CIS Controls CIS-4.8

Disabling unnecessary remote services eliminates the corresponding authentication and remote-access path, directly reducing lateral movement opportunities.

Disabling Remote Desktop Services where RDP is not operationally required prevents adversaries from connecting through that service.

Disabling unnecessary SMB file sharing and administrative shares directly removes common lateral movement, file-transfer, and remote-management paths.

Disabling DCOM when it is not required removes a remote RPC-based execution and management interface that adversaries may abuse.

Disabling the SSH daemon or Remote Login on systems that do not require it eliminates an SSH-based remote-access path.

Uninstalling unnecessary VNC server software removes the listener and prevents remote control through that implementation.

Disabling the WinRM service where it is unnecessary removes a remote command-execution and administration interface.

Disabling unnecessary cloud-native VM connection types, serial consoles, or direct management services eliminates those remote-administration paths.

Removing unnecessary shared folders and file-sharing services prevents adversaries from placing malicious content in those shares for other users or systems to execute.

Uninstalling or disabling unnecessary externally accessible VPN, remote desktop, SSH, and management services directly reduces external entry points.

Removing unused public-facing applications, services, and web modules eliminates exploitable listeners and reduces the externally exposed attack surface.

A remote service that has been disabled or uninstalled can no longer be reached and exploited through its network interface.

Removing unauthorized or unnecessary remote-access products and disabling embedded remote-support functionality directly eliminates those access channels.

Uninstalling unnecessary remote desktop products prevents adversaries from abusing that specific software for persistent or interactive access.

Disabling unnecessary server extension mechanisms and components reduces the features adversaries can abuse to establish persistent server-side access.

Disabling unnecessary web server functionality, scripting engines, and dangerous application functions can prevent particular web shell implementations from executing.

Removing unused IIS modules, handlers, filters, and extensions directly reduces opportunities to install or abuse malicious IIS components.

Disabling unnecessary metadata services or insecure metadata-service versions directly prevents adversary access through those endpoints.

Removing unnecessary configuration-management protocols and repositories reduces the systems and services from which adversaries can collect configuration data.

Disabling SNMP where it is unnecessary removes the management service used to retrieve MIB and configuration information.

Removing unnecessary Telnet, HTTP management, TFTP, legacy SNMP, or similar configuration services reduces direct collection of network-device configurations.

Disabling unnecessary Wi-Fi, cellular, modem, Bluetooth, or other secondary network services removes potential alternative exfiltration channels.

Disabling the Bluetooth service and adapter functionality where it is unnecessary prevents Bluetooth-based data transfer from that asset.

Disabling unnecessary cloud services, command-line integrations, and administrative applications reduces available cloud-management paths, although required web consoles may remain accessible.

Removing unnecessary file-sharing services and shares reduces the network data repositories available for adversary collection.

Removing unnecessary plaintext and broadcast-based services reduces sensitive service traffic available for interception, although it does not prevent sniffing of remaining traffic.

Disabling unnecessary remote WMI and dependent management services reduces remote WMI execution, while local WMI functionality may remain available.

Disabling unnecessary network-device command-line services, especially Telnet or direct CLI access, removes a command interface adversaries could abuse.

Uninstalling unnecessary deployment agents and disabling unused remote-deployment functionality reduces the number of centralized execution mechanisms available to an adversary.

Removing unnecessary proxy, relay, port-forwarding, and tunneling services reduces the ability to turn an enterprise asset into a network intermediary.

Disabling unnecessary internal proxy listeners, SSH forwarding, port proxies, and routing functions impedes the use of a compromised asset as an internal pivot.

Disabling unnecessary SMB, WebClient, WebDAV, LLMNR, NBT-NS, and related services reduces mechanisms that can coerce outbound authentication.

Disabling the Background Intelligent Transfer Service where it is genuinely unnecessary prevents adversary use of BITS for transfer, execution, or persistence.

Removing unnecessary SMB, SSH, WinRM, file-sharing, and deployment services reduces common channels used to move tools between systems.

Disabling unnecessary extended stored procedures, scripting extensions, or database execution features reduces opportunities to establish persistence through the database server.

Removing unused mail transport agents and extension points reduces the components available for adversary persistence in messaging infrastructure.

Disabling unnecessary Terminal Services functionality reduces opportunities to replace or abuse associated DLL components, although required RDP systems remain exposed.

Removing unnecessary vSphere Installation Bundles and disabling unused ESXi extension functionality reduces the components available for hypervisor persistence.

Removing unnecessary container-management utilities, exposed APIs, and administrative services reduces the mechanisms available for remote container commands.

Minimal container images and removal of unnecessary tools, shells, runtimes, and privileged services reduce some prerequisites and post-exploitation options for container escape.

Disabling unnecessary remote services prevents sessions from being established through those services and therefore removes sessions that could later be hijacked.

Disabling unnecessary SSH and agent-forwarding functions removes some SSH sessions and forwarding sockets that adversaries could hijack.

Disabling unnecessary RDP services prevents creation of RDP sessions on those assets, eliminating that session-hijacking opportunity.

Disabling unnecessary Active Directory Certificate Services web enrollment, enrollment agents, legacy authentication protocols, and certificate-service roles reduces certificate abuse paths.

Disabling unnecessary SaaS integrations, plug-ins, application consent features, and service connections reduces the number of integrations an adversary can authorize or abuse.