Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-5-2Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | cis-aws-storage-5.2 |
| description | Ensure direct data addition to S3 |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","s3","data-upload","access-point","level-2"] |
| cis_id | 5.2 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-5.1","cis-aws-storage-5.3"] |
| prerequisites | ["cis-aws-storage-5.1"] |
| severity_boost | {} |
Your bucket name must be unique and not already in use on AWS. Click on your bucket name, and in the right corner, you will find an option to upload data directly to your S3 bucket. You can choose the file option to upload individual files, images, or even entire folders.
Accessing the upload option within your bucket simplifies the process of adding data, making it easy to manage and organize your files. This streamlined approach allows for efficient data storage, retrieval, and management within the AWS S3 environment, enhancing overall operational efficiency.
Without direct data upload capability:
Access Point in S3 Bucket:
Access points are named network endpoints that are attached to buckets which simplify managing data access at scale in S3. To see if any of the access points attached to this bucket grant public or cross-account access, go to IAM Access Analyzer for S3.
# List objects in bucket to verify upload capability
aws s3 ls s3://<bucket-name>/
# Upload a test file
aws s3 cp <local-file> s3://<bucket-name>/<key-name>
aws s3 s3://<bucket-name>/<key-name>
aws s3control list-access-points \
--account-id <account-id> \
--bucket <bucket-name>
aws s3control get-access-point \
--account-id <account-id> \
--name <access-point-name>
aws s3control get-access-point-policy-status \
--account-id <account-id> \
--name <access-point-name>
S3 bucket should allow direct data upload with:
Upload Data to S3 Bucket:
Configure Access Point (Optional but Recommended for Scale):
Upload Files to S3:
# Upload single file
aws s3 cp <local-file> s3://<bucket-name>/<key-name>
# Upload directory (recursive)
aws s3 cp <local-directory>/ s3://<bucket-name>/<prefix>/ --recursive
# Upload with server-side encryption
aws s3 cp <local-file> s3://<bucket-name>/<key-name> \
--server-side-encryption AES256
# Sync local directory with S3 bucket
aws s3 sync <local-directory>/ s3://<bucket-name>/<prefix>/
Create Access Point:
# Create access point
aws s3control create-access-point \
--account-id <account-id> \
--name <access-point-name> \
--bucket <bucket-name> \
--vpc-configuration VpcId=<vpc-id>
# Set access point policy
aws s3control put-access-point-policy \
--account-id <account-id> \
--name <access-point-name> \
--policy file://access-point-policy.json
# Verify access point creation
aws s3control get-access-point \
--account-id <account-id> \
--name <access-point-name>
Example Access Point Policy (access-point-policy.json):
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<account-id>:role/<role-name>"
},
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:<region>:<account-id>:accesspoint/<access-point-name>/object/*"
}
]
}
By default:
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications. | ● | ● | ● |
| v8 | 8.3 Ensure Adequate Audit Log Storage Ensure that logging destinations maintain adequate storage to comply with the enterprise's audit log management process. | ● | ● | ● |
| v7 | 13.4 Only Allow Access to Authorized Cloud Storage or Email Providers Only allow access to authorized cloud storage or email providers. | ● | ● | |
| v7 | 14.6 Protect Information through Access Control Lists Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | ● | ● | ● |
Level 2