Description

Detects Azure Network Security Groups (NSGs) that allow unrestricted access to Microsoft SQL Server ports (1433). This misconfiguration could expose SQL Server instances to the public internet, potentially enabling unauthorized database access and brute force attacks.

Detection Strategy

• Reviews each security rule in Azure Network Security Groups

• Alerts when a rule allows inbound traffic to port 1433 (SQL Server) from any source IP address (0.0.0.0/0 or *)

• Checks both TCP protocol specifically and wildcard (*) protocol settings

• Examines both source_address_prefix and source_address_prefixes fields for overly permissive settings