Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-storage-8-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-storage-8.1 |
| description | Ensure soft delete for Azure File Shares is Enabled |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","azure-files","soft-delete"] |
| cis_id | 8.1 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Azure Files offers soft delete for file shares, allowing you to easily recover your data when it is mistakenly deleted by an application or another storage account user.
Important data could be accidentally deleted or removed by a malicious actor. With soft delete enabled, the data is retained for the defined retention period before permanent deletion, allowing for recovery of the data.
When a file share is soft-deleted, the used portion of the storage is charged for the indicated soft-deleted period. All other meters are not charged unless the share is restored.
Storage Accounts.Data storage, click on File shares.File share settings, ensure the value for Soft delete shows a number of days between 1 and 365, inclusive.Run the following command to list storage accounts:
az storage account list
Run the following command to determine if a storage account has file shares:
az storage share list --account-name <storage-account>
For each storage account with file shares, run the following command:
az storage account file-service-properties show --resource-group <resource-group> --account-name <storage-account>
Ensure that under shareDeleteRetentionPolicy, enabled is set to true, and days is set to an appropriate value between 1 and 365, inclusive.
Run the following command to list storage accounts:
Get-AzStorageAccount -ResourceGroupName <resource-group>
With a storage account context set, run the following command to determine if a storage account has file shares:
Get-AzStorageShare
For each storage account with file shares, run the following command:
Get-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account>
Ensure that ShareDeleteRetentionPolicy.Enabled is set to and is set to an appropriate value between 1 and 365, inclusive.
TrueShareDeleteRetentionPolicy.DaysshareDeleteRetentionPolicy.enabled is true and shareDeleteRetentionPolicy.days is set to an appropriate value between 1 and 365, inclusive.
Storage Accounts.Data storage, click File shares.File share settings, click the value next to Soft delete.Soft delete for all file shares, click the toggle to set it to Enabled.Retention policies, set an appropriate number of days to retain soft deleted data between 1 and 365, inclusive.Save.For each storage account requiring remediation, run the following command to enable soft delete for file shares and set an appropriate number of days for deleted data to be retained, between 1 and 365, inclusive:
az storage account file-service-properties update --account-name <storage-account> --enable-delete-retention true --delete-retention-days <retention-days>
For each storage account requiring remediation, run the following command to enable soft delete for file shares and set an appropriate number of days for deleted data to be retained, between 1 and 365, inclusive:
Update-AzStorageFileServiceProperty -ResourceGroupName <resource-group> -AccountName <storage-account> -EnableShareDeleteRetentionPolicy $true -ShareRetentionDays <retention-days>
Soft delete is enabled by default at the storage account file share setting level.
Level 1 | Automated