基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-k8s-v1111-5-2-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | cis-k8s-v1111-5.2.1 |
| description | Ensure that the cluster has at least one active policy control mechanism in place (Manual) |
| category | cis-k8s |
| version | 1.11.1 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","policies","pod-security","pod-security-standards"] |
| cis_id | 5.2.1 |
| cis_benchmark | CIS Kubernetes Benchmark v1.11.1 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Every Kubernetes cluster should have at least one policy control mechanism in place to enforce the other requirements in this section. This could be the in-built Pod Security Admission controller, or a third party policy control system.
Without an active policy control mechanism, it is not possible to limit the use of containers with access to underlying cluster nodes, via mechanisms like privileged containers, or the use of hostPath volume mounts.
Where policy control systems are in place, there is a risk that workloads required for the operation of the cluster may be stopped from running. Care is required when implementing admission control policies to ensure that this does not occur.
Review the workloads deployed to the cluster to understand if Pod Security Admission or external admission control systems are in place.
Ensure that either Pod Security Admission or an external policy control system is in place for every namespace which contains user workloads.
By default, Pod Security Admission is enabled but no policies are in place.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 13.4 Perform Traffic Filtering Between Network Segments | X | X | |
| v8 | 13.10 Perform Application Layer Filtering | X | ||
| v7 | 4.7 Limit Access to Script Tools | X | X | |
| v7 | 9.4 Apply Host-based Firewalls or Port Filtering | X | X | X |