Analytic rule catalog
GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
Back
| Id | f4f92ca4-6ebe-4f2a-90e5-b0d04b709651 |
| Rulename | GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports |
| Description | This query detects GCP Firewall rules that allow unrestricted (0.0.0.0/0) ingress to high-risk ports using Google Cloud Security Command Center OPEN_FIREWALL findings. Publicly exposed management, database, and service ports (e.g., RDP 3389, SSH 22, SQL 1433/3306) significantly increase the risk of brute-force attacks, exploitation, and lateral movement. |
| Severity | High |
| Tactics | InitialAccess LateralMovement Discovery |
| Techniques | T1133 T1021 T1046 |
| Required data connectors | GoogleSCCDefinition |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPFirewallHighRiskOpenPorts.yaml |
| Version | 1.0.0 |
| Arm template | f4f92ca4-6ebe-4f2a-90e5-b0d04b709651.json |
let HighRiskPorts = dynamic([3389,20,23,110,143,3306,8080,1433,9200,9300,25,445,135,21,1434,4333,5432,5500,5601,22,3000,5000,8088,8888]);
GoogleCloudSCC
| where tostring(Findings.state) == "ACTIVE"
| extend FindingCategory = tostring(Findings.category)
| where FindingCategory == "OPEN_FIREWALL"
| extend FindingsJson = parse_json(Findings)
| extend SourcePropertiesJson = parse_json(tostring(FindingsJson.sourceProperties))
| extend IpRulesJson = parse_json(tostring(FindingsJson.ipRules))
| where tostring(FindingsJson.state) == "ACTIVE"
| where tostring(SourcePropertiesJson.ExternalSourceRanges) contains "0.0.0.0/0"
| extend AllowedIpRules = parse_json(tostring(IpRulesJson.allowed.ipRules))
| mv-expand IpRule = AllowedIpRules
| extend PortRanges = parse_json(tostring(IpRule.portRanges))
| mv-expand PortRange = PortRanges
| extend MinPort = toint(PortRange.min), MaxPort = toint(PortRange.max)
| where MinPort in (HighRiskPorts) or MaxPort in (HighRiskPorts)
| extend
ResourceName = tostring(FindingsJson.resourceName),
FindingName = tostring(FindingsJson.name),
Protocol = tostring(IpRule.protocol),
Severity = tostring(FindingsJson.severity),
Description = tostring(FindingsJson.description),
ExternalUri = tostring(FindingsJson.externalUri),
AttackExposureScore = todouble(FindingsJson.attackExposure.score),
ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
FirewallName = extract(@"firewalls/([^/]+)", 1, tostring(FindingsJson.resourceName))
| extend PortInfo = case(
MinPort == MaxPort, tostring(MinPort),
strcat(tostring(MinPort), "-", tostring(MaxPort))
)
| summarize
TimeGenerated = max(TimeGenerated),
OpenHighRiskPorts = make_set(PortInfo),
Protocols = make_set(Protocol),
AttackExposureScore = max(AttackExposureScore)
by ProjectName, FirewallName, ResourceName, FindingName, Severity, Description, ExternalUri
| extend OpenHighRiskPorts = strcat_array(OpenHighRiskPorts, ", ")
| extend Protocols = strcat_array(Protocols, ", ")
entityMappings:
- entityType: CloudApplication
fieldMappings:
- identifier: Name
columnName: ResourceName
name: GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPFirewallHighRiskOpenPorts.yaml
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: GoogleSCCDefinition
dataTypes:
- GoogleCloudSCC
tactics:
- InitialAccess
- LateralMovement
- Discovery
query: |
let HighRiskPorts = dynamic([3389,20,23,110,143,3306,8080,1433,9200,9300,25,445,135,21,1434,4333,5432,5500,5601,22,3000,5000,8088,8888]);
GoogleCloudSCC
| where tostring(Findings.state) == "ACTIVE"
| extend FindingCategory = tostring(Findings.category)
| where FindingCategory == "OPEN_FIREWALL"
| extend FindingsJson = parse_json(Findings)
| extend SourcePropertiesJson = parse_json(tostring(FindingsJson.sourceProperties))
| extend IpRulesJson = parse_json(tostring(FindingsJson.ipRules))
| where tostring(FindingsJson.state) == "ACTIVE"
| where tostring(SourcePropertiesJson.ExternalSourceRanges) contains "0.0.0.0/0"
| extend AllowedIpRules = parse_json(tostring(IpRulesJson.allowed.ipRules))
| mv-expand IpRule = AllowedIpRules
| extend PortRanges = parse_json(tostring(IpRule.portRanges))
| mv-expand PortRange = PortRanges
| extend MinPort = toint(PortRange.min), MaxPort = toint(PortRange.max)
| where MinPort in (HighRiskPorts) or MaxPort in (HighRiskPorts)
| extend
ResourceName = tostring(FindingsJson.resourceName),
FindingName = tostring(FindingsJson.name),
Protocol = tostring(IpRule.protocol),
Severity = tostring(FindingsJson.severity),
Description = tostring(FindingsJson.description),
ExternalUri = tostring(FindingsJson.externalUri),
AttackExposureScore = todouble(FindingsJson.attackExposure.score),
ProjectName = extract(@"projects/([^/]+)", 1, tostring(FindingsJson.resourceName)),
FirewallName = extract(@"firewalls/([^/]+)", 1, tostring(FindingsJson.resourceName))
| extend PortInfo = case(
MinPort == MaxPort, tostring(MinPort),
strcat(tostring(MinPort), "-", tostring(MaxPort))
)
| summarize
TimeGenerated = max(TimeGenerated),
OpenHighRiskPorts = make_set(PortInfo),
Protocols = make_set(Protocol),
AttackExposureScore = max(AttackExposureScore)
by ProjectName, FirewallName, ResourceName, FindingName, Severity, Description, ExternalUri
| extend OpenHighRiskPorts = strcat_array(OpenHighRiskPorts, ", ")
| extend Protocols = strcat_array(Protocols, ", ")
description: |
This query detects GCP Firewall rules that allow unrestricted (0.0.0.0/0) ingress to high-risk ports using Google Cloud Security Command Center OPEN_FIREWALL findings.
Publicly exposed management, database, and service ports (e.g., RDP 3389, SSH 22, SQL 1433/3306) significantly increase the risk of brute-force attacks, exploitation, and lateral movement.
severity: High
tags:
- PCI-DSS v3.2.1 1.2.1
id: f4f92ca4-6ebe-4f2a-90e5-b0d04b709651
customDetails:
ProjectName: ProjectName
ExternalUri: ExternalUri
FirewallName: FirewallName
FindingId: FindingName
AttackExposureScore: AttackExposureScore
OpenHighRiskPorts: OpenHighRiskPorts
Protocols: Protocols
triggerThreshold: 0
queryFrequency: 1h
alertDetailsOverride:
alertDescriptionFormat: 'GCP Firewall {{FirewallName}} in project {{ProjectName}} allows unrestricted (0.0.0.0/0) ingress to high-risk ports: {{OpenHighRiskPorts}}.'
