[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CS6WCCEAJP8PMHQ63SC7G":3,"skill-same:01M71CS6WCCEAJP8PMHQ63SC7G":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M71CS6WCCEAJP8PMHQ63SC7G","compliance-cis-cloud",null,"Compliance Cis Cloud.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcompliance-cis-cloud\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28],"cloud","compliance","cis","compliance cis cloud","cybersecurity","2026-11-10 10:12:30",false,"---\nname: compliance-cis-cloud\ndescription: \"Compliance Cis Cloud.\"\ndomain: cybersecurity\n---\n\n|\n| CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus |\n| Level 1 Profile | Practical security controls implementable without significant performance or functionality impact, representing security hygiene |\n| Level 2 Profile | Defense-in-depth controls that may restrict functionality and require careful planning before implementation |\n| Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security |\n| Control ID | Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption) |\n| Compliance Score | Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement |\n| Automated Assessment | Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements |\n| Remediation Runbook | Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation |\n\n## Tools & Systems\n\n- **Prowler**: Open-source cloud security tool performing 300+ checks including CIS benchmark assessments for AWS, Azure, and GCP\n- **ScoutSuite**: Multi-cloud security auditing tool with CIS benchmark rule sets generating HTML reports\n- **AWS Security Hub**: Native AWS service supporting CIS AWS Foundations Benchmark as a security standard\n- **Azure Policy**: Governance service with built-in CIS benchmark policy initiatives for automated compliance monitoring\n- **GCP Security Command Center**: Native GCP service evaluating configurations against CIS GCP Foundations Benchmark\n\n## Common Scenarios\n\n### Scenario: Pre-Audit CIS Assessment for SOC 2 Certification\n\n**Context**: A SaaS company pursuing SOC 2 Type II certification needs to demonstrate cloud security controls aligned to CIS benchmarks. The auditor requires evidence of continuous compliance monitoring across 45 AWS accounts.\n\n**Approach**:\n1. Run Prowler CIS v5.0 assessment across all 45 accounts to establish the baseline compliance score\n2. Export results to CSV and categorize failures by section (IAM, Logging, Monitoring, Networking)\n3. Map each CIS control to the relevant SOC 2 Trust Services Criteria (CC6.1, CC6.6, CC7.1, etc.)\n4. Remediate all Level 1 control failures within 30 days and Level 2 within 60 days\n5. Enable CIS v5.0 in AWS Security Hub for continuous monitoring and automated drift detection\n6. Generate weekly compliance reports showing improvement trajectory for the auditor\n7. Document exceptions for controls intentionally not implemented with risk acceptance justification\n\n**Pitfalls**: Remediating controls without testing in a staging environment first can break production workloads. Ignoring Level 2 controls entirely weakens the audit narrative even if they are not strictly required.\n\n## Output Format\n\n```\nCIS Benchmark Audit Report\n============================\nCloud Provider: AWS\nBenchmark Version: CIS AWS Foundations Benchmark v5.0\nAccounts Assessed: 45\nAssessment Date: 2025-02-23\nTool: Prowler v4.3.0\n\nOVERALL COMPLIANCE SCORE: 74%\n\nCOMPLIANCE BY SECTION:\n  1. Identity and Access Management:  68% (41\u002F60 controls passed)\n  2. Storage:                         82% (28\u002F34 controls passed)\n  3. Logging:                         91% (20\u002F22 controls passed)\n  4. Monitoring:                      55% (18\u002F33 controls passed)\n  5. Networking:                      78% (32\u002F41 controls passed)\n\nTOP FAILED CONTROLS (by affected accounts):\n  [1.4]   Root account has active access keys           - 3\u002F45 accounts\n  [1.5]   MFA not enabled for root account              - 2\u002F45 accounts\n  [2.1.1] S3 default encryption not enabled             - 12\u002F45 accounts\n  [3.1]   CloudTrail not multi-region                   - 8\u002F45 accounts\n  [4.3]   No alarm for root account usage               - 28\u002F45 accounts\n  [5.1]   VPC flow logs not enabled                     - 15\u002F45 accounts\n  [5.4]   Security groups allow 0.0.0.0\u002F0 ingress      - 22\u002F45 accounts\n\nREMEDIATION PRIORITY:\n  Critical (Fix within 7 days):  Root access keys, missing root MFA\n  High (Fix within 30 days):     S3 encryption, CloudTrail, VPC flow logs\n  Medium (Fix within 60 days):   CloudWatch alarms, security group restrictions\n  Low (Fix within 90 days):      Level 2 controls, informational items\n```\n","|\n| CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus |\n| Level 1 Profile | Practical security controls implementable without significant performance or functionality impact, representing security hygiene |\n| Level 2 Profile | Defense-in-depth controls that may restrict functionality and require careful planning before implementation |\n| Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security |\n| Control ID | Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption) |\n| Compliance Score | Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement |\n| Automated Assessment | Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements |\n| Remediation Runbook | Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation |\n\n## Tools & Systems\n\n- **Prowler**: Open-source cloud security tool performing 300+ checks including CIS benchmark assessments for AWS, Azure, and GCP\n- **ScoutSuite**: Multi-cloud security auditing tool with CIS benchmark rule sets generating HTML reports\n- **AWS Security Hub**: Native AWS service supporting CIS AWS Foundations Benchmark as a security standard\n- **Azure Policy**: Governance service with built-in CIS benchmark policy initiatives for automated compliance monitoring\n- **GCP Security Command Center**: Native GCP service evaluating configurations against CIS GCP Foundations Benchmark\n\n## Common Scenarios\n\n### Scenario: Pre-Audit CIS Assessment for SOC 2 Certification\n\n**Context**: A SaaS company pursuing SOC 2 Type II certification needs to demonstrate cloud security controls aligned to CIS benchmarks. The auditor requires evidence of continuous compliance monitoring across 45 AWS accounts.\n\n**Approach**:\n1. Run Prowler CIS v5.0 assessment across all 45 accounts to establish the baseline compliance score\n2. Export results to CSV and categorize failures by section (IAM, Logging, Monitoring, Networking)\n3. Map each CIS control to the relevant SOC 2 Trust Services Criteria (CC6.1, CC6.6, CC7.1, etc.)\n4. Remediate all Level 1 control failures within 30 days and Level 2 within 60 days\n5. Enable CIS v5.0 in AWS Security Hub for continuous monitoring and automated drift detection\n6. Generate weekly compliance reports showing improvement trajectory for the auditor\n7. Document exceptions for controls intentionally not implemented with risk acceptance justification\n\n**Pitfalls**: Remediating controls without testing in a staging environment first can break production workloads. Ignoring Level 2 controls entirely weakens the audit narrative even if they are not strictly required.\n\n## Output Format\n\n```\nCIS Benchmark Audit Report\n============================\nCloud Provider: AWS\nBenchmark Version: CIS AWS Foundations Benchmark v5.0\nAccounts Assessed: 45\nAssessment Date: 2025-02-23\nTool: Prowler v4.3.0\n\nOVERALL COMPLIANCE SCORE: 74%\n\nCOMPLIANCE BY SECTION:\n  1. Identity and Access Management:  68% (41\u002F60 controls passed)\n  2. Storage:                         82% (28\u002F34 controls passed)\n  3. Logging:                         91% (20\u002F22 controls passed)\n  4. Monitoring:                      55% (18\u002F33 controls passed)\n  5. Networking:                      78% (32\u002F41 controls passed)\n\nTOP FAILED CONTROLS (by affected accounts):\n  [1.4]   Root account has active access keys           - 3\u002F45 accounts\n  [1.5]   MFA not enabled for root account              - 2\u002F45 accounts\n  [2.1.1] S3 default encryption not enabled             - 12\u002F45 accounts\n  [3.1]   CloudTrail not multi-region                   - 8\u002F45 accounts\n  [4.3]   No alarm for root account usage               - 28\u002F45 accounts\n  [5.1]   VPC flow logs not enabled                     - 15\u002F45 accounts\n  [5.4]   Security groups allow 0.0.0.0\u002F0 ingress      - 22\u002F45 accounts\n\nREMEDIATION PRIORITY:\n  Critical (Fix within 7 days):  Root access keys, missing root MFA\n  High (Fix within 30 days):     S3 encryption, CloudTrail, VPC flow logs\n  Medium (Fix within 60 days):   CloudWatch alarms, security group restrictions\n  Low (Fix within 90 days):      Level 2 controls, informational items\n```\n",{"name":5,"domain":28,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcompliance-cis-cloud","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill compliance-cis-cloud",{"tool":47,"command":48},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill compliance-cis-cloud",{"tool":50,"command":51},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill compliance-cis-cloud","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcompliance-cis-cloud\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"index.json","REFERENCE","参考文档",480,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcompliance-cis-cloud\u002Findex.json",[62,87,110,132,154,170],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":29},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,28,86],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":29},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[94,69,95,72,96,97,98,28,99,100,101,102,103,104,74,105,106,107,108,109],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":29},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[117,118,119,120,121,122,28,99,123,100,124,125,74,107,126,127,128,129,130,131],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":29},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[70,139,140,141,142,143,144,75,145,28,86,146,147,148,149,150,151,152,153,74],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":29},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[161,162,70,163,141,143,164,75,165,145,28,86,100,166,167,168,169,153,74,76],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":29},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[177,70,141,178,164,75,179,180,28,86,181,182,183,184,185,186,74,76,187,188],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]