Competition Checklist · 08 · Services
Services & Remote Access Checklist
Identify required services, investigate unknown listeners, review RDP, SSH, WinRM, VTY access, service accounts, firewall exposure, and dependencies before disabling anything network-facing.
The objective is not to minimize the number of running services. The objective is to preserve required functionality while reducing unnecessary or suspicious exposure.
Quick Use
Service rule
Required does not mean unrestricted, and unfamiliar does not mean unnecessary
A required service can still be hardened by limiting who can reach it, while an unfamiliar service must be investigated before it is stopped. Make the smallest change that solves the confirmed problem.
Opening pass
Understand service purpose before changing state
Read the mission before stopping, disabling, uninstalling, or reconfiguring any service.
A listening service may be required for file sharing, administration, web access, monitoring, backup, directory services, or another competition requirement.
Record which remote-access methods are explicitly required.
RDP, SSH, WinRM, VTY access, or other management channels should match the scenario instead of a generic hardening rule.
Map listeners to services and processes before changing them.
A port number alone does not tell you whether the listener is malicious, unnecessary, or mission-critical.
Identify service dependencies and service accounts.
Stopping one service can break another role, and changing a service identity can disrupt required functionality.
Preserve evidence for unknown services or listeners.
Record names, paths, accounts, PIDs, ports, timestamps, and logs before remediation changes the state.
Plan how required functionality will be tested after each major change.
A service change is not complete until the mission function is verified.
Windows services
Review service state, identity, path, and dependencies
Running services
Get-Service | Where-Object Status -eq Running | Sort-Object Name
Every unusual running service is classified as required, expected, suspicious, or unresolved.
Service details
Get-CimInstance Win32_Service | Select-Object Name,State,StartMode,StartName,PathName
Service path, startup mode, account, and current state are understood before modification.
Service installation evidence
Get-WinEvent -FilterHashtable @{LogName="System"; Id=7045} -MaxEvents 100Recently installed services are correlated with executable paths and timestamps.
Service dependencies
Get-Service <ServiceName> -DependentServices
Get-Service <ServiceName> -RequiredServices
Required dependencies are known before a service is stopped or disabled.
Windows remote access
Review RDP, WinRM, users, and firewall exposure
RDP service
Get-Service TermService
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
RDP state matches the mission and the listener is present only when required.
RDP users
Get-LocalGroupMember "Remote Desktop Users"
Only approved remote users retain access.
WinRM
Get-Service WinRM
Get-NetTCPConnection -LocalPort 5985,5986 -ErrorAction SilentlyContinue
PowerShell remoting is enabled only when needed and is understood before changes.
Firewall exposure
Get-NetFirewallRule -Enabled True | Get-NetFirewallPortFilter
Firewall rules expose only the services the scenario requires.
Linux services
Review systemd services before disabling them
Running services
systemctl --type=service --state=running
Unexpected daemons are investigated by purpose, package, user, and executable path.
Enabled services
systemctl list-unit-files --type=service --state=enabled
Automatic startup is justified by mission requirements.
Service configuration
systemctl status <service>
systemctl cat <service>
The unit file, executable, environment, and dependencies are reviewed before changing state.
Service logs
journalctl -u <service> --no-pager -n 100
Recent restarts, failures, and suspicious activity are preserved before remediation.
Linux remote access
Review SSH configuration and evidence
SSH service
systemctl status ssh
systemctl status sshd
SSH state matches the mission.
SSH configuration
sudo sshd -T 2>/dev/null
sudo grep -RInE 'PermitRootLogin|PasswordAuthentication|AllowUsers|AllowGroups' /etc/ssh 2>/dev/null
Remote login settings restrict exposure without blocking approved administrators.
SSH listener
sudo ss -lntp | grep ':22'
The listener is expected, bound appropriately, and owned by the correct process.
Authentication evidence
sudo grep -Ei 'sshd.*(Accepted|Failed)' /var/log/auth.log | tail -n 100
sudo journalctl -u ssh --no-pager -n 100
Successful and failed remote sessions are correlated with approved users and times.
Cisco remote access
Protect VTY and SSH management paths
VTY lines
show running-config | section line vty
Remote management access methods and ACL restrictions match the mission.
SSH state
show ip ssh
SSH is available when required and insecure alternatives are not enabled unnecessarily.
Local management users
show running-config | include username
Only approved local device administrators remain.
Management ACLs
show access-lists
show running-config | include access-class
VTY access is restricted to approved management sources when required.
Listener mapping
Turn ports into service context
Windows
Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess
Get-Process -Id <PID>
Tie each important listener to a process and then to the related Windows service or application.
Linux
sudo ss -lntup
ps -fp <PID>
Tie sockets to the owning process, executable, and service unit.
Cisco
show control-plane host open-ports
show running-config | section line vty
Confirm exposed management services and required device-control protocols.
Decision model
Match the response to the actual service state
Required and secure
Leave it enabled, document why it is needed, and verify the protection around it.
Required but overexposed
Keep the service, reduce unnecessary access, and verify required clients still connect.
Not required and inactive
Disable automatic start if justified, then verify nothing depends on it.
Not required and listening
Preserve evidence, confirm no dependency exists, then stop or disable it.
Unknown
Investigate executable path, package, account, logs, listeners, dependencies, and mission context before changing anything.
Suspicious
Preserve service, process, network, path, and log evidence before containment.
High-priority findings
Preserve evidence before removing exposure
RDP enabled with unapproved users
Record group membership, recent logons, service state, and firewall exposure before removing access.
SSH enabled when the mission does not require it
Preserve login and configuration evidence, confirm no approved administration depends on it, then disable or restrict it.
Unknown service listening externally
Record service name, executable path, account, PID, port, connections, logs, and install time before containment.
Service running as excessive privilege
Identify the required service function and minimum rights before changing its account.
Broad firewall or ACL exposure
Confirm required clients and ports, then narrow only the unnecessary exposure.
Required service stopped
Restore mission-critical functionality first, verify it, then investigate why the state changed.
Do not blindly change
Common service-hardening mistakes
Do not disable every service you do not recognize.
Do not close a port until you know which service owns it.
Do not disable RDP if the competition mission requires remote administration.
Do not disable SSH merely because it is listening.
Do not remove a service account before identifying dependencies.
Do not change firewall policy in bulk just to reduce the number of open ports.
Do not restart a suspicious service before preserving logs and process context.
Do not assume a service is safe only because its display name sounds legitimate.
Verification sweep
Prove required services still work after remediation
Required services
Every mission-required service is running and usable.
Unneeded services
Services changed during remediation were confirmed unnecessary and remain disabled as intended.
RDP
RDP state, users, listener, and firewall exposure match the scenario.
SSH
SSH state, allowed users, listener, and authentication settings match the mission.
WinRM / management
Remote management is available only where required and from approved sources.
Listeners
Every significant listener is mapped to a known service, process, or approved device function.
Dependencies
No required role, application, share, or automation broke after service changes.
Evidence
Unknown or suspicious service evidence was preserved before containment.
Services & Remote Access final checklist
Finish with required functionality and controlled exposure
The mission was reviewed before service or remote-access changes.
Required services were identified and protected.
Unknown services were investigated by path, account, state, and dependencies.
Listeners were mapped to processes or services.
RDP state matches the mission.
RDP users match the approved roster.
SSH state matches the mission.
SSH configuration restricts access appropriately.
WinRM or other management services were reviewed where relevant.
Firewall or ACL exposure matches required clients and ports.
Service accounts were reviewed before privilege changes.
Suspicious services were documented before containment.
Required functionality was retested after every high-impact change.
The change log records service and remote-access remediation.