用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-apache-6-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-apache-6.1 |
| description | Ensure the Error Log Filename and Severity Level Are Configured Correctly |
| category | cis-apache |
| version | 3.6.0 |
| author | cyberstrike-official |
| tags | ["cis","apache","linux","logging","monitoring"] |
| cis_id | 6.1 |
| cis_benchmark | CIS Apache HTTP Server 2.2 Benchmark v3.6.0 |
| tech_stack | ["linux","apache"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
The LogLevel directive is used to configure the severity level for the error logs, while the ErrorLog directive configures the log file name. The log level values are the standard syslog levels of emerg, alert, crit, error, warn, notice, info and debug. The recommended level is notice, so that all errors from the emerg level through the notice level will be logged.
The server error logs are invaluable because they can be used to spot potential problems before they become serious. Most importantly, they can be used to watch for anomalous behavior such as numerous "not found" or "unauthorized" errors that may be an indication an attack is pending or has occurred.
The Apache httpd server stopped including 404 not found errors in its error log several years ago. Not including the 404 errors may cause log monitoring and host intrusion detection and prevention software to miss web scanning attacks which cause a large number of not found errors, and may fail to block the attack. For Apache 2.4 benchmark we have recommended using "notice core:info" in order to pick up the 404 errors. However, in Apache 2.2, the LogLevel directive doesn't support multiple levels. So the same recommended solution is not available. There are three alternatives to consider:
Set the LogLevel to info – However this may create excessive logs, especially for TLS connections. The excessive logs may overwhelm the log monitoring processes.
Adapt the log monitoring and IDS to monitor the access logs. Which are much more frequent and may also overwhelm the log monitoring system.
Upgrade to Apache 2.4.
For historical context:
Perform the following steps to determine if the recommended state is implemented:
LogLevel in the Apache server configuration has a value of notice or lower. Note that it is also compliant to have a value of info or debug if there is a need for a more verbose log and storage and monitoring processes are capable of handling the extra load. The recommended value is notice.ErrorLog directive is configured to an appropriate log file or syslog facility.ErrorLog directive for each virtual host configured if the virtual host will have different people responsible for the web site.Perform the following to implement the recommended state:
LogLevel in the Apache configuration to have a value of notice or lower. Note that is it is compliant to have a value of info or debug if there is a need for a more verbose log and the storage and monitoring processes are capable of handling the extra load. The recommended value is notice.LogLevel notice
ErrorLog directive if not already configured. The file path may be relative or absolute, or the logs may be configured to be sent to a syslog server.ErrorLog "logs/error_log"
ErrorLog directive for each virtual host configured if the virtual host will have different people responsible for the web site. Each responsible individual or organization needs access to their own web logs.The following is the default configuration:
LogLevel warn
ErrorLog "logs/error_log"
Version 6
6.2 Ensure Audit Log Settings Support Appropriate Log Entry Formatting Validate audit log settings for each hardware device and the software installed on it, ensuring that logs include a date, timestamp, source addresses, destination addresses, and various other useful elements of each packet and/or transaction. Systems should record logs in a standardized format such as syslog entries or those outlined by the Common Event Expression initiative. If systems cannot generate logs in a standardized format, log normalization tools can be deployed to convert logs into such a format.
Version 7
6.2 Activate audit logging Ensure that local logging has been enabled on all systems and networking devices.
6.3 Enable Detailed Logging Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.
Level 1 | Scored Level 2 | Scored