Description

Detects Azure Network Security Groups (NSGs) that allow unrestricted internet access to MySQL database ports (3306). Having MySQL directly accessible from the internet poses a significant security risk as it could allow unauthorized access to sensitive database contents.

Detection Strategy

• Identifies NSG rules that allow inbound traffic to port 3306 (MySQL) from any source IP address ('*' or '0.0.0.0/0')

• Triggers when an NSG rule allows TCP or any (*) protocol access to MySQL port

• Examines both source_address_prefix and source_address_prefixes fields in NSG rules for overly permissive settings