[Ravi Nandan Ray (Rajaravi99)]

Required items, please complete

Change(s):

• Added a new threat hunting query template: WAFBypassDoubleURLEncodingAdminPath.yaml.
• Integrated coverage tracking for both modern (AGWFirewallLogs) and legacy (AzureDiagnostics) Azure Web Application Firewall structures.
• Implemented robust regex-free URL normalization using KQL token slicing split(..., '?')[0] to isolate request directories safely.
• Added explicit entity mappings linking extracted target entities (IP and Host) directly to the Microsoft Sentinel Graph investigation matrix.

Reason for Change(s):

• Provides cloud security operations teams with proactive hunting coverage against advanced evasion methods (specifically multi-layered / Double URL Encoding obfuscation techniques).
• Targets defensive blind spots where attackers attempt to bypass basic front-end infrastructure inspection rules to access sensitive exposed administrative endpoints (e.g., /admin, /config, /setup).
• Helps identify early-stage reconnaissance scanning traffic or active perimeter probing that standard rules might let trickle past as "Allowed" or "Matched".

Version Updated:

• N/A (This is a brand new Threat Hunting query template; version initialized at 1.0.0 within the YAML metadata structure).

Testing Completed:

• Yes. The updated KQL syntax and structural parameters were actively executed, parsed, and successfully verified inside a live Microsoft Sentinel production workspace containing standard multi-tenant Azure WAF log ingestion engines.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. Local schema structure tests (DetectionTemplateSchemaValidation) and syntax evaluation procedures (KqlValidationTests) were completed locally via the native .NET Core SDK test environment (dotnet test) and returned perfect pass statuses with no schema alignment warnings.

---

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 2 · 3

Open (5)

• StartTime and EndTime are referenced but not defined within the query. Hunting queries should… · New
• StartTime and EndTime are referenced but not defined within the query. Hunting queries should… · New
• This template is clearly scoped to Azure WAF / Application Gateway WAF… · New
• has_any() is term/token-based matching, which can miss common admin endpoint variants that appear… · New
• has_any() is term/token-based matching, which can miss common admin endpoint variants that appear… · New

What changed in this PR

Adds a new Microsoft Sentinel hunting query template to detect potential WAF bypass attempts using double URL-encoding, covering both modern (AGWFirewallLogs) and legacy (AzureDiagnostics) schemas and mapping results to investigation entities.

Changes:

• Introduces a new hunting query YAML for double URL-encoded admin-path detection.
• Supports both AGWFirewallLogs and AzureDiagnostics WAF log structures and unions results.
• Adds entity mappings (IP, Host) and custom details for investigation enrichment.

File	Description
Solutions/​Azure Firewall/​Hunting Queries/​Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml	New hunting query template for detecting double URL-encoding-based access attempts to admin/sensitive paths across modern/legacy WAF logs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-skharode]

I reviewed the query and the failing KQL Validation check. Please address the following before approval:

• StartTime and EndTime are used before being defined. Please declare the time parameters before both table expressions and confirm this resolves the KQL validation failure.
• The query is not included in Solution_AzureFirewall.json and is missing from the Azure Firewall package. Please add it to the solution manifest and regenerate the package (with the appropriate version update).
• The query uses Azure Web Application Firewall/Application Gateway WAF data rather than Azure Firewall logs. Please confirm the intended solution placement and include any required dependencies.
• has_any() uses term-based matching. Please confirm the listed paths cover all intended variants or add any missing endpoint patterns.
• Remove the trailing whitespace reported by git diff --check.
• Please confirm T1036 is the correct ATT&CK mapping for this detection.
• Please go through the Copilot suggestions.

After the updates, please share the KQL validation results and confirm the intended solution placement.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode, thanks for reviewing. I will check on the copilots comments on the query ASAP.

[v-skharode]

Friendly follow-up. The KQL Validation check is still failing, and the review items raised earlier remain unaddressed. Could you please provide an update on the required changes, validation results, and the intended solution placement for this query? Thanks.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode, I have made the changes suggested, please do have a look and let me know if this works. Also let me know if anymore changes needs to be done.

1. Placed files under proper folder structure under Solution/Azure WAF/Hunting Queries.
2. Updated the KQL query according to copilot's comments.
3. Corrected MITRE mappings.
4. Packaged the solution with V3 tool.

[v-skharode]

hi Ravi Nandan Ray (@Rajaravi99),
Thanks, the earlier query and placement findings appear addressed. I found two remaining items: the query uses connector ID AzureWebApplicationFirewall, but this solution’s connector ID is WAF; and the solution/package version remains 3.0.2 despite adding new content. Please correct the connector ID, bump the solution version, and regenerate the package. There is also trailing whitespace in the query description.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode , I have made these changes. Please do let me know if we need anymore refinement.

1. Updated the connector ID to WAF.
2. Repackaged the solution with version bump to 3.0.3

[v-skharode]

Hey Ravi Nandan Ray (@Rajaravi99)
Thanks for the update, and I should have clarified the versioning expectation earlier. Since this PR adds a new hunting query, repository guidance calls for a minor version bump rather than a patch update.
Please update the solution version to 3.1.0 and regenerate the package accordingly.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode , shall I close this PR and I will open a fresh PR with all the proper changes and version bumps, if that is OK. I don't know why but I am unable to push to this PR. I am getting this issue

git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

[v-skharode]

Hey Ravi Nandan Ray (@Rajaravi99)
Thanks for the update. That’s fine with me. Please open a fresh PR with the required changes and version/package updates and reference this PR for context. Once the new PR is available, please share the link here.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode , as discussed I have closed this PR and opened a new one #15285

Please do have a look, and do let me know if anything needs to be updated.