Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-docker-v170-3-9The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-docker-v170-3.9 |
| description | Ensure that TLS CA certificate file ownership is set to root:root |
| category | cis-docker |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","docker","daemon","files","permissions","ownership","tls","certificates"] |
| cis_id | 3.9 |
| cis_benchmark | CIS Docker Benchmark v1.7.0 |
| tech_stack | ["docker"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
You should verify that the TLS CA certificate file (the file that is passed along with the --tlscacert parameter) is individually owned and group owned by root.
The TLS CA certificate file should be protected from any tampering. It is used to authenticate the Docker server based on a given CA certificate. It must be therefore be individually owned and group owned by root to ensure that it cannot be modified by less privileged users.
None.
You should execute the command below to verify that the TLS CA certificate file is owned and group owned by root:
stat -c %U:%G <path to TLS CA certificate file> | grep -v root:root
The above command should return no results.
You should execute the following command:
chown root:root <path to TLS CA certificate file>
This sets the individual ownership and group ownership for the TLS CA certificate file to root.
By default, the ownership and group-ownership for TLS CA certificate file is correctly set to root.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account. | ● | ● | ● |
| v7 | 4 Controlled Use of Administrative Privileges Controlled Use of Administrative Privileges |
Manual