From a5f3398452f007b75e7ac82fe241df07bfbc9472 Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Sun, 4 Oct 2026 16:48:41 +0530 Subject: [PATCH 1/3] Adding new threat hunting query --- ...ss Via Double URL Encoded Admin Paths.yaml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml diff --git a/Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml b/Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml new file mode 100644 index 00000000000..5eb117fb1ef --- /dev/null +++ b/Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml @@ -0,0 +1,61 @@ +id: 16a81a04-3d26-4118-8f6d-6dd3389583cc +name: Bypass Attempt via Double URL Encoding +description: | + Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. + Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. +description-detailed: | + This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, + when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. + It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. + Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations. +status: Available +requiredDataConnectors: + - connectorId: AzureWebApplicationFirewall + dataTypes: + - AGWFirewallLogs + - AzureDiagnostics +tactics: + - InitialAccess + - DefenseEvasion +relevantTechniques: + - T1190 + - T1036 +query: | + let TargetAdminPaths = dynamic(["admin", "PSEMHUB", "bin", "config", "setup", "install", "login"]); + let ModernWAF = AGWFirewallLogs + | where TimeGenerated between (StartTime .. EndTime) + | where Action in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(RequestUri, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | where SecondaryDecode has_any (TargetAdminPaths) or RequestPath has_any (TargetAdminPaths) + | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action; + let LegacyWAF = AzureDiagnostics + | where TimeGenerated between (StartTime .. EndTime) + | where Category == "ApplicationGatewayFirewallLog" + | where action_s in~ ("Allowed", "Matched") + | extend RequestPath = tostring(split(requestUri_s, "?")[0]) + | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) + | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode + | where SecondaryDecode has_any (TargetAdminPaths) or RequestPath has_any (TargetAdminPaths) + | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s; + union isfuzzy=true ModernWAF, LegacyWAF + | summarize + StartTime = min(TimeGenerated), + EndTime = max(TimeGenerated), + AttackCount = count(), + SamplePayloads = make_set(requestUri, 5) + by clientIp, hostname, action +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: clientIp + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname +customDetails: + WAFAction: action + TotalAttempts: AttackCount +version: 1.0.0 \ No newline at end of file From 48b137c619d8cb9ade02abb2d4e5fbd2b29af518 Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Tue, 6 Oct 2026 17:23:55 +0530 Subject: [PATCH 2/3] KQL validated after copilot review --- .../Data/Solution_AzureWAF.json | 3 + ...s Via Double URL Encoded Admin Paths.yaml} | 34 +-- .../Package/3.0.2.zip | Bin 20244 -> 21795 bytes .../Package/createUiDefinition.json | 40 +++- .../Package/mainTemplate.json | 213 +++++++++++++----- 5 files changed, 214 insertions(+), 76 deletions(-) rename Solutions/{Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml => Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml} (75%) diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index 17686190a21..64770bb763d 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -6,6 +6,9 @@ "Data Connectors": [ "Data Connectors/template_WAF.json" ], + "Hunting Queries": [ + "Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml" + ], "Analytic Rules": [ "Analytic Rules/MaliciousWAFSessions.yaml", "Analytic Rules/AFD-Premium-WAF-SQLiDetection.yaml", diff --git a/Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml similarity index 75% rename from Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml rename to Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml index 5eb117fb1ef..48f343c5990 100644 --- a/Solutions/Azure Firewall/Hunting Queries/Azure Firewall - Bypass Via Double URL Encoded Admin Paths.yaml +++ b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml @@ -15,37 +15,39 @@ requiredDataConnectors: - AGWFirewallLogs - AzureDiagnostics tactics: - - InitialAccess - DefenseEvasion relevantTechniques: - - T1190 - - T1036 + - T1027 query: | - let TargetAdminPaths = dynamic(["admin", "PSEMHUB", "bin", "config", "setup", "install", "login"]); - let ModernWAF = AGWFirewallLogs + let StartTime = ago(1d); + let EndTime = now(); + let TargetAdminPathRegex = @"^/?(admin|psemhub|bin|config|setup|install|login)"; + let ModernWAF = (AGWFirewallLogs | where TimeGenerated between (StartTime .. EndTime) | where Action in~ ("Allowed", "Matched") | extend RequestPath = tostring(split(RequestUri, "?")[0]) | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode - | where SecondaryDecode has_any (TargetAdminPaths) or RequestPath has_any (TargetAdminPaths) - | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action; - let LegacyWAF = AzureDiagnostics + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action); + let LegacyWAF = (AzureDiagnostics | where TimeGenerated between (StartTime .. EndTime) | where Category == "ApplicationGatewayFirewallLog" | where action_s in~ ("Allowed", "Matched") | extend RequestPath = tostring(split(requestUri_s, "?")