@cyberstrike-io/cyberstrike 1.1.9 → 1.1.10-beta.1

package/skill/CIS_benchmarks/Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-2.9/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: cis-azure-compute-2.9
+description: "Ensure App Service Environment has TLS 1.0 and 1.1 disabled"
+category: cis-azure-compute
+version: "2.0.0"
+author: cyberstrike-official
+tags: [cis, azure, app-service-environment, ase]
+cis_id: "2.9"
+cis_benchmark: "CIS Microsoft Azure Compute Services Benchmark v2.0.0"
+tech_stack: [azure]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure App Service Environment has TLS 1.0 and 1.1 disabled
+
+## Description
+The TLS (Transport Layer Security) protocol secures the transmission of data over the internet using standard encryption technology. TLS versions 1.0 and 1.1 have been deprecated, and their use is generally discouraged. Disable all inbound TLS 1.0 and TLS 1.1 traffic for all the apps in an App Service Environment.
+
+## Rationale
+TLS 1.0 and 1.1 are outdated and vulnerable to security risks.
+
+## Impact
+Disallowing TLS 1.0 and 1.1 may affect compatibility with clients and backend services.
+
+## Audit Procedure
+
+### Using Azure Portal
+1. Go to `App Service Environments`.
+2. Click the name of an App Service Environment.
+3. Under `Settings`, click `Configuration`.
+4. Ensure that `Allow TLS 1.0 and 1.1` is set to `Off`.
+5. Repeat steps 1-4 for each App Service Environment.
+
+### Using Azure CLI
+Run the following command to list App Service Environments:
+```bash
+az appservice ase list
+```
+
+For each App Service Environment, ensure that `clusterSettings` includes:
+```json
+{
+  "name": "DisableTls1.0",
+  "value": "1"
+}
+```
+
+## Expected Result
+The `clusterSettings` should include a `DisableTls1.0` setting with value `"1"`. In the portal, `Allow TLS 1.0 and 1.1` should be set to `Off`.
+
+## Remediation
+
+### Using Azure Portal
+1. Go to `App Service Environments`.
+2. Click the name of an App Service Environment.
+3. Under `Settings`, click `Configuration`.
+4. Next to `Allow TLS 1.0 and 1.1`, click the radio button next to `Off`.
+5. Click `Save`.
+6. Click `Continue`.
+7. Repeat steps 1-6 for each App Service Environment requiring remediation.
+
+## Default Value
+TLS 1.0 and 1.1 are allowed by default.
+
+## References
+1. https://learn.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-environment-custom-settings
+2. https://learn.microsoft.com/en-us/cli/azure/appservice/ase
+
+## Profile
+Level 1 | Automated

package/skill/CIS_benchmarks/Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-20.1/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: cis-azure-compute-20.1
+description: "Ensure Virtual Machines are utilizing Managed Disks"
+category: cis-azure-compute
+version: "2.0.0"
+author: cyberstrike-official
+tags: [cis, azure, virtual-machines, vm, disks, encryption]
+cis_id: "20.1"
+cis_benchmark: "CIS Microsoft Azure Compute Services Benchmark v2.0.0"
+tech_stack: [azure]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Virtual Machines are utilizing Managed Disks
+
+## Description
+
+Migrate blob-based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include:
+
+1. Default Disk Encryption
+2. Resilience, as Microsoft will manage the disk storage and move around if underlying hardware goes faulty
+3. Reduction of costs over storage accounts
+
+## Rationale
+
+Managed disks are by default encrypted on the underlying hardware, so no additional encryption is required for basic protection. It is available if additional encryption is required. Managed disks are by design more resilient than storage accounts.
+
+For ARM-deployed Virtual Machines, Azure Adviser will at some point recommend moving VHDs to managed disks both from a security and cost management perspective.
+
+## Impact
+
+There are additional costs for managed disks based off of disk space allocated. When converting to managed disks, VMs will be powered off and back on.
