Check critical ports opened to the entire internet

id: 66d494c0-233c-438a-9b1b-5fe839790d38
name: Check critical ports opened to the entire internet
description: |
  'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
requiredDataConnectors:
  - connectorId: WAF
    dataTypes:
      - AzureDiagnostics
tactics:
  - InitialAccess
query: |

  //Check critical ports opened to the entire internet
  AzureDiagnostics
  | where Category == "NetworkSecurityGroupEvent" 
  | where direction_s == "In" 
  | where conditions_destinationPortRange_s in (
  "22","22-22"          //SSH
  ,"3389","3389-3389"   //RDP
  ,"137","137-137"      //NetBIOS
  ,"138","138-138"      //NetBIOS
  ,"139","139-139"      //SMB
  ,"53","53-53"         //DNS
  ,"3020","3020-3020"   //CIFS
  ,"3306","3306-3306"   //MySQL
  ,"1521","1521-1521"   //Oracle Database
  ,"2483","2483-2483"   //Oracle Database
  ,"5432","5432-5432"   //PostgreSQL
  ,"389","389-389"      //LDAP
  ,"27017","27017-27017"//MongoDB
  ,"20","20-20"         //FTP
  ,"21","21-21"         //FTP
  ,"445","445-445"      //Active Directory
  ,"161","161-161"      //SNMP
  ,"25","25-25"         //SMTP
  )
   or (conditions_destinationPortRange_s == "0-65535" and conditions_sourcePortRange_s == "0-65535")
  | where priority_d < 65000    //Not to check the Azure defaults
  | where conditions_sourceIP_s == "0.0.0.0/0,0.0.0.0/0" or conditions_sourceIP_s == "0.0.0.0/0" //With rules Any/Any
  | where type_s !~ "block"
  | order by TimeGenerated desc
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by OperationName, systemId_g, vnetResourceGuid_g, subnetPrefix_s, macAddress_s, primaryIPv4Address_s, ruleName_s, direction_s, priority_d, type_s, conditions_destinationIP_s, conditions_destinationPortRange_s, conditions_sourceIP_s, conditions_sourcePortRange_s, ResourceId
  | extend timestamp = StartTime
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Alethor
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]