The Invitation

First contact

An inbound rule permitting 3389, written on a Friday evening to get through a remote debugging session, by somebody who fully intended to remove it on the Monday. It was two years old. “But we whitelisted IP addresses,” they said. One of the addresses was a home broadband connection.

Behaviour

It does not hide. It advertises. A management port reachable from outside places an address into a space that is scanned continuously, and the first connection attempt arrives in minutes rather than days. None of that is targeted or personal. It is weather.

The mature form of the creature is the one wearing a source restriction, because that form survives review. A whitelist is read as a control by everyone who sees it, and it is a control precisely as far as the addresses on it are controlled. A residential connection on that list is a control operated by an internet provider, a router built to a budget, and whoever else is on that network. An address you do not control is somebody else’s control.

Signs of infestation

Query every network security group for inbound rules permitting 3389, 22, or any management port. Sort what comes back into three piles: sourced from Any or 0.0.0.0/0, sourced from a named list, and sourced from your own ranges. The middle pile is the one to work.

Then try to date them, and watch what happens. A security rule carries no creation timestamp. Resource Graph keeps about a fortnight of change history and the Activity Log ninety days, so a rule older than that cannot be dated from the platform at all. The failure is the finding: nothing that can tell you how long it has been there has been running for as long as it has.

Resolve every address on every whitelist and establish who operates it — not who uses it, who operates it. Then pull authentication failure counts for whatever sits behind each rule, by day, as far back as retention allows. Where the rule cannot be dated, that history is the only age you are going to get, and it begins before your logs do.

Containment

Closing the rule takes a minute and closes only the future. The question that matters is not the state of the rule today but what reached it while it stood open — and whether your logs go back far enough to answer that is the business of a different specimen.