Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-6-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
| name | cis-aws-storage-6.3 |
| description | Ensure functionality of Endpoint Detection and Response (EDR) |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","edr","endpoint-detection","security","threat-detection","malware"] |
| cis_id | 6.3 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-6.1","cis-aws-storage-6.2","cis-aws-storage-6.4"] |
| prerequisites | [] |
| severity_boost | {} |
Establish and maintain an effective Endpoint Detection and Response (EDR) system to proactively monitor, detect, and respond to security threats on endpoints such as computers, mobile devices, and servers. This involves deploying EDR software that continuously collects data from endpoints, analyzes this data for signs of malicious activity, and provides real-time alerts and detailed incident reports. Regularly test and update the EDR system to ensure it can accurately identify and mitigate advanced threats, including zero-day exploits and sophisticated malware, ensuring comprehensive protection and swift response to potential security incidents.
Ensuring the functionality of Endpoint Detection and Response (EDR) systems is essential for early detection and swift response to security threats on endpoints. These systems continuously monitor and analyze endpoint data, providing real-time alerts and detailed incident reports to identify and mitigate potential threats. Regular testing and updates of the EDR system ensure it remains effective against advanced threats, maintaining comprehensive protection for the organization's assets.
Implementing and maintaining EDR requires:
Preparing the Environment for EDR:
Preparing the Source Server:
Preparing the Staging Area Subnet:
Accessing the AWS Elastic Disaster Recovery Console:
Configuring the Replication Settings Template:
Configure and Initializein in the AWS Elastic Disaster Recovery screen.Configure EBS encryption and volume types:
Configure EBS volumes:
Configure the security group:
Launch the template:
Follow the audit procedure steps to configure EDR functionality:
By default, EDR is not configured. Organizations must manually set up all components including network access, security groups, replication settings, and encryption.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 13.2 Deploy a Host-Based Intrusion Detection Solution Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported. | ● | ● | |
| v8 | 13.3 Deploy a Network Intrusion Detection Solution Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service. | ● | ● | |
| v7 | 8.6 Centralize Anti-malware Logging Send all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting. | ● | ● | |
| v7 | 12.6 Deploy Network-based IDS Sensor Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries. | ● | ● |