القائمة
Ensure 'Subscription leaving/entering Microsoft Entra tenant' is set to 'Permit no one'
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-5-25يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | cis-azure-foundations-5.25 |
| description | Ensure 'Subscription leaving/entering Microsoft Entra tenant' is set to 'Permit no one' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","identity","subscription-management","tenant-security","access-control"] |
| cis_id | 5.25 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-5.23","cis-azure-foundations-5.27"] |
| prerequisites | [] |
| severity_boost | {} |
Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Microsoft Entra ID.
Permissions to move subscriptions in and out of a Microsoft Entra tenant must only be given to appropriate administrative personnel. A subscription that is moved into a Microsoft Entra tenant may be within a folder to which other users have elevated permissions. This prevents loss of data or unapproved changes of the objects within by potential bad actors.
Subscriptions will need to have these settings turned off to be moved.
SubscriptionsAdvanced options drop-down menu, select Manage PoliciesSubscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Permit no oneBoth Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant should be set to Permit no one.
SubscriptionsAdvanced options drop-down menu, select Manage PoliciesSubscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant to Permit no oneSave changesBy default Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Allow everyone (default).
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | x | x | x |
| v8 | 6.1 Establish an Access Granting Process | x | x | x |
| v8 | 6.2 Establish an Access Revoking Process | x | x | x |
| v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts | x | x | x |
Level 2 | Manual