+
+## Audit Procedure
+
+### Using Azure Portal
+
+1. Using the search feature, go to `Virtual Machines`
+2. Click the `Manage view` dropdown, then select `Edit columns`
+3. Add `Uses managed disks` to the selected columns
+4. Select `Save`
+5. Ensure all virtual machines listed are using managed disks
+
+### Using Azure PowerShell
+
+```powershell
+Get-AzVM | ForEach-Object {"Name: " + $_.Name;"ManagedDisk Id: " + $_.StorageProfile.OsDisk.ManagedDisk.Id;""}
+```
+
+Example output:
+
+```
+Name: vm1
+ManagedDisk Id: /disk1/id
+
+Name: vm2
+ManagedDisk Id: /disk2/id
+```
+
+If the 'ManagedDisk Id' field is empty the os disk for that vm is not managed.
+
+## Expected Result
+
+All Virtual Machines should have a non-empty `ManagedDisk Id` value, indicating they are using managed disks.
+
+## Remediation
+
+### Using Azure Portal
+
+1. Using the search feature, go to `Virtual Machines`
+2. Select the virtual machine you would like to convert
+3. Select `Disks` in the menu for the VM
+4. At the top select `Migrate to managed disks`
+5. You may follow the prompts to convert the disk and finish by selecting `Migrate` to start the process
+
+**NOTE** VMs will be stopped and restarted after migration is complete.
+
+### Using Azure PowerShell
+
+```powershell
+Stop-AzVM -ResourceGroupName $rgName -Name $vmName -Force
+ConvertTo-AzVMManagedDisk -ResourceGroupName $rgName -VMName $vmName
+Start-AzVM -ResourceGroupName $rgName -Name $vmName
+```
+
+## Default Value
+
+Managed disks or are an option upon the creation of VMs.
+
+## References
+
+1. https://docs.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks
+2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-4-enable-data-at-rest-encryption-by-default
+3. https://docs.microsoft.com/en-us/azure/virtual-machines/faq-for-disks
+4. https://azure.microsoft.com/en-us/pricing/details/managed-disks/
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-20.10/SKILL.md

@@ -0,0 +1,169 @@
+---
+name: cis-azure-compute-20.10
+description: "Ensure Trusted Launch is enabled on Virtual Machines"
+category: cis-azure-compute
+version: "2.0.0"
+author: cyberstrike-official
+tags: [cis, azure, virtual-machines, vm, disks, encryption]
+cis_id: "20.10"
+cis_benchmark: "CIS Microsoft Azure Compute Services Benchmark v2.0.0"
+tech_stack: [azure]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure Trusted Launch is enabled on Virtual Machines
+
+## Description
+
+When **Secure Boot** and **vTPM** are enabled together, they provide a strong foundation for protecting your VM from boot attacks. For example, if an attacker attempts to replace the bootloader with a malicious version, Secure Boot will prevent the VM from booting. If the attacker is able to bypass Secure Boot and install a malicious bootloader, vTPM can be used to detect the intrusion and alert you.
+
+## Rationale
+
+Secure Boot and vTPM work together to protect your VM from a variety of boot attacks, including bootkits, rootkits, and firmware rootkits. Not enabling Trusted Launch in Azure VM can lead to increased vulnerability to rootkits and boot-level malware, reduced ability to detect and prevent unauthorized changes to the boot process, and a potential compromise of system integrity and data security.
+
+## Impact
+
+Secure Boot and vTPM are not currently supported for Azure Generation 1 VMs.
+
+**IMPORTANT:** Before enabling Secure Boot and vTPM on a Generation 2 VM which does not already have both enabled, it is highly recommended to create a restore point of the VM prior to remediation.
+
+## Audit Procedure
+
+### Using Azure Portal
+
+1. Go to Virtual Machines
+2. For each VM, under Settings, click on Configuration on the left blade
+3. Under Security Type, make sure security type is not standard and if it is Trusted Launch Virtual Machines then make sure Enable Secure Boot & Enable vTPM are checked
+
+### Using Azure CLI
+
+Run the following command to list VM names and security profile settings:
+
+```bash
+az vm list --query [*].[name,securityProfile]
+```
+
+For each VM, ensure that `securityType` is set to `TrustedLaunch`, `uefiSettings.secureBootEnabled` is set to `true`, and `uefiSettings.vTpmEnabled` is set to `true`.
