auditing-cloud-with-cis-benchmarks

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.

Jump to install

Repository: mukul975/Anthropic-Cybersecurity-Skills
Last source activity: August 2, 2026 at 16:32
Detected SKILL.md language: English
Stars: 27,732
Forks: 3,366

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill auditing-cloud-with-cis-benchmarks

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

4 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

View all from this repository

name	auditing-cloud-with-cis-benchmarks
description	Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
domain	cybersecurity
subdomain	cloud-security
tags	["cis-benchmarks","cloud-audit","compliance-assessment","prowler","security-hardening"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["GOVERN-1.1","GOVERN-4.2","MAP-2.3"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1098.003","T1685.002","T1580"]

name	auditing-cloud-with-cis-benchmarks
description	Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
domain	cybersecurity
subdomain	cloud-security
tags	["cis-benchmarks","cloud-audit","compliance-assessment","prowler","security-hardening"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["GOVERN-1.1","GOVERN-4.2","MAP-2.3"]
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1098.003","T1685.002","T1580"]

Term	Definition
CIS Benchmark	Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus
Level 1 Profile	Practical security controls implementable without significant performance or functionality impact, representing security hygiene
Level 2 Profile	Defense-in-depth controls that may restrict functionality and require careful planning before implementation
Foundations Benchmark	CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security
Control ID	Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption)
Compliance Score	Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement
Automated Assessment	Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements
Remediation Runbook	Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation

auditing-cloud-with-cis-benchmarks

Install options

Review the source files