Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-1-1La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Affichage de SKILL.md
Basé sur la classification professionnelle SOC
| name | cis-gcp-foundations-1.1 |
| description | Ensure That Corporate Login Credentials Are Used |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","iam","service-accounts","mfa","kms","api-keys"] |
| cis_id | 1.1 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Use corporate login credentials instead of consumer accounts, such as Gmail accounts.
It is recommended fully-managed corporate Google accounts be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as consumer accounts, should not be used for business purposes.
There will be increased overhead as maintaining accounts will now be required. For smaller organizations, this will not be an issue, but will balloon with size.
For each Google Cloud Platform project, list the accounts that have been granted access to that project.
From Google Cloud CLI
gcloud projects get-iam-policy PROJECT_ID
gcloud resource-manager folders get-iam-policy FOLDER_ID
gcloud organizations get-iam-policy ORGANIZATION_ID
No email accounts outside the organization domain should be granted permissions in the IAM policies. This excludes Google-owned service accounts.
Remove all consumer Google accounts from IAM policies. Follow the documentation and setup corporate login accounts.
Prevention:
To ensure that no email addresses outside the organization can be granted IAM permissions to its Google Cloud projects, folders or organization, turn on the Organization Policy for Domain Restricted Sharing. Learn more at:
https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains
From Google Cloud Console
Follow the documentation to set up corporate login accounts and remove consumer accounts from IAM policies.
By default, no email addresses outside the organization's domain have access to its Google Cloud deployments, but any user email account can be added to the IAM policy for Google Cloud Platform projects, folders, or organizations.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.6 Centralize Account Management - Centralize account management through a directory or identity service. | x | x | |
| v7 | 16.2 Configure Centralized Point of Authentication - Configure access for all accounts through as few centralized points of authentication as possible, including network, security, and cloud systems. | x | x |