Description

Detects Azure Network Security Group (NSG) rules that allow inbound traffic to dangerous ports from broad source IP ranges. This configuration could expose sensitive services to unauthorized access from the internet, potentially enabling attackers to exploit vulnerable services.

Detection Strategy

• Rule direction must be 'Inbound'

• Rule access must be 'Allow'

• Protocol must be either 'TCP' or '*' (all protocols)

• Source address prefixes include overly permissive ranges (like 0.0.0.0/0 or '*')

• Destination port ranges include sensitive ports commonly targeted by attackers