azure-func-public-endpoint
Function app SCM/app surface reachable publicly (used with a held key or exploitable code).
where
app default hostname is public (no access restrictions / private endpoint)
emit
| target type | AnonymousIdentity |
|---|---|
| source | <function app> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
Narrative
{app.name} is reachable from the internet (public default hostname); combine with a key or anonymous trigger for invoke.
Raw rule rules/derived/azure/functions.yaml
id: azure-func-public-endpoint
emits: ExposedToInternet
description: Function app SCM/app surface reachable publicly (used with a held key or exploitable code).
where:
- app default hostname is public (no access restrictions / private endpoint)
emit:
target_type: AnonymousIdentity
source: <function app>
target: <AnonymousIdentity>
conditions:
- network_reachability
false_positive_note: Public reachability alone is not unauthenticated compromise; pair with a held key
(listkeys), anonymous trigger, or an exploitable function. Not exposure if publicNetworkAccess=Disabled
or private-endpoint-only.
narrative: '{app.name} is reachable from the internet (public default hostname); combine with a key
or anonymous trigger for invoke.'