chris408

Not sure, but for now AWS is the focus.

Yes, with concent of course (Red Teaming).

That is true and it is the first place I usually check when I compromise a new server.

This wasn't mentioned in the post but imagine you compromised a server and found an unprotected ssh key. You don't know where it can be used, and the .bash_history has rolled over or has very few ssh commands in it. You see a lot of hosts in the known_hosts file though but it is hashed. That is where this would be helpful, and is why I went down this route.

Maybe this isn’t clear, but something I read a while back on this topic:

Running a container from dockerhub is basically the same as curl piping into bash.

Apparently they don’t have a mechanism to permit their own addresses because the probes come from dynamic addresses. It sounded like they were adding this as a predefined label in the future.

I agree, it seems strange that these ports are open, which is why I wrote this up. I spoke with Microsoft on the phone and they confirmed that the ports must be open for their SLA checks and monitoring to work properly.

To reconfirm this, I ran a quick test and saw these ports open by default after I configured an application gateway on my account.