用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-foundations-4-7命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-aws-foundations-4.7 |
| description | Ensure VPC flow logging is enabled in all VPCs |
| category | cis-logging |
| version | 7.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","logging","vpc","flow-logs","network","cloudwatch"] |
| cis_id | 4.7 |
| cis_benchmark | CIS AWS Foundations Benchmark v7.0.0 |
| tech_stack | ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-foundations-4.1"] |
| prerequisites | [] |
| severity_boost | {} |
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs.
VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or gain insights during security workflows.
By default, CloudWatch Logs will store logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind that the average time it takes for an organization to realize they have been breached is 210 days (at the time of this writing). Since additional time is required to research a breach, a minimum retention policy of 365 days allows for detection and investigation. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods:
Services, then select VPC.Your VPCs.Flow Logs tab.Active in the Status column.describe-vpcs command (OSX/Linux/UNIX) to list the VPC networks available in the current AWS region:aws ec2 describe-vpcs --region <region> --query Vpcs[].VpcId
The command output returns the VpcId of VPCs available in the selected region.
describe-flow-logs command (OSX/Linux/UNIX) using the VPC ID to determine if the selected virtual network has the Flow Logs feature enabled:aws ec2 describe-flow-logs --filter "Name=resource-id,Values=<vpc-id>"
If there are no Flow Logs created for the selected VPC, the command output will return an empty list .
[]--region, and repeat steps 1-4 for each region.VPCS=$(aws ec2 describe-vpcs --query "Vpcs[].VpcId" --output text)
for VPC in $VPCS; do
COUNT=$(aws ec2 describe-flow-logs --filter Name=resource-id,Values=$VPC --query "length(FlowLogs)" --output text)
if [ "$COUNT" -gt 0 ]; then
echo "$VPC True"
else
echo "$VPC False"
fi
done
All VPCs in all regions have at least one active Flow Log configured.
Services, then select VPC.Your VPCs.Flow Logs tab.Create Flow Log.Reject.Role and Destination Log Group.Create Log Flow.CloudWatch Logs Group.Note: Setting the filter to "Reject" will dramatically reduce the accumulation of logging data for this recommendation and provide sufficient information for the purposes of breach detection, research, and remediation. However, during periods of least privilege security group engineering, setting the filter to "All" can be very helpful in discovering existing traffic flows required for the proper operation of an already running environment.
role_policy_document.json, and paste the following content:{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "test",
"Effect": "Allow",
"Principal": {
"Service": "vpc-flow-logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
iam_policy.json, and paste the following content:{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:PutLogEvents",
"logs:GetLogEvents",
"logs:FilterLogEvents"
],
"Resource": "*"
}
]
}
aws iam create-role --role-name <aws-support-iam-role> --assume-role-policy-document file://<file-path>role_policy_document.json
aws iam create-policy --policy-name <iam-policy-name> --policy-document file://<file-path>iam_policy.json
attach-group-policy command, using the IAM policy ARN returned from the previous step to attach the policy to the IAM role:aws iam attach-group-policy --policy-arn arn:aws:iam::<aws-account-id>:policy/<iam-policy-name> --group-name <group-name>
describe-vpcs command to get a list of VPCs in the selected region:aws ec2 describe-vpcs --region <region>
create-flow-logs command to create a flow log for a VPC:aws ec2 create-flow-logs --resource-type VPC --resource-ids <vpc-id> --traffic-type REJECT --log-group-name <log-group-name> --deliver-logs-permission-arn <iam-role-arn>
By default, VPC Flow Logs are not enabled for any newly created VPCs. Logging must be manually configured on a per-VPC basis.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs - Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets. | x | x | x |
| v8 | 13.6 Collect Network Traffic Flow Logs - Collect network traffic flow logs and/or network traffic to review and alert upon from network devices. | x | x | |
| v7 | 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices. | x | x | x |
| v7 | 12.5 Configure Monitoring Systems to Record Network Packets - Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries. | x | x |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| M1047 |
Level 2 | Automated