If an Azure Virtual Machine is associated with a Network Security Group with “management ports” such as RDP (Remote Desktop Protocol on port 3389/TCP) or SSH (Secure Shell protocol on port 22/TCP) exposed to the 'Any' pseudo-class for 'Source,' Microsoft Defender for Cloud will create a security recommendation to highlight that the management port is open to the internet, which allows an administrator to easily recognize that there is a virtual machine in their environment with one or more over-exposed server management ports. It is being disclosed in accordance with Rapid7's vulnerability disclosure policy. This issue was discovered by Aaron Sawitsky, Senior Manager for Cloud Product Integrations at Rapid7. Similar to a firewall, a security group allows you to create rules that limit what IP addresses/ranges can access which ports on one or more virtual machines in the cloud environment. Security groups are a concept that exists in both Azure and Amazon Web Services (AWS) cloud environments. Defender for Cloud is described in detail at the vendor's website. Microsoft Defender for Cloud is a cloud security posture management (CSPM) solution that provides several security capabilities, including the ability to detect misconfigurations in Azure and multi-cloud environments. Note that as of this writing, the same issue appears when using the IPv6 range “::/0” as a synonym for 'any' and Microsoft has not yet fixed this version of the vulnerability. Although the CIDR-notated network of '/0' is often treated as synonymous with 'Any,' they are not equivalent in Defender for Cloud's logic.

Defender for Cloud would only detect an open management port if the source in the port rule is set to the literal alias of “Any”.

This occured when the Network Security Group (NSG) associated with the virtual machine contained a rule that allowed access to one of these ports from the IPv4 range “0.0.0.0/0”. Prior to March 9, 2023, Microsoft Defender for Cloud incorrectly marked some Azure virtual machines as having secured management ports including SSH (port 22/TCP), RDP (port 3389/TCP) and WINRM (port 5985/TCP), when in fact one or more of these ports were exposed to the internet.

Is microsoft defender good enough