🛡️ Azure Network Security Group allows unrestricted WinRM traffic🟢

• Contextual name: 🛡️ Network Security Group allows unrestricted WinRM traffic🟢
• ID: /ce/ca/azure/virtual-network/security-group-allows-unrestricted-winrm-traffic
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Network Security Group
  • 🔌 Azure Network Security Group Rule - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Network security groups should be periodically evaluated for port misconfigurations. Where Windows Remote Management (WinRM) access (TCP ports 5985 and 5986) is not explicitly required and narrowly configured for resources attached to a network security group, Internet-level access to Azure resources should be restricted or eliminated.

Rationale

Windows Server enables PowerShell Remoting over WinRM by default and accepts remoting connections only from administrators, so a WinRM port reachable from the Internet exposes administrator remote command execution to password guessing. A compromised virtual machine can then be used to attack other resources on the virtual network or outside Azure.

Audit

This policy marks an Azure Network Security Group as INCOMPLIANT if a current Allow/Inbound TCP or Any rule permits Internet, wildcard, or a global IPv4/IPv6 source to destination ports 5985, 5986, any range containing them, or all ports.

No matching current rule is COMPLIANT within the collected rule scope. This checks permissive rule configuration across all NSGs; it does not simulate priority-based effective routing or approved exceptions. Augmented port rules require manual review when the collector cannot provide usable destination port bounds.

Remediation

Open File

Remediation

Remove unrestricted inbound access to Windows Remote Management (WinRM) on TCP ports 5985 and 5986. Where WinRM is required, restrict access to the approved administrative source IP addresses or CIDR ranges.

Confirm a working alternative administrative path before changing a rule used by administrators or automation. For example, establish a VPN or ExpressRoute connection to the virtual machine's private network. Record the existing rule configuration so you can roll back an unintended change.

From Azure Portal

1. Go to Network security groups and select the affected NSG.
2. Under Settings, select Inbound security rules.
3. Identify Allow rules with protocol TCP or Any that permit traffic from Any, Internet, 0.0.0.0/0, or ::/0 to ports 5985, 5986, Any, or a range containing either port. Review every entry in rules with multiple source prefixes or destination port ranges.
4. Delete a rule dedicated to WinRM if that access is no longer required.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.1.2 Ensure that WinRM Access from the Internet is Evaluated and Restricted (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data