Menu
Ensure critical data is encrypted with customer-managed keys (CMK)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-database-3-5The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-database-3.5 |
| description | Ensure critical data is encrypted with customer-managed keys (CMK) |
| category | cis-azure-database |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","cosmos-db","nosql"] |
| cis_id | 3.5 |
| cis_benchmark | CIS Microsoft Azure Database Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Customer-managed keys introduce additional depth to security by providing control over encryption keys. Where required, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys.
While it is possible to automate the assessment of this recommendation, the assessment status remains "Manual" due to ideally limited scope. The scope of application should be carefully considered to account for organizational capacity, and targeted to workloads with specific need for CMK.
Customer-managed keys provide greater control over the creation, rotation, and revocation of encryption keys, supporting strict security and compliance requirements.
Implementing customer-managed keys introduces additional administrative effort to create, rotate, monitor, and secure encryption keys.
Azure Cosmos DB.Encryption Key Type is set to Customer-managed key.Run the following command to list Azure Cosmos DB accounts:
az cosmosdb list
For each account, run the following command to get the Key Vault key URI:
az cosmosdb show --resource-group <resource-group> --name <cosmos-db> --query keyVaultKeyUri
Ensure an Azure Key Vault key URI is returned.
Run the following command to get Azure Cosmos DB accounts for a given resource group:
Get-AzCosmosDBAccount -ResourceGroupName <resource-group>
Run the following command to get the account with a given name:
$cosmosdb = Get-AzCosmosDBAccount -ResourceGroupName <resource-group> -Name <cosmos-db>
Run the following command to get the Key Vault key URI:
$cosmosdb.KeyVaultKeyUri
Ensure an Azure Key Vault key URI is returned.
Repeat for each account.
1f905d99-2ab7-462c-a6b0-f709acca6c8fEncryption Key Type should be set to Customer-managed key, or a Key Vault key URI should be returned from CLI/PowerShell.
Azure Cosmos DB.Encryption Key Type to Customer-managed key.By default, Azure Cosmos DB accounts are encrypted using service-managed keys.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.11 Encrypt Sensitive Data at Rest | X | X | |
| v7 | 14.8 Encrypt Sensitive Information at Rest | X |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1530 | TA0009 | M1041 |