Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-4-4The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
Based on SOC occupation classification
| name | cis-gcp-foundations-4.4 |
| description | Ensure Oslogin Is Enabled for a Project |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","compute","virtual-machines","oslogin"] |
| cis_id | 4.4 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.
Enabling osLogin ensures that SSH keys used to connect to instances are mapped with IAM users. Revoking access to IAM user will revoke all the SSH keys associated with that particular user. It facilitates centralized and automated SSH key pair management which is useful in handling cases like response to compromised SSH key pairs and/or revocation of external/third-party/Vendor users.
Enabling OS Login on project disables metadata-based SSH key configurations on all instances from a project. Disabling OS Login restores SSH keys that you have configured in project or instance meta-data.
enable-oslogin is present with value set to TRUE.enable-oslogin and value FALSE.gcloud compute instances list --format=json
commonInstanceMetadata has a key enable-oslogin set to value TRUE.VMs created by GKE should be excluded. These VMs have names that start with gke- and are labeled goog-gke-node.
Edit.enable-oslogin and the value is TRUE.Save to apply the changes.VM Instances page at https://console.cloud.google.com/compute/instances.Edit to edit the instance settings.Custom metadata, remove any entry with key enable-oslogin and the value is FALSE.Save to apply your changes to the instance.gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE
gcloud compute instances remove-metadata <INSTANCE_NAME> --keys=enable-oslogin
Optionally, you can enable two factor authentication for OS login. For more information, see: https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication.
By default, parameter enable-oslogin is not set, which is equivalent to setting it to FALSE.
Project cos-cloud (Container-Optimized OS) image family cos-stable.
All project coreos-cloud (CoreOS) image families
Project suse-cloud (SLES) image family sles-11
All Windows Server and SQL Server image families
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.6 Centralize Account Management | X | X | |
| v8 | 6.7 Centralize Access Control | X | X | |
| v7 | 16.2 Configure Centralized Point of Authentication | X | X |