Devon
This one is a little trickier to catch but looks for the translated service containing RDP, RDS, Terminal, or 3389 with source being any. This is an indicator of wide open RDP however if the service does not contain these names it is missed.
NATPolicies[?contains(TranslatedService,
RDP
) || contains(TranslatedService, 'RDS') || contains(TranslatedService, 'Terminal') || contains(TranslatedService, '3389') && contains(Source, 'any')].name