+
+### Using Azure PowerShell
+
+Run the following command to list VMs:
+
+```powershell
+Get-AzVm
+```
+
+Run the following command to get the VM in a resource group with a given name:
+
+```powershell
+$vm = Get-AzVm -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Run the following command to get the security profile settings for the VM:
+
+```powershell
+$vm.SecurityProfile
+```
+
+Ensure that `SecurityType` is set to `TrustedLaunch`.
+
+Run the following command to get the UEFI settings for the VM:
+
+```powershell
+$vm.SecurityProfile.UefiSettings
+```
+
+Ensure that `SecureBootEnabled` and `VTpmEnabled` are set to `True`.
+Repeat for each VM.
+
+## Expected Result
+
+All VMs should have `securityType` set to `TrustedLaunch` with both `secureBootEnabled` and `vTpmEnabled` set to `true`.
+
+## Remediation
+
+**Note:** Trusted launch on existing virtual machines (VMs) is currently not supported for Azure Generation 1 VMs.
+
+### Using Azure Portal
+
+1. Go to Virtual Machines.
+2. For each VM, under Settings, click on Configuration on the left blade.
+3. Under Security Type, select 'Trusted Launch Virtual Machines'.
+4. Make sure Enable Secure Boot & Enable vTPM are checked.
+5. Click on Apply.
+
+### Using Azure CLI
+
+Ensure that it is safe to change the state of the VM.
+
+Run the following command to deallocate the VM:
+
+```bash
+az vm deallocate --resource-group <resource-group> --name <vm>
+```
+
+Run the following command to update the VM, setting security type to `TrustedLaunch` and enabling `secure boot` and `vTPM`:
+
+```bash
+az vm update --resource-group <resource-group> --name <vm> --enable-secure-boot true --enable-vtpm true --security-type TrustedLaunch
+```
+
+Run the following command to restart the VM:
+
+```bash
+az vm start --resource-group <resource-group> --name <vm>
+```
+
+Repeat for each VM requiring remediation.
+
+### Using Azure PowerShell
+
+Ensure it is safe to change the state of the VM.
+
+Run the following command to stop the VM:
+
+```powershell
+Stop-AzVm -ResourceGroupName <resource-group> -Name <vm> -Force
+```
+
+Run the following command to get the VM in a resource group with a given name:
+
+```powershell
+$vm = Get-AzVM -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Run the following command to update the VM, setting security type to `TrustedLaunch` and enabling `secure boot` and `vTPM`:
+
+```powershell
+Update-AzVm -ResourceGroupName <resource-group> -VM $vm -EnableSecureBoot 1 -EnableVtpm 1 -SecurityType TrustedLaunch
+```
+
+Run the following command to start the VM:
+
+```powershell
+Start-AzVm -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Repeat for each VM requiring remediation.
+
+## Default Value
+
+On Azure Generation 2 VMs, vTPM is enabled by default. Secure Boot is not enabled by default.
+
+## References
+
+1. https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vm?tabs=portal
+2. https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-existing-vm?tabs=portal#enable-trusted-launch-on-existing-vm
+3. https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch#secure-boot
+4. https://learn.microsoft.com/en-us/cli/azure/vm
+5. https://learn.microsoft.com/en-us/powershell/module/az.compute/get-azvm
+6. https://learn.microsoft.com/en-us/powershell/module/az.compute/stop-azvm
+7. https://learn.microsoft.com/en-us/powershell/module/az.compute/update-azvm
+8. https://learn.microsoft.com/en-us/powershell/module/az.compute/start-azvm
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-20.11/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: cis-azure-compute-20.11
+description: "Ensure that encryption at host is enabled"
+category: cis-azure-compute
+version: "2.0.0"
+author: cyberstrike-official
+tags: [cis, azure, virtual-machines, vm, disks, encryption]
+cis_id: "20.11"
+cis_benchmark: "CIS Microsoft Azure Compute Services Benchmark v2.0.0"
+tech_stack: [azure]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure that encryption at host is enabled
+
+## Description
+
+Encryption at host enhances Azure Disk Storage Server-Side Encryption to ensure that all temporary disks and disk caches are encrypted at rest and flow encrypted to the storage clusters.
+
+## Rationale
+
+Encryption at host provides an additional layer of security to protect sensitive information.
+
+## Impact
+
+- Virtual machines must be deallocated for encryption at host to be enabled.