alertDisplayNameFormat: GCP Firewall {{FirewallName}} allows unrestricted high-risk ports
version: 1.0.0
relevantTechniques:
- T1133
- T1021
- T1046
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f4f92ca4-6ebe-4f2a-90e5-b0d04b709651')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f4f92ca4-6ebe-4f2a-90e5-b0d04b709651')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "GCP Firewall {{FirewallName}} in project {{ProjectName}} allows unrestricted (0.0.0.0/0) ingress to high-risk ports: {{OpenHighRiskPorts}}.",
"alertDisplayNameFormat": "GCP Firewall {{FirewallName}} allows unrestricted high-risk ports"
},
"alertRuleTemplateName": "f4f92ca4-6ebe-4f2a-90e5-b0d04b709651",
"customDetails": {
"AttackExposureScore": "AttackExposureScore",
"ExternalUri": "ExternalUri",
"FindingId": "FindingName",
"FirewallName": "FirewallName",
"OpenHighRiskPorts": "OpenHighRiskPorts",
"ProjectName": "ProjectName",
"Protocols": "Protocols"
},
"description": "This query detects GCP Firewall rules that allow unrestricted (0.0.0.0/0) ingress to high-risk ports using Google Cloud Security Command Center OPEN_FIREWALL findings.\nPublicly exposed management, database, and service ports (e.g., RDP 3389, SSH 22, SQL 1433/3306) significantly increase the risk of brute-force attacks, exploitation, and lateral movement.\n",
"displayName": "GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports",
"enabled": true,
"entityMappings": [
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"columnName": "ResourceName",
"identifier": "Name"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Security%20Command%20Center/Analytic%20Rules/GCPFirewallHighRiskOpenPorts.yaml",
"query": "let HighRiskPorts = dynamic([3389,20,23,110,143,3306,8080,1433,9200,9300,25,445,135,21,1434,4333,5432,5500,5601,22,3000,5000,8088,8888]);\nGoogleCloudSCC\n| where tostring(Findings.state) == \"ACTIVE\"\n| extend FindingCategory = tostring(Findings.category)\n| where FindingCategory == \"OPEN_FIREWALL\"\n| extend FindingsJson = parse_json(Findings)\n| extend SourcePropertiesJson = parse_json(tostring(FindingsJson.sourceProperties))\n| extend IpRulesJson = parse_json(tostring(FindingsJson.ipRules))\n| where tostring(FindingsJson.state) == \"ACTIVE\"\n| where tostring(SourcePropertiesJson.ExternalSourceRanges) contains \"0.0.0.0/0\"\n| extend AllowedIpRules = parse_json(tostring(IpRulesJson.allowed.ipRules))\n| mv-expand IpRule = AllowedIpRules\n| extend PortRanges = parse_json(tostring(IpRule.portRanges))\n| mv-expand PortRange = PortRanges\n| extend MinPort = toint(PortRange.min), MaxPort = toint(PortRange.max)\n| where MinPort in (HighRiskPorts) or MaxPort in (HighRiskPorts)\n| extend \n ResourceName = tostring(FindingsJson.resourceName),\n FindingName = tostring(FindingsJson.name),\n Protocol = tostring(IpRule.protocol),\n Severity = tostring(FindingsJson.severity),\n Description = tostring(FindingsJson.description),\n ExternalUri = tostring(FindingsJson.externalUri),\n AttackExposureScore = todouble(FindingsJson.attackExposure.score),\n ProjectName = extract(@\"projects/([^/]+)\", 1, tostring(FindingsJson.resourceName)),\n FirewallName = extract(@\"firewalls/([^/]+)\", 1, tostring(FindingsJson.resourceName))\n| extend PortInfo = case(\n MinPort == MaxPort, tostring(MinPort),\n strcat(tostring(MinPort), \"-\", tostring(MaxPort))\n)\n| summarize \n TimeGenerated = max(TimeGenerated), \n OpenHighRiskPorts = make_set(PortInfo),\n Protocols = make_set(Protocol),\n AttackExposureScore = max(AttackExposureScore)\n by ProjectName, FirewallName, ResourceName, FindingName, Severity, Description, ExternalUri\n| extend OpenHighRiskPorts = strcat_array(OpenHighRiskPorts, \", \")\n| extend Protocols = strcat_array(Protocols, \", \")\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Discovery",
"InitialAccess",
"LateralMovement"
],
"tags": [
"PCI-DSS v3.2.1 1.2.1"
],
"techniques": [
"T1021",
"T1046",
"T1133"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}