用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill maintenance-tools-03-07-04-maintenance-tools命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | Maintenance Tools (03.07.04)_maintenance-tools |
| description | Approve, control, and monitor the use of system maintenance tools. |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","maintenance tools (03-07-04)","family-03.07","cui-protection","cmmc"] |
| tech_stack | ["linux","windows"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Family: Maintenance Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI
Approve, control, and monitor the use of system maintenance tools. Check media with diagnostic and test programs for malicious code before it is used in the system. Prevent the removal of system maintenance equipment containing CUI by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
Examine the SSP for Maintenance Tools (03.07.04) implementation description and responsible parties.
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
| Tool | Purpose | Usage |
|---|---|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Approve, control, and monitor the use of system maintenance tools. Check media with diagnostic and test programs for malicious code before it is used in the system. Prevent the removal of system maintenance equipment containing CUI by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.
Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with the tools that are used for diagnostic and repair actions on the system. Maintenance tools can include hardware and software diagnostic and test equipment as well as packet sniffers. The tools may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Diagnostic and test programs are potential vehicles for transporting malicious code into the system, either intentionally or unintentionally. Examples of media inspection include checking the cryptographic hash or digital signatures of diagnostic and test programs and media. If organizations inspect media that contain diagnostic and test programs and determine that the media also contain malicious code, the incident is handled consistent with incident handling policies and procedures. A periodic review of system maintenance tools can result in the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools do not address the hardware and software components that support maintenance and are considered a part of the system.
| Finding | Severity | Impact |
|---|---|---|
| Maintenance Tools (03.07.04) Maintenance Tools not implemented | Medium | CUI Protection - Maintenance |
| Maintenance Tools (03.07.04) partially implemented (POA&M) | Low | CMMC certification risk |
| CWE ID | Title |
|---|---|
| N/A | No direct CWE mapping |