Description

Detects Azure Network Security Groups (NSGs) that allow unrestricted access to RPC port 135 from any IP address. Unrestricted RPC access could enable attackers to remotely execute malicious code or exploit vulnerabilities in the RPC service, potentially compromising the affected systems.

Detection Strategy

• Examines each security rule in Azure Network Security Groups

• Reports a vulnerability when a rule allows inbound traffic to port 135 (RPC) from any source IP address ('*' or '0.0.0.0/0')

• Checks both TCP protocol and wildcard (*) protocol rules that could allow RPC access

• Considers both source_address_prefix and source_address_prefixes fields in NSG rules