القائمة
Designate individuals authorized to make information publicly accessible;
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill ac-22-publicly-accessible-contentيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | AC-22_publicly-accessible-content |
| description | Designate individuals authorized to make information publicly accessible; |
| category | authorization |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","ac-22","ac"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | ["AC-3","AT-2","AT-3","AU-13"] |
| prerequisites | [] |
| severity_boost | {"AC-3":"Chain with AC-3 for comprehensive security coverage","AT-2":"Chain with AT-2 for comprehensive security coverage","AT-3":"Chain with AT-3 for comprehensive security coverage"} |
Family: Access Control (AC) Framework: NIST SP 800-53 Rev 5
In accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including information protected under the PRIVACT and proprietary information. Publicly accessible content addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Posting information on non-organizational systems (e.g., non-organizational public websites, forums, and social media) is covered by organizational policy. While organizations may have individuals who are responsible for developing and implementing policies about the information that can be made publicly accessible, publicly accessible content addresses the management of the individuals who make such information publicly accessible.
Examine the System Security Plan (SSP) and related artifacts for AC-22 implementation details. Verify the organization has documented how this control is satisfied.
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
| Tool | Purpose | Usage |
|---|---|---|
| cloud-audit-mcp | Check IAM policies and access controls | cloud_audit_iam_policies |
| hackbrowser-mcp | Test web application access controls | browser_auth_test |
Designate individuals authorized to make information publicly accessible; Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and Review the content on the publicly accessible system for nonpublic information [organization-defined] and remove such information, if discovered.
In accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including information protected under the PRIVACT and proprietary information. Publicly accessible content addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Posting information on non-organizational systems (e.g., non-organizational public websites, forums, and social media) is covered by organizational policy. While organizations may have individuals who are responsible for developing and implementing policies about the information that can be made publicly accessible, publicly accessible content addresses the management of the individuals who make such information publicly accessible.
| Finding | Severity | Impact |
|---|---|---|
| AC-22 Publicly Accessible Content not implemented | High | Access Control |
| AC-22 partially implemented | Medium | Incomplete Access Control |
| CWE ID | Title |
|---|---|
| CWE-284 | Improper Access Control |