Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-k8s-v200-3-2-2The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-k8s-v200-3.2.2 |
| description | Ensure that the audit policy covers key security concerns (Manual) |
| category | cis-k8s |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","control-plane-config","logging"] |
| cis_id | 3.2.2 |
| cis_benchmark | CIS Kubernetes Benchmark v2.0.0 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the audit policy created for the cluster covers key security concerns.
Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment.
Increasing audit logging will consume resources on the nodes or other log destination.
Review the audit policy provided for the cluster and ensure that it covers at least the following areas:
pod and deployment objects.pods/exec, pods/portforward, pods/proxy and services/proxy.CertificateSigningRequest API which allows for creation of new credentials.Token sub-resource of ServiceAccount objects which allows for creation of new credentials.For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging). Exceptions should be created in the audit logging policy to ensure that system operations (e.g. the Kubelet creating new credentials) are not logged, to reduce operational load and the risk of false positives.
Consider modification of the audit policy in use on the cluster to include these items, at a minimum.
By default Kubernetes clusters do not log audit information.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 8.5 Collect Detailed Audit Logs Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | ● | ● | |
| v7 | 14.9 Enforce Detail Logging for Access or Changes to Sensitive Data Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information and Event Monitoring). | ● |
Level 2 - Master Node (Manual)