用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1604-v200-4-1-11命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ubuntu1604-v200-4-1-11 |
| description | Ensure use of privileged commands is collected |
| category | cis-logging |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-16.04","auditd","logging"] |
| cis_id | 4.1.11 |
| cis_benchmark | CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Monitor privileged programs (those that have the setuid and/or setgid bit set on execution) to determine if unprivileged users are running these commands.
Note: Reloading the auditd config to set active settings requires the auditd service to be restarted, and may require a system reboot.
Execution of privileged commands by non-privileged users could be an indication of someone trying to gain unauthorized access to the system.
None.
Run the following command replacing <partition> with a list of partitions where programs can be executed from on your system:
find <partition> -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged" }'
Verify all resulting lines are a .rules file in /etc/audit/rules.d/ and the output of auditctl -l.
Note: The .rules file output will be auid!=-1 not auid!=4294967295.
All privileged commands should have corresponding audit rules.
To remediate this issue, the system administrator will have to execute a find command to locate all the privileged programs and then add an audit line for each one of them. The audit parameters associated with this are as follows:
-F path=" $1 " - will populate each file name found through the find command and processed by awk.-F perm=x - will write an audit record if the file is executed.-F auid>=1000 - will write a record if the user executing the command is not a privileged user.-F auid!= 4294967295 - will ignore Daemon eventsAll audit records should be tagged with the identifier key "privileged".
Run the following command replacing <partition> with a list of partitions where programs can be executed from on your system:
find <partition> -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>='"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' -F auid!=4294967295 -k privileged" }'
Edit or create a file in the /etc/audit/rules.d/ directory ending in .rules and add all resulting lines to the file.
Example:
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>='"$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)"' -F auid!=4294967295 -k privileged" }' >> /etc/audit/rules.d/50-privileged.rules
Additional Information: Systems may have been customized to change the default UID_MIN. To confirm the UID_MIN for your system, run the following command:
awk '/^\s*UID_MIN/{print $2}' /etc/login.defs
If your systems' UID_MIN is not 1000, replace auid>=1000 with auid>=<UID_MIN for your system> in the Audit and Remediation procedures.
By default, no audit rules are configured for privileged command usage.
| Controls Version | Control |
|---|---|
| v7 | 5.1 Establish Secure Configurations - Maintain documented, standard security configuration standards for all authorized operating systems and software. |