用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-compute-2-5命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
| name | cis-azure-compute-2.5 |
| description | Ensure Azure Key Vaults are Used to Store Secrets |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","key-vault","secrets"] |
| cis_id | 2.5 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.
The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing within Azure Key Vault as secrets increases security by controlling access. This also allows for updates of the credentials without redeploying the entire application.
Integrating references to secrets within the key vault are required to be specifically integrated within the application code. This will require additional configuration to be made during the writing of an application, or refactoring of an already written one. There are also additional costs that are charged per 10000 requests to the Key Vault.
Key Vaults.To list key vaults and/or HSMs within a subscription run the following command:
az keyvault list [--resource-type] --subscription <id_or_name_of_target_subscription>
--resource-type could be either __vault__ or __hsm__. When parameter is missing all types of vaults will be listed.
To list the secrets within a target key vault run the following command:
az keyvault secret list [--vault-name / --id]
To list the certificates within a target key vault run the following command:
az keyvault certificate list [--vault-name / --id]
To list the keys within a target key vault run the following command:
az keyvault secret list [--vault-name / --id]
--id represents the full URI of the vault. --vault-name represents the name and must be present if --id is missing.
To list key vaults within a subscription run the following command:
Get-AzKeyVault
To list all secrets in a key vault run the following command:
Get-AzKeyVaultSecret -VaultName '<vaultName>'
Azure Key Vaults should be created and secrets should be stored within them rather than in application code or configuration files.
Remediation has 2 steps:
az keyvault create --name "<name>" --resource-group "<myResourceGroup>" --location myLocation
New-AzKeyvault -name <name> -ResourceGroupName <myResourceGroup> -Location <myLocation>
Configure the App Service to reference secrets from Key Vault using Key Vault references in application settings. Use a system-assigned managed identity with appropriate access policies granting "get" permission on secrets.
By default, no Azure Key Vaults are created.
Level 2 | Manual