NSG Inbound RDP/SSH Allow Rule from Any Source Modified

Ankit Mehta@Secvyn

•updated Jun 29, 2026•4•0•4

Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.