Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-apache-12-3The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-apache-12.3 |
| description | Ensure the Apache AppArmor Profile Is in Enforce Mode |
| category | cis-apache |
| version | 3.6.0 |
| author | cyberstrike-official |
| tags | ["cis","apache","linux","apparmor","mandatory-access-control","mac"] |
| cis_id | 12.3 |
| cis_benchmark | CIS Apache HTTP Server 2.2 Benchmark v3.6.0 |
| tech_stack | ["linux","apache"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
AppArmor profiles may be in one of three modes: disabled, complain, or enforce. In the complain mode, any violations of the access controls are logged but the restrictions are not enforced. Also, once a profile mode has been changed, it is recommended to restart the Apache server, otherwise the currently running process may not be confined by the policy.
The complain mode is useful for testing and debugging a profile but is not appropriate for production. Only the confined process running in enforce mode will prevent attacks that violate the configured access controls.
None documented
Perform the following steps to determine if the recommended state is implemented:
Use the aa-unconfined command to check that the apache2 policy is enforced, and that the currently running apache2 processes are confined. The output should include both confined by and (enforce).
# aa-unconfined --paranoid | grep apache2
1899 /usr/sbin/apache2 confined by '/usr/sbin/apache2 (enforce)'
1902 /usr/sbin/apache2 confined by '/usr/sbin/apache2 (enforce)'
1903 /usr/sbin/apache2 confined by '/usr/sbin/apache2 (enforce)'
. . .
Note that non-compliant results may include not confined or (complain), such as the following:
3304 /usr/sbin/apache2 not confined
2502 /usr/sbin/apache2 confined by '/usr/sbin/apache2 (complain)'
4004 /usr/sbin/apache2 confined by
'/usr/sbin/apache2//HANDLING_UNTRUSTED_INPUT (complain)'
Perform the following to implement the recommended state:
# aa-enforce /usr/sbin/apache2
# /etc/init.d/apparmor reload
The default Apache profile is very permissive.
Version 6
2 Inventory of Authorized and Unauthorized Software Inventory of Authorized and Unauthorized Software
Version 7
14.7 Enforce Access Control to Data through Automated Tools Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system.
Level 2 | Scored