+- Encryption at host does not use virtual machine CPU, and does not impact virtual machine performance.
+- Encryption at host cannot be enabled on virtual machines that have ever had Azure Disk Encryption enabled.
+
+## Audit Procedure
+
+### Using Azure Portal
+
+1. Go to `Virtual machines`.
+2. Click the name of a virtual machine.
+3. In the `Properties` pane, under `Disk`, ensure that `Encryption at host` is set to `Enabled`.
+4. Repeat steps 1-3 for each virtual machine.
+
+### Using Azure CLI
+
+Run the following command to list VM names and security profile settings:
+
+```bash
+az vm list --query [*].[name,securityProfile]
+```
+
+For each VM, ensure that `encryptionAtHost` is set to `true`.
+
+### Using Azure PowerShell
+
+Run the following command to list VMs:
+
+```powershell
+Get-AzVm
+```
+
+Run the following command to get the VM in a resource group with a given name:
+
+```powershell
+$vm = Get-AzVm -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Run the following command to get the security profile settings for the VM:
+
+```powershell
+$vm.SecurityProfile
+```
+
+Ensure that `EncryptionAtHost` is set to `True`.
+Repeat for each VM.
+
+## Expected Result
+
+All VMs should have `encryptionAtHost` set to `true` in the security profile.
+
+## Remediation
+
+**Note:** Encryption at host must first be enabled in a subscription before it can be used for virtual machines.
+
+1. From Azure Portal, select the Cloud Shell icon.
+2. Run the following command to set the context to the current subscription:
+
+```powershell
+Set-AzContext -SubscriptionId <subscription-id>
+```
+
+3. Run the following command to register the encryption at host feature for the subscription:
+
+```powershell
+Register-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute"
+```
+
+4. Run the following command to confirm that the `RegistrationState` is `Registered`:
+
+```powershell
+Get-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute"
+```
+
+### Using Azure Portal
+
+**Note:** Ensure that it is safe to change the state of the VM.
+
+1. Go to `Virtual machines`.
+2. Click the name of a virtual machine.
+3. Click `Stop`.
+4. Click `Yes`.
+5. Under `Settings`, click `Disks`.
+6. Click `Additional settings`.
+7. Next to `Encryption at host`, select `Yes`.
+8. Click `Save`.
+9. Click `Overview`.
+10. Click `Start`.
+11. Repeat steps 1-10 for each virtual machine requiring remediation.
+
+### Using Azure CLI
+
+**Note:** Ensure that it is safe to change the state of the VM.
+
+Run the following command to deallocate the VM:
+
+```bash
+az vm deallocate --resource-group <resource-group> --name <vm>
+```
+
+Run the following command to update the VM, enabling `encryptionAtHost`:
+
+```bash
+az vm update --resource-group <resource-group> --name <vm> --set securityProfile.encryptionAtHost=true
+```
+
+Run the following command to restart the VM:
+
+```bash
+az vm start --resource-group <resource-group> --name <vm>
+```
+
+Repeat for each VM requiring remediation.
+
+### Using Azure PowerShell
+
+**Note:** Ensure that it is safe to change the state of the VM.
+
+Run the following command to stop the VM:
+
+```powershell
+Stop-AzVm -ResourceGroupName <resource-group> -Name <vm> -Force
+```
+
+Run the following command to get the VM in a resource group with a given name:
+
+```powershell
+$vm = Get-AzVM -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Run the following command to update the VM, enabling `encryptionAtHost`:
+
+```powershell
+Update-AzVm -ResourceGroupName <resource-group> -VM $vm -EncryptionAtHost 1
+```
+
+Run the following command to start the VM:
+
+```powershell
+Start-AzVm -ResourceGroupName <resource-group> -Name <vm>
+```
+
+Repeat for each VM requiring remediation.
+
+## Default Value
+
+Encryption at host is disabled by default.
