Description

Detects Azure Network Security Group rules that allow unrestricted inbound ICMP (ping) traffic from overly permissive source ranges. This configuration could enable network scanning and reconnaissance attacks by allowing ping requests from any source.

Detection Strategy

• Scans Network Security Group inbound rules for ICMP protocol or wildcard (*) protocol settings

• Checks if the source address prefix/prefixes include overly permissive ranges like '0.0.0.0/0', '*', 'Internet', or 'Any'

• Reports a vulnerability when an NSG rule allows ICMP traffic from unrestricted source IP ranges