用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-compute-2-11命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
| name | cis-aws-compute-2.11 |
| description | Ensure instances stopped for over 90 days are removed |
| category | cis-compute |
| version | 1.1.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","compute","ec2","stopped-instances","cleanup","lifecycle"] |
| cis_id | 2.11 |
| cis_benchmark | CIS AWS Compute Services Benchmark v1.1.0 |
| tech_stack |
| ["aws"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-compute-2.5","cis-aws-compute-2.12"] |
| prerequisites | [] |
| severity_boost | {} |
Enable this rule to help with the baseline configuration of Amazon Elastic Compute Cloud (Amazon EC2) instances by checking whether Amazon EC2 instances have been stopped for more than the allowed number of days, according to your organization's standards.
Stopped instances that are no longer needed consume resources and may contain outdated configurations or unpatched software. Removing them reduces the attack surface and management overhead.
Terminating instances is irreversible. Ensure data on the instance is backed up or no longer needed before termination.
No specific CLI audit command is provided for this control. Use the console method below.
Instances, click Instances.Details tab.Launch time.If the Launch time of the selected Instance is greater than 90 days, the Instance has been offline and is considered outdated.
Repeat all steps for the other regions.
Refer to the remediation procedure below if any of the Launch times are over 90 days.
No stopped instances should have a Launch time older than 90 days. All stopped instances beyond this threshold should be terminated.
No specific CLI remediation command is provided for this control. Use the console method below.
Login to the EC2 console at https://console.aws.amazon.com/ec2/.
In the left pane, click Instances, click Instances.
Select the Instance for that hasn't been used for over 90 days.
Under the Details tab.
Click Instance state, click Terminate instance.
Click Terminate.
Repeat steps no. 3 - 6 the other instances with a launch date equal to or over 90 days.
Repeat all steps for the other regions.
AWS does not automatically terminate stopped instances. They remain in the stopped state indefinitely unless terminated.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 1.1 Establish and Maintain Detailed Enterprise Asset Inventory | x | x | x |
| v7 | 1.4 Maintain Detailed Asset Inventory | x | x | x |
Level 1 | Manual