+
+## References
+
+1. https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview
+2. https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#encryption-at-host---end-to-end-encryption-for-your-vm-data
+3. https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal
+
+## Profile
+
+Level 1 | Automated

package/skill/CIS_benchmarks/Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-20.2/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: cis-azure-compute-20.2
+description: "Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)"
+category: cis-azure-compute
+version: "2.0.0"
+author: cyberstrike-official
+tags: [cis, azure, virtual-machines, vm, disks, encryption]
+cis_id: "20.2"
+cis_benchmark: "CIS Microsoft Azure Compute Services Benchmark v2.0.0"
+tech_stack: [azure]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
+
+## Description
+
+Ensure that OS disks (boot volumes) and data disks (non-boot volumes) are encrypted with CMK (Customer Managed Keys). Customer Managed keys can be either ADE or Server Side Encryption (SSE).
+
+## Rationale
+
+Encrypting the IaaS VM's OS disk (boot volume) and Data disks (non-boot volume) ensures that the entire content is fully unrecoverable without a key, thus protecting the volume from unwanted reads. PMK (Platform Managed Keys) are enabled by default in Azure-managed disks and allow encryption at rest. CMK is recommended because it gives the customer the option to control which specific keys are used for the encryption and decryption of the disk. The customer can then change keys and increase security by disabling them instead of relying on the PMK key that remains unchanging. There is also the option to increase security further by using automatically rotating keys so that access to disk is ensured to be limited. Organizations should evaluate what their security requirements are, however, for the data stored on the disk. For high-risk data using CMK is a must, as it provides extra steps of security. If the data is low risk, PMK is enabled by default and provides sufficient data security.
+
+## Impact
+
+Using CMK/BYOK will entail additional management of keys.
+
+**NOTE:** You must have your key vault set up to utilize this.
+
+## Audit Procedure
+
+### Using Azure Portal
+
+1. Go to `Virtual machines`.
+2. For each virtual machine, go to `Settings`.
+3. Click on `Disks`.
+4. Ensure that the `OS disk` and `Data disks` have encryption set to CMK.
+
+### Using Azure PowerShell
+
+```powershell
+$ResourceGroupName="yourResourceGroupName"
+$DiskName="yourDiskName"
+
+$disk=Get-AzDisk -ResourceGroupName $ResourceGroupName -DiskName $DiskName
+$disk.Encryption.Type
+```
+
+## Expected Result
+
+The encryption type for all OS and Data disks should indicate Customer Managed Key (CMK) encryption, not Platform Managed Key (PMK).
+
+## Remediation
+
+### Using Azure Portal
+
+**Note:** Disks must be detached from VMs to have encryption changed.
+
+1. Go to `Virtual machines`
+2. For each virtual machine, go to `Settings`
+3. Click on `Disks`
+4. Click the ellipsis `(...)`, then click `Detach` to detach the disk from the VM
+5. Now search for `Disks` and locate the unattached disk
+6. Click the disk then select `Encryption`
+7. Change your encryption type, then select your encryption set
+8. Click `Save`
+9. Go back to the VM and re-attach the disk
+
+### Using Azure PowerShell
+
+```powershell
+$KVRGname = 'MyKeyVaultResourceGroup';
+$VMRGName = 'MyVirtualMachineResourceGroup';
+$vmName = 'MySecureVM';
+$KeyVaultName = 'MySecureVault';
+$KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
+$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
+$KeyVaultResourceId = $KeyVault.ResourceId;
+
+Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGname -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;
+```
+
+**NOTE:** During encryption it is likely that a reboot will be required. It may take up to 15 minutes to complete the process. For Linux machines you may need to set the `-skipVmBackup` parameter.
+
+## Default Value
+
+By default, Azure disks are encrypted using SSE with PMK.
+
+## References
+
+1. https://docs.microsoft.com/azure/security/fundamentals/azure-disk-encryption-vms-vmss
+2. https://docs.microsoft.com/en-us/azure/security-center/security-center-disk-encryption?toc=%2fazure%2fsecurity%2ftoc.json
+3. https://docs.microsoft.com/azure/security/fundamentals/data-encryption-best-practices#protect-data-at-rest
+4. https://docs.microsoft.com/en-us/rest/api/compute/disks/delete
+5. https://docs.microsoft.com/en-us/rest/api/compute/disks/update#encryptionsettings
+6. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required
+7. https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-enable-customer-managed-keys-powershell
+8. https://docs.microsoft.com/en-us/azure/virtual-machines/disk-encryption
+
+## Profile
+
+Level 2 | Automated