Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-12-8O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | cis-aws-compute-12.8 |
| description | Ensure that Code Signing is enabled for Lambda functions |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","lambda","serverless","code-signing","integrity","supply-chain"] |
| cis_id | 12.8 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-12.9","cis-aws-compute-12.11"] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that all your Amazon Lambda functions are configured to use the Code Signing feature in order to restrict the deployment of unverified code.
Code Signing, ensures that the function code is signed by an approved (trusted) source, and that it has not been altered since signing, and that the code signature has not expired or been revoked.
Enabling code signing adds an additional step to the deployment process. All code packages must be signed before deployment, which may slow down CI/CD pipelines.
AWS Lambda, click Functions.Function name click on the name of the function that you want to review.Configuration tabCode signing.Code signing configuration section check for any code signing configurations created for the function.aws lambda list-functionsaws lambda list-functions --output table --query "Functions[*].FunctionName"
This command will provide a table titled ListFunctions
aws lambda get-function-code-signing-configaws lambda get-function-code-signing-config --function-name "name_of_function" --query "CodeSigningConfigArn"
Each Lambda function has a code signing configuration with a valid CodeSigningConfigArn associated.
Create Signing Profile if none are set up. If you already have some created in the left panel click on Signing Profiles, Create Signing Profile.
***Note a Signing Profile is a trusted publisher and is analogous to the use of a digital signing certificate to generate signatures for your application code.Create Signing Profile setup page provide:
Create ProfileCode signing configurations.Create configurationCreate code signing configuration setup page:
Signing profile version ARN box and select the Signing Profile created above.Signature validation policy, click the signature validation policy suitable for your Lambda function.
**Note - A signature check can fail if the code is not signed by an allowed Signing Profile, or if the signature has expired or has been revoked.Create configurationEdit code signing, select the code signing configuration created above from the drop downSaveThe Lambda function is now configured to use code signing.
N/A - This control is Console-based remediation only.
Code Signing is not enabled by default for Lambda functions.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 2.7 Allowlist Authorized Scripts - Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently. | x | ||
| v8 | 10.2 Configure Automatic Anti-Malware Signature Updates - Configure automatic updates for anti-malware signature files on all enterprise assets. | x | x | x |
| v7 | 5.3 Securely Store Master Images - Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible. | x | x | |
| v7 | 8.2 Ensure Anti-Malware Software and Signatures are Updated - Ensure that the organization's anti-malware software updates its scanning engine and signature database on a regular basis. | x | x | x |
Level 1 | Manual