Menu
Ensure Operating system updates are applied to your base image every 30 days
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-euc-5-7The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-aws-euc-5.7 |
| description | Ensure Operating system updates are applied to your base image every 30 days |
| category | cis-end-user-compute |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","end-user-compute","appstream","patch-management","image-management"] |
| cis_id | 5.7 |
| cis_benchmark | CIS AWS End User Compute Services Benchmark v1.2.0 |
| tech_stack | ["aws"] |
| cwe_ids | ["CWE-1357"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
To ensure that your fleet instances have the latest Windows updates installed, we recommend that you install Windows updates on your image builder, create a new image, and then update your fleet with the new image once a month.
All fleet instances used in user streaming sessions have only the Windows and application updates that were installed on the underlying image when it was created. In addition, any updates made to Windows or to applications on the instance during the streaming session will not persist to future sessions by the same user or other users.
None - this is a security best practice.
Perform the following steps to review the Image date.
https://console.aws.amazon.com/appstream2If the created at date is over 30 days old refer to the remediation below.
Not applicable - must be audited via Console.
AppStream image builder is less than 30 days old.
Perform the steps below to create an image and update it:
https://console.aws.amazon.com/appstream2Install Operating system updates and install, configure and update your applications for streaming, and then create an image by creating a snapshot of the image builder instance.
Not applicable - must be configured via Console.
By default, Windows Operating systems are set to update automatically utilizing Windows update services. Linux operating systems do not update automatically by default.
v8:
v7:
Level 1