[0]) | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath)) | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode - | where SecondaryDecode has_any (TargetAdminPaths) or RequestPath has_any (TargetAdminPaths) - | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s; + | extend NormalizedPath = tolower(SecondaryDecode) + | where NormalizedPath matches regex TargetAdminPathRegex + | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s); union isfuzzy=true ModernWAF, LegacyWAF - | summarize - StartTime = min(TimeGenerated), - EndTime = max(TimeGenerated), - AttackCount = count(), - SamplePayloads = make_set(requestUri, 5) - by clientIp, hostname, action + | summarize + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + AttackCount = count(), + SamplePayloads = make_set(requestUri, 5) + by clientIp, hostname, action entityMappings: - entityType: IP fieldMappings: diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.2.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.2.zip index f4f8998089fd912299334b86233284ac9afa81e9..b9d7ff4d8a8df43a90d51bf4aa3c45357fd4da85 100644 GIT binary patch literal 21795 zcmY&;V~}V~u;kdbZQHhO+qP}no;!2Lwr$(CZS4Ja-}|wDI!^S7$jItCm31D%;4 z628yZL_Jfe*wk5^sQGpLOc&RFltz8tEg5=jZ+y#Me6)*Y%dS3T zLZGmyW8YSrs%U%(i*pSX>T?Iuyf3w|w_);r8Dfc6ENY9jc}LC*Wbq~y=gHv@Ft>M- z@!Rh*w-&~T47PckjmW%J>vN3;bGn051g34)L=G$TICD8Y`m)uK(2k+plu2;jllLfx z*TOAql88h8d?oq!4&Ew? zsERV=Rz}kVai@WvO$XU&dBS+x{Q4dmNg3_of@LVmC@jiX3!&zUbyt;Kd>dC3LXL++ z3~^ZmSg64q58hStNd+!7Ea_9>91epP8!&U~LX1wB1pra3v@fu6^}z;D zZN@NVcC(>8wWXmtC9DisUE?RRgXMD6IL>KycIOn+nxayXeJWc>Sv8xDU7A1%`Rv)a z023oI9h`FDdLJI|FC%FX;a5)4$vbqBZ$rF{bcCd#%^#)CpvV$XXS`C4X0$KRNfjvx z-EYVCqreC4%*HX>%|FEzj_Ol*1%>lvDxV$&%OT*I+MMNa0TqiM=0O|P0iMcU<93|R zt}By#CI`(dCcCBFsviR+Q{s!VQR|&D1ub%i>I#*K4wY`hd%mbnyRkUP8(7PM=8yQd zl~l-7z#B;&MolyZX|z2A^s~VLxvyV|;2;S>64<2>gj#!S!c3mHg+d0L128ESWsd5m zkwn1kJ|uN_XX$l%G-uS+3nr2N=8pVbhhYR;Yhaa&RD}n#U-3bAJZ33#Wnl2*Mh6v$ zMceo|=|w8-4UI#vne@_-*7gO5f&=a;OQa%!a!M?5W7@Ip1!LgF>pI3@HbXQ7 z;~+X*$9N}P0DnOkDCSx*mMlJ{!01enpOfc?4YyG!gt1wzrEFSwlIoUknrEy?Sbp+~ z>MI41D5JV!)%kIj6W1j&Vz**?lK2{@D;(Lh@!&VGQLWp`0ewf2cE*{*)4%n4SI@i8 zo?6(n%wtt6H+!s5|FY}!;i8U8d39=$c3M$c7lUFK7VKBfCqSGS{}D+b6%}sf>!UJr zK!pOTP6`OxOMwOqTG5qM3={!HJV{GnP-CX6*0klo=rSb|_1ff!)LfVXSf83IZdYUv zh)rWJ+_xPYZQeU>705(BTwtl*P*+}h=Z*)jWD2R!Oab^44%dj#rDrL zx zjxL=~Vg4koFgZ4l1G)#Tu6bm5^negSOY!bRxgwjy1piZ_beHKucrIp{laEztgx;|A zM@MO*g{hd@b}qPot*D0v*&g}S7;oV!rLE9}STIcbMHk(MrSj<2Z~~ajS4xslTJS`Y z%=Af*HbBj1hsedgV+*(ccz8vZo?W)#LKO8&I?`~4q~T>nTO(` zZA1=|1L%M>)0kLsWTkggwIM65yLaon>g2BFru69Q2RByJi3OBdcCm<7D}=~#vpK<$ zeS(x|JuSM)Dz{E;wojcXx^6}(-Q9S#9o#sxB_ZoTwtoy4>qqB)1_wWNymqwA)++Tx z#>I%VUA05lZY%TcTIN&jqAT6cpsG)R;>h>4xa3Kfb?nGp4-X7Nsis~ zBLj6;ipj}(NabI~aw9ShEcB&nF-#1DKcK?Hd7+|!m7W+yY_m25E*k{EsT z;h%j$0>zA+vP@y3+WJ6eQQ+qIaC<+40Bs7akG?D?H3nP1y`>ywy)|1k(RC5u2>LrOmtJc#9!xw1Uj+`v)b6!AkT}l2umLw(XHn2!L2@x+-ut0dwITa0n|C0A(k~tz+nbrplZnC&XLyD3rtjw694>Y3*FiM8FKIgz zF4v!Ha;}KoyDK@nu4`J4t{AVpE_siGSm!7Kp$+-jz0 z{iv}EO1M&EB{oZwm#KQW`5ugZbHM50Q(9zPq$Fo^k-2O0IyHV*S`~h|T6=&cP;lG# zWFjyX%r3a;W%+pRMfy`P``pj|s<<1f6f@RT2N9o6Db~{7r6TcZ>}|SU+7YB$nN-Q? zR-b2~1iYuoKiCEe3U4z3E4z0E$-H{hso(IlKdH*FBpud^uytWd!g2dT%;3@K;{ zMQtbocH|7VuLZ;z5mr+*YGx136KL8F9ftzi1)%Q6DGR2GWnGO+a?fErvbaH<_1&HN!eyFP6W!JC9PCHI)&e`_ z8nbyrPr?