Menu
Ensure Private Virtual Networks are used for Container Instances
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-compute-3-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-compute-3.1 |
| description | Ensure Private Virtual Networks are used for Container Instances |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","container-instances","aci"] |
| cis_id | 3.1 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Private Virtual Networks (vNets) ensure that services and hosts within the subscription environment are appropriately segmented in private subnets. Public IP addressing for container instances should be handled through a NAT gateway and/or Firewall. In addition to the use of a private vNet for container instances, ensure that a Network Security Group (NSG) is configured and applied to your container instance vNet. The NSG will need to be configured with inbound and outbound TCP/UDP traffic rules which reflect the needs of the services running in your container instance.
Network segmentation reduces threat surface and limits potential lateral movement in the case of breach. Container instances with Public IP addresses present significant threat surface and should be avoided.
A well-architected Cloud network will require documentation and consideration for subnetting. The use of vNets and NSGs have a minimal impact on cost, but the use of Firewalls and public-facing gateways will increase that cost.
Container Instances.Properties under the Settings section.IP address property indicates (Private).Run the following command:
az container list
For each Container Instance, ensure "type": "Private" is indicated under the "ipAddress" section.
All Container Instances should have "type": "Private" in the "ipAddress" section, indicating they are deployed within a private virtual network.
Container Instances which have been created with Public IP addresses will need to be re-created with private IP addresses. During the initial creation of a Container Instance, ensure that the Networking Type of "Private" is selected prior to creating the Container Instance.
Container Instances must be re-created with the appropriate vNet and subnet configuration. Use the --vnet and --subnet parameters during az container create to deploy into a private virtual network.
By default, the "Public" Networking type is selected when creating a Container Instance from Azure Portal.
Level 1 | Manual