Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-4-2El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-aws-foundations-4.2 |
| description | Ensure CloudTrail log file validation is enabled |
| category | cis-logging |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","logging","cloudtrail","log-validation","integrity"] |
| cis_id | 4.2 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-4.1","cis-aws-foundations-4.5"] |
| prerequisites | [] |
| severity_boost | {} |
CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or remained unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled for all CloudTrails.
Enabling log file validation will provide additional integrity checks for CloudTrail logs.
N/A
Trails in the left navigation pane.Name column.General details section, ensure log file validation is set to Enabled.List all trails:
aws cloudtrail describe-trails
Ensure LogFileValidationEnabled is set to true for each trail.
All CloudTrail trails have LogFileValidationEnabled set to true.
Trails in the left navigation pane.General details section, click edit.Advanced settings, check the enable box under Log file validation.Save changes.Enable log file validation on a trail:
aws cloudtrail update-trail --name <trail_name> --enable-log-file-validation
Note that periodic validation of logs using these digests can be carried out by running the following command:
aws cloudtrail validate-logs --trail-arn <trail_arn> --start-time <start_time> --end-time <end_time>
By default, CloudTrail log file validation is not enabled. This means that while logs are still delivered to the designated S3 bucket, there is no mechanism in place to verify their integrity. Without validation, it is not possible to detect if log files have been altered, deleted, or tampered with after delivery.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.11 Conduct Audit Log Reviews - Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis. | x | x | |
| v7 | 6.1 Utilize Three Synchronized Time Sources - Use at least three synchronized time sources from which all servers and network devices retrieve time information on a regular basis so that timestamps in logs are consistent. | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1565 | TA0040 |
Level 2 | Automated