The Cloud, Complete With Detection Use Cases

**URL:** <https://onehack.st/t/leonidas-automated-attack-simulation-in-the-cloud-complete-with-detection-use-cases/199805>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [August 31, 2021, 1:45pm UTC](https://onehack.st/t/leonidas-automated-attack-simulation-in-the-cloud-complete-with-detection-use-cases/199805 "2021-08-31T13:45:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [August 31, 2021, 1:45pm UTC](https://onehack.st/t/leonidas-automated-attack-simulation-in-the-cloud-complete-with-detection-use-cases/199805/1 "2021-08-31T13:45:46Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/e/9e6a16369294bac48d07b852591e58da58ac5a72.png)

This is the repository containing Leonidas, a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures (TTPs) and their associated detection properties. These definitions can then be compiled into:

- A web API exposing each test case as an individual endpoint
- Sigma rules ([https://github.com/Neo23x0/sigma](https://github.com/Neo23x0/sigma)) for detection
- Documentation - see [http://detectioninthe.cloud/](http://detectioninthe.cloud/) for an example

## Deploying the API

The API is deployed via an AWS-native CI/CD pipeline. Instructions for this can be found at [Deploying Leonidas](https://github.com/FSecureLABS/leonidas/blob/master/docs/deploying-leonidas.md).

## Using the API

The API is invoked via web requests secured by an API key. Details on using the API can be found at [Using Leonidas](https://github.com/FSecureLABS/leonidas/blob/master/docs/using-leonidas.md)

## Installing the Generator Locally

To build documentation or Sigma rules, you’ll need to install the generator locally. You can do this by:

- `cd generator`
- `poetry install`

## Generating Sigma Rules

Sigma rules can be generated as follows:

- `poetry run ./generator.py sigma`

The rules will then appear in `./output/sigma`

## Generating Documentation

The documentation is generated as follows:

- `poetry run ./generator.py docs`

This will produce markdown versions of the documentation available at `output/docs`. This can be uploaded to an existing markdown-based documentation system, or the following can be used to create a prettified HTML version of the docs:

- `cd output`
- `mkdocs build`

This will create a `output/site` folder containing the HTML site. It is also possible to view this locally by running `mkdocs serve` in the same folder.

## Writing Definitions

The definitions are written in a YAML-based format, for which an example is provided below. Documentation on how to write these can be found in [Writing Definitions](https://github.com/FSecureLABS/leonidas/blob/master/docs/writing-definitions.md)

— name: Enumerate Cloudtrails for a Given Region author: Nick Jones description: | An adversary may attempt to enumerate the configured trails, to identify what actions will be logged and where they will be logged to. In AWS, this may start with a single call to enumerate the trails applicable to the default region. category: Discovery mitre\_ids: - T1526 platform: aws permissions: - cloudtrail:DescribeTrails input\_arguments: executors: sh: code: | aws cloudtrail describe-trails leonidas\_aws: implemented: True clients: - cloudtrail code: | result = clients[“cloudtrail”].describe\_trails() detection: sigma\_id: 48653a63-085a-4a3b-88be-9680e9adb449 status: experimental level: low sources: - name: “cloudtrail” attributes: eventName: “DescribeTrails” eventSource: “\*.cloudtrail.amazonaws.com”

## GitHub

> **[GitHub - ReversecLabs/leonidas: Automated Attack Simulation in the Cloud, complete...](https://github.com/ReversecLabs/leonidas)**
>
> Automated Attack Simulation in the Cloud, complete with detection use cases.