68 lines
2.4 KiB
YAML
68 lines
2.4 KiB
YAML
id: azure-vm-endpoint-protection-missing
|
|
info:
|
|
name: Azure VM Endpoint Protection Not Installed
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that all your Microsoft Azure virtual machines (VMs) have endpoint protection installed in order to help you identify and remove viruses, spyware, and other malicious software. The Azure Security Center service monitors the status of anti-malware protection for Azure virtual machines (VMs) and highlights if there is insufficient protection, marking the virtual machines without endpoint protection as vulnerable to malware threats.
|
|
impact: |
|
|
Virtual machines without endpoint protection are exposed to a higher risk of being compromised by viruses, spyware, and other malicious software.
|
|
remediation: |
|
|
Install an approved endpoint protection solution on your Azure VMs to mitigate the risk of malware and maintain compliance with organizational security policies.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/security-center/security-center-intro
|
|
tags: cloud,devops,azure,microsoft,endpoint-protection,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let VMData of iterate(template.vmList)) {
|
|
VMData = JSON.parse(VMData);
|
|
set("name", VMData.name);
|
|
set("resourceGroup", VMData.resourceGroup);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az vm list --output json --query '[*].{"name":name,"resourceGroup":resourceGroup}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: vmList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az vm extension list --vm-name "$name" --resource-group "$resourceGroup" --query '[*].name'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '['
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "EndpointSecurity"
|
|
- "TrendMicroDSA"
|
|
- "Antimalware"
|
|
- "EndpointProtection"
|
|
- "SCWPAgent"
|
|
- "PortalProtectExtension"
|
|
- "FileSecurity"
|
|
negative: true
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'name + " in " + resourceGroup + " is missing endpoint protection"'
|
|
# digest: 4a0a00473045022100e0dd381dca1677601c77cea90a81c2d0ffd63648356f6700342aa27270a99dab022076afae8aa60a503af9c390f360ba223c9b001fd7d78e0b58ce379d40666c3b00:922c64590222798bb761d5b6d8e72950 |