Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1604-v200-4-1-1-4O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | cis-ubuntu1604-v200-4-1-1-4 |
| description | Ensure audit_backlog_limit is sufficient |
| category | cis-logging |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-16.04","auditd","logging"] |
| cis_id | 4.1.1.4 |
| cis_benchmark | CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The backlog limit has a default setting of 64.
During boot if audit=1, then the backlog will hold 64 records. If more that 64 records are created during boot, auditd records will be lost and potential malicious activity could go undetected.
None.
Run the following commands and verify the audit_backlog_limit= parameter is set to an appropriate size for your organization:
grep "^\s*linux" /boot/grub/grub.cfg | grep -v "audit_backlog_limit="
Nothing should be returned.
grep "audit_backlog_limit=" /boot/grub/grub.cfg
Ensure the returned value complies with local site policy. Recommended that this value be 8192 or larger.
The first command should return no output. The second command should show audit_backlog_limit= set to 8192 or larger.
Edit /etc/default/grub and add audit_backlog_limit=<BACKLOG SIZE> to GRUB_CMDLINE_LINUX:
Example:
GRUB_CMDLINE_LINUX="audit_backlog_limit=8192"
Run the following command to update the grub2 configuration:
update-grub
The default backlog limit is 64.
| Controls Version | Control |
|---|---|
| v7 | 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices. |
| v7 | 6.3 Enable Detailed Logging - Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. |