🛡️ Reduction of the attack surface

Windows

Services that run automatically and are currently running.

Get-Service |
  Where-Object { $_.StartType -eq 'Automatic' } |
  Where-Object { $_.Status -eq 'Running' } |
  Sort-Object Name | Select-Object Name, DisplayName

Print on Spooler server not printed (PrintNightmare, CVE-2021-34527):

Stop-Service Spooler
Set-Service Spooler -StartupType Disabled

Set-Service Spooler -StartupType Automatic
Start-Service Spooler

SMBv1 - an outdated protocol used by WannaCry:

Disable-WindowsOptionalFeature -Online `
  -FeatureName SMB1Protocol -NoRestart

Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Checking for success

Get-Service Spooler | Select-Object Name, Status, StartType
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol |
  Select-Object FeatureName, State

macOS

Loaded launchd works and off system services. Shared services are more convenient to manage System Settings, General, Sharing.

sudo launchctl list | grep -v com.apple
sudo launchctl print-disabled system

Remote login (SSH) if not in use. Terminal needs Full Disk Access:

sudo systemsetup -setremotelogin off

sudo systemsetup -setremotelogin on

Screen sharing:

sudo launchctl disable system/com.apple.screensharing

sudo launchctl enable system/com.apple.screensharing

Checking for success

sudo systemsetup -getremotelogin
sudo launchctl print-disabled system | grep screensharing

Linux

Enabled and operating systemd units.

systemctl list-unit-files --type=service --state=enabled
systemctl list-units --type=service --state=running

Printer service on the server (including scant activation):

sudo systemctl disable --now cups.service cups.socket cups.path

sudo systemctl enable --now cups.service cups.socket cups.path

mDNA (Avahi) - announce the device on the local network:

sudo systemctl disable --now avahi-daemon.service avahi-daemon.socket
sudo systemctl mask avahi-daemon.service avahi-daemon.socket

sudo systemctl unmask avahi-daemon.service avahi-daemon.socket
sudo systemctl enable --now avahi-daemon.service

Checking for success

systemctl is-enabled cups.service avahi-daemon.service
systemctl is-active cups.service avahi-daemon.service

Windows

Open ports with process name and firewall profiles.

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort,
  @{ n='Process';
     e={ (Get-Process -Id $_.OwningProcess).ProcessName } }
Get-NetFirewallProfile |
  Select-Object Name, Enabled, DefaultInboundAction

Set-NetFirewallProfile -Profile Domain,Private,Public `
  -Enabled True -DefaultInboundAction Block

Set-NetFirewallProfile -Profile Domain,Private,Public `
  -DefaultInboundAction NotConfigured

Checking for success

Get-NetFirewallProfile | Select-Object Name, DefaultInboundAction
# no citas ierīces - aizvērtais ports nedrīkst atbildēt:
Test-NetConnection <servera-adrese> -Port 3389

macOS

Open TCP and UDP ports and app firewalls.

sudo lsof -iTCP -sTCP:LISTEN -n -P
sudo lsof -iUDP -n -P
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

sudo /usr/libexec/ApplicationFirewall/socketfilterfw \
  --setstealthmode off
sudo /usr/libexec/ApplicationFirewall/socketfilterfw \
  --setglobalstate off

Checking for success

/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

Linux

Open ports with process and active connections.

sudo ss -tulpn
sudo ss -tnp state established

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

sudo ufw disable

Checking for success

sudo ufw status verbose
# no citas ierīces - aizvērtais ports nedrīkst atbildēt:
nc -zv <servera-adrese> 5432

Windows

Launch entries, non-Microsoft planned tasks and full report with Sysinternals Authoruns.

Get-CimInstance Win32_StartupCommand |
  Select-Object Name, Command, Location, User
Get-ScheduledTask |
  Where-Object { $_.State -ne 'Disabled' } |
  Where-Object { $_.TaskPath -notlike '\Microsoft\*' } |
  Select-Object TaskPath, TaskName, State
autorunsc.exe -accepteula -a * -m -s -h -c > autoruns.csv

Disable-ScheduledTask -TaskPath '\' -TaskName 'VecsAtjauninatajs'

Enable-ScheduledTask -TaskPath '\' -TaskName 'VecsAtjauninatajs'

macOS

LaunchAgents and LaunchDaemons folders, background task database (macOS 13+) and cron.

ls -la ~/Library/LaunchAgents \
  /Library/LaunchAgents /Library/LaunchDaemons
sudo sfltool dumpbtm
crontab -l

launchctl bootout gui/$(id -u) \
  ~/Library/LaunchAgents/com.example.updater.plist

launchctl bootstrap gui/$(id -u) \
  ~/Library/LaunchAgents/com.example.updater.plist

Linux

All users cron, system cron folders and systemd timers.

for u in $(cut -d: -f1 /etc/passwd); do
  sudo crontab -l -u "$u" 2>/dev/null | sed "s/^/$u: /"
done
ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly
systemctl list-timers --all

sudo systemctl disable --now vecs-atjauninatajs.timer

sudo systemctl enable --now vecs-atjauninatajs.timer

Windows

Assessment of Security Compliance Toolkit (Policy Analyzer, LGPO) and CIS-CAT Lite against CIS Benchmark. The current security policy can be exported for comparison.

secedit /export /cfg C:\Temp\drosibas-politika.inf
gpresult /h C:\Temp\gpo-atskaite.html

macOS

the test script generated by mSCP shows compliance with the selected baseline. In the organization, the settings are maintained by MDM profiles.

sudo zsh ./<baseline>_compliance.sh --check

Linux

Fast audit with Lynis and full examination with OpenSCAP. Profile name and content file vary by distribution - they are shown in oscap info.

sudo lynis audit system
oscap info /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
sudo oscap xccdf eval --profile <profils> \
  --report atskaite.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml