MCADDF

[MISCONFIG-007]: Open Network Security Groups

Metadata

| Attribute | Details | |—|—| | Technique ID | MISCONFIG-007 | | MITRE ATT&CK v18.1 | Cloud Service Discovery (T1526) | | Tactic | Discovery / Initial Access / Lateral Movement | | Platforms | Azure Virtual Network, Network Security Groups (NSG), Azure IaaS VMs, PaaS services | | Severity | Critical | | Technique Status | ACTIVE | | Last Verified | 2026-01-10 | | Affected Versions | All Azure subscriptions using NSGs for traffic filtering (all regions) | | Patched In | N/A – design allows broad rules; mitigated via proper NSG configuration, just‑in‑time access, and Azure Policy/Defender recommendations. | | Author | SERVTEP – Artur Pchelnikau |

2. EXECUTIVE SUMMARY

Operational Risk

Compliance Mappings

| Framework | Control / ID | Description | |—|—|—| | CIS Azure Foundations | AZURE 6.x – Network Security | Requires restricting NSG rules from allowing Any/0.0.0.0/0 to sensitive ports; implement least‑privilege network access. | | DISA STIG | SRG‑NET‑000193 | Prohibits unrestricted inbound access; mandates firewall rules to restrict to authorized sources. | | CISA SCuBA | Network Segmentation | Guidance for segmenting cloud networks and avoiding flat, internet‑exposed VNets. | | NIST 800‑53 Rev5 | SC‑7, AC‑4, AC‑6 | Boundary protection and information flow enforcement; open NSGs violate least privilege and boundary safeguards. | | GDPR | Art. 32 | Appropriate security including network controls; open management ports to the internet endanger personal data. | | DORA | Art. 9 | Requires robust ICT security measures, including secure network configuration for critical financial workloads. | | NIS2 | Art. 21 | Technical measures for risk management – includes segmentation and limiting exposure of critical systems. | | ISO 27001:2022 | A.8.20, A.8.21 | Security of network services and network segregation. | | ISO 27005 | “Publicly Exposed Management Interface” | Risk scenario: remote management exposed to the internet through misconfigured NSGs. |

3. TECHNICAL PREREQUISITES

Supported Versions:

4. ENVIRONMENTAL RECONNAISSANCE

Management Station / PowerShell Reconnaissance

Connect-AzAccount

Get-AzSubscription | ForEach-Object {
  Set-AzContext -SubscriptionId $_.Id | Out-Null
  Get-AzNetworkSecurityGroup | ForEach-Object {
    $nsg = $_
    $nsg.SecurityRules | Where-Object {
      $_.Direction -eq 'Inbound' -and $_.Access -eq 'Allow' -and \
      ($_.SourceAddressPrefix -eq '0.0.0.0/0' -or $_.SourceAddressPrefix -eq 'Internet' -or $_.SourceAddressPrefix -eq '*')
    } | Select-Object @{n='Subscription';e={$_.Id.Split('/')[-5]}},
                       @{n='NSG';e={$nsg.Name}}, Name, Priority,
                       SourceAddressPrefix, DestinationAddressPrefix,
                       DestinationPortRange, Protocol
  }
} | Sort-Object Priority | Format-Table -AutoSize

What to Look For:

Azure CLI / Bash Reconnaissance

az network nsg list --query "[].{name:name, resourceGroup:resourceGroup, securityRules:securityRules}" -o json > nsgs.json

# Quick jq filter for open inbound rules
cat nsgs.json | jq '.[] | {name, resourceGroup, 
  openRules: (.securityRules[] | select(.direction=="Inbound" and .access=="Allow" and 
    (.sourceAddressPrefix=="*" or .sourceAddressPrefix=="0.0.0.0/0" or .sourceAddressPrefix=="Internet")))}'

Network Watcher – IP Flow Verify

5. DETAILED EXECUTION METHODS AND THEIRS STEPS

METHOD 1 – Exploiting Open NSGs from the Internet

Supported Versions: All Azure VNets/VMs with NSGs exposing management or application ports broadly.

Step 1: Scan for Exposed Ports

Objective: Identify open NSG‑exposed ports on Azure public IPs.

Command (Attacker – Nmap):

nmap -Pn -p 22,80,443,3389,5985,5986 <public-ip-range>

Expected Output:

Step 2: Attempt Brute Force or Exploit

Objective: Use exposed RDP/SSH/HTTP services for compromise.

Example:

What This Means:

METHOD 2 – Creating an Open NSG Rule (Misconfiguration)

Supported Versions: All Azure environments using NSGs.

Step 1: Create Rule Allowing Any/Any from Internet

Command (Azure CLI):

RG="rg-app"
NSG="nsg-web"

az network nsg rule create \
  --resource-group $RG \
  --nsg-name $NSG \
  --name Allow-Any-RDP \
  --priority 100 \
  --access Allow \
  --protocol Tcp \
  --direction Inbound \
  --source-address-prefixes 0.0.0.0/0 \
  --source-port-ranges "*" \
  --destination-port-ranges 3389 \
  --destination-address-prefixes "*"

Expected Output:

References & Proofs:

6. ATTACK SIMULATION & VERIFICATION (Atomic Red Team)

No specific Atomic test exists for Azure NSG misconfiguration, but threat emulation can leverage:

Security teams can:

7. TOOLS & COMMANDS REFERENCE

Azure PowerShell – NSG Management

Install-Module Az.Network -Scope CurrentUser
Import-Module Az.Network

Get-AzNetworkSecurityGroup -Name "nsg-web" -ResourceGroupName "rg-app" |
  Select-Object -ExpandProperty SecurityRules

Azure CLI – NSG Management

az network nsg rule list --resource-group rg-app --nsg-name nsg-web -o table

Script (One-Liner – Detect Open NSG Rules)

Connect-AzAccount

Get-AzSubscription | ForEach-Object {
  Set-AzContext -SubscriptionId $_.Id | Out-Null
  Get-AzNetworkSecurityGroup | ForEach-Object {
    $nsg = $_
    $nsg.SecurityRules | Where-Object {
      $_.Direction -eq 'Inbound' -and $_.Access -eq 'Allow' -and \
      ($_.SourceAddressPrefix -in @('*','0.0.0.0/0','Internet'))
    } | Select-Object @{n='Subscription';e={$_.Id.Split('/')[-5]}},
                       @{n='NSG';e={$nsg.Name}}, Name, Priority,
                       SourceAddressPrefix, DestinationPortRange
  }
}

8. SPLUNK DETECTION RULES

Rule 1: Overly Permissive NSG Inbound Rules Created or Modified

Rule Configuration:

SPL Query:

index=azure_activity ResourceProviderValue="MICROSOFT.NETWORK" \
  operationName="Microsoft.Network/networkSecurityGroups/securityRules/write"
| eval props = spath(_raw, "properties")
| eval ruleProps = spath(props, "properties")
| eval direction = spath(ruleProps, "direction"),
       access = spath(ruleProps, "access"),
       src = spath(ruleProps, "sourceAddressPrefix"),
       src2 = spath(ruleProps, "sourceAddressPrefixes{}"),
       destPort = spath(ruleProps, "destinationPortRange")
| where direction="Inbound" AND access="Allow" AND \
  (src="*" OR src="0.0.0.0/0" OR src="Internet" OR like(src2, "%0.0.0.0/0%"))
| stats latest(_time) AS lastChange BY resourceId, src, destPort

What This Detects:

Source: Microsoft Defender for Cloud networking recommendations and Azure Policy definitions that identify overly permissive NSGs.

9. MICROSOFT SENTINEL DETECTION

Query 1: All Network Ports Should Be Restricted – NSG Rule Monitoring

Rule Configuration:

KQL Query:

AzureActivity
| where ResourceProviderValue == "MICROSOFT.NETWORK" 
| where OperationNameValue == "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE"
| extend props = parse_json(Properties)
| extend rule = parse_json(tostring(props.responseBody.properties))
| extend direction = tostring(rule.direction),
         access = tostring(rule.access),
         src = tostring(rule.sourceAddressPrefix),
         destPort = tostring(rule.destinationPortRange)
| where direction =~ "Inbound" and access =~ "Allow" and 
      (src in ("*","0.0.0.0/0","Internet"))
| project TimeGenerated, ResourceId, direction, access, src, destPort, Caller

What This Detects:

Source: Defender for Cloud networking recommendations – “All network ports should be restricted on network security groups associated to your virtual machine.”

10. WINDOWS EVENT LOG MONITORING

Windows event logs are not directly involved in NSG evaluation, but:

11. SYSMON DETECTION PATTERNS

Sysmon can help detect repeated failed inbound connections at the host and suspicious execution triggered by remote access.

Example:

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alerts

Alert Names (examples):

Manual Configuration Steps:

  1. Enable Defender for Cloud for subscriptions.
  2. Review Networking recommendations; remediate NSGs flagged as overly permissive.
  3. Enable Just‑in‑time VM access for RDP/SSH to close NSG ports by default and open them only on demand.

13. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Not applicable directly; NSG configuration is logged in Azure Activity logs, not the M365 unified audit log. Use Sentinel/Log Analytics and Defender for Cloud for governance.

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Validation Command (Verify Fix)

Connect-AzAccount
Get-AzSubscription | ForEach-Object {
  Set-AzContext -SubscriptionId $_.Id | Out-Null
  Get-AzNetworkSecurityGroup | ForEach-Object {
    $nsg = $_
    $open = $nsg.SecurityRules | Where-Object {
      $_.Direction -eq 'Inbound' -and $_.Access -eq 'Allow' -and \
      ($_.SourceAddressPrefix -in @('*','0.0.0.0/0','Internet'))
    }
    if ($open) {
      Write-Output "[!] Open inbound rules in $($nsg.Name) in subscription $($_.Id.Split('/')[-5])"
    }
  }
}

Expected Output (If Secure):

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate:
    • Immediately update NSGs to block external access; consider deallocating or isolating compromised VMs.
  2. Collect Evidence:
    • Export Azure Activity and NSG diagnostics; collect host logs and memory images for compromised machines.
  3. Remediate:
    • Reset credentials, rebuild or restore VMs from clean images, implement hardened NSGs and JIT.
Step Phase Technique Description
1 Discovery T1526 – Cloud Service Discovery Attacker enumerates public IPs and NSGs in Azure.
2 Initial Access T1021 – Remote Services Exploitation of exposed RDP/SSH services.
3 Current Step MISCONFIG-007 – Open Network Security Groups Misconfiguration enables direct access to internal workloads.
4 Lateral Movement T1021/T1021.004 Pivoting from compromised VMs to others.
5 Impact DATA-EXFIL-XXX / IMPACT-XXX Data theft or destructive actions once inside VNet.

17. REAL-WORLD EXAMPLES

Example 1: Brute Force Against Exposed RDP/SSH in Azure

Example 2: Misconfigured NSGs and Insecure APIs in Azure (Research Case Study)

This site is open source. Improve this page.