&5#6+#b>~b z<6?99r;?uP#Ia7w5G}U}K7*{9O!Sdhmh1T+dJR7&Qy)8&_ z?;PTikaqnlKj&7B?#+%l_Ix$nvwFjaM3j&gFZZbaPFhggXTC_Sxo=^3J`$^5=99yI z_e(Xel(c;{6G00p=;|A&_ONGUU3H%cJ z^SJBH?e|$2@%_o^(;rsB%!`ndE=qWM9Vc*VZs10t4}C@Wl5*c_7x3VA(MK@~v9uji zSVkYG6kI{m3czW*lnTX;Rz6&LNp+bDGz zLob}Hr6Udi(E0!bfcVe-*cw{eshHY2*!=TA|JV0icV9YfN+dCS_!Gb2TD5cM|A7-a z_%>?w3a8cFj!Ls_CW$v&ecDG0B#LB&a8M{PY1YQxZOjqpmUkk$1VXVRkqGJ-V4i0S z6jC!)Q&T%`?)km!B~bZ*uaF-@N#7}07D@Amx~-6H+$U`D+? z6RcLcwn`0CE62kyG2?WfyNQx9M|&Cj;V(1(^)8>{n#0{BZh2)tP+F`n%)jsh{UP6x zj|_*s>WAnV1P+n%xRJ#{&+1`!T`im$6UHifT%U66?v*=c#y|ic=*S#Epzv`$*KnS7 zu{nwaEKEEs!XpT*8Ao_FW1d`Mw01J;I6~7#+vvW@y-Eex;Kg5q>GY7|IZ!gSNE_^h z#v@dDxG@9yD9N+lFykQ#?RwwUmoAGJs zY^C>pFB*uNm+UL*u$~#pkiy4-pQdD-u;6%2kc|+8IpVYkqZD1swaR-%^$hVk^PdqR z-#8x1)DC;;zi-Nqe4%!O-DZrq=l_JzMK;-3B3=V18_Py`;%|-nOr5EdW8s|o6>LRT z&L>DF3T``rWt)y_VW-^00 zB$%0rkituH7EUZBlnS5@COwuA}YZXV1$9wn6)1fSO5qI9Zw!TSC3_3wNe_C_C z{Z1fM48#DXWI5L8%aJKGDbW}~_ORy7Nz8TUq{^%L$3T6DQzKwY&U1Y=tI(SJxZU>0 zS*~qweOe446{Jwj2v_wR*$b*<$n$5*HKzThF$JSGyf7$j>-P$0%XANlp>@D5+(wSsWIwnx4MUqQi^ z0)m1<-F9CNRUJ!fyR5lMta)Ret2nK&8Kzk8)+IZ)qlP*`MIe5_J=tIE-Hsd@NFPq9m8*n>vV;DMUQe@M^@20~>8(LNYTYHU!LV6%DJ$ z3D|gFp<#cBd&>|eJu%dJQlpJbv#lj1)N?T{@Ukt8m8ZhBSqxmgNv?8XAx5mSTAe!; zvAnd=!PXgVX2IVLt%er~+I-Lm^xp#?wE2Lf;l7p_S`EGNzLy)CnQZvATJcUbOOsiN z@-o)8mguG0rpVy5*($@6SMfY%NrQv$|HAP9FAV>GFqW`rb~MKOVJ7<*O8;PBja(|K z;pU&@N=jHauCv0#pQF^OSvF~v`mfEZvnK{(r!_gGf7dnJ?j>k)V53nr+V0g+uCD7v)45+2Ii#ifarF7VQ2uI5__g7dyWH z;bO=4zg%dI_tQ-FKmOy=xr|lgCf2c1(UPTAJdb6S>sDOkT9MK8^ij4=LXsM)o!#h= z_S4wtaG9v_@3g7w94_xQIgsU`pjVk29K121TN@i0thsE?UAOvar^}XIs^`y_nre1z ztUb!qE2`~Ev~OXQHQRCrH93U;3+Y?Kd|yVRs&C+$+yQMSXc3EMOLJr(_ljmJ%Pkyt z@GJ(#R^@u7Nh}toS(QJ7FDRDr{ zS=TwZV?w((YLjRz7BW_yi&fURb{1!?Sgb~{Rl#*)t%SGD*T8FEixH=Wc5+JW!+e{Y z@81|p{y!qyu7`-LZC26Nh<)&Ix&E#z=R?_KE_|HgJ%no+f<4$(AoTp;rD4x2r1iP2# zIiHFkmUITIUU^qqvqLq{tbYiwmgD)wlv3@d>5o^=6mZS$;ay>PIp{nB&RK9XLQhp0cZ^FS-5w>&jZUSg8U-!m;N%4)osqvUO zEVl}dXni3WvfF23+VaZDz)47PO(4(28PFxtlLPH!?U9bIx9=py3dj6bmQk`>a@y}G z@CeH1Zz=M&GA7IdPYM_y$;~O|@A$r$Qo<2E)9dbz@)39kE)5!aO@|r0O#$jzwU?=$ zhgdKD8v^ejPQgj~^xSnn0eZ67lK0Z_USz%(ErpVsLW>^Y@%PCSuM@Z63X?D=*%Xt- zk;KO&ExcAH)>#!nc83?eBdFhzo;HCJ|_c{yU{ zw#8i+8jm_ojycZH--r9UurgAb$P{K?dWgJIbU2^TDKU9c%x;9p7>c?#?Dy1}~#^47UUVm{%w+5=#`A$4_3xih8I^jt@#7;#^|$T z3AYAhhcXVH8W@h;Fa`AF| zv<1TdjP_H~vT)UZOkpo}ay!Y!w~^^tvyS7wr$7bD!Nj?8nc9i`SWD?wO_xglv9H|w z5pm(mH9|MJ$1L5+WbQ#=j)j{?@!#xb`g?>9)UZoDqW5%}c^Pme4wZDq0Cr9uGCE_o zDY4F~J}PtkjUK1~w&SP6vpDzF@E!&H4wRx{ojTs=6|>SQ`8gN#PNkXQmB2)qIBTmc zmCun;B-1$j$y|ON&~v(7f8yOP`Rzgk#=X`enQkk|?;C}S>%YcU&W41hU1V_J70(~j z9L*CkGxW-Xs@wY`3>M41ES1)pDv-7eX=)v8h{$1@K10K7Qyp`Xbb;xX zNqJzJLIqKHA`UP-1vn|qNs>h`q@1$$V1|5|7SKPQYqfo6OF8h8Q3M?ZvgFkgqp&2L zwa#4UMThoRu%zJ@dbD%OEJ=eQG+j~CkfDf5`oe;TIUAIm&C2DdjX9h?))a$=1{V1p z0tTEAoA#H@$bzDp&|x`0s!wfPEz9xo)gD?yzD2VBc0`w0KdC1z%KYH(9n*1ViA;qb z@zDS&v#Ge%0YwRgQvv}}pZz3=#5lwG)PVct(yJmj)aRrUI1V&JRNUqkN?%0~LrI1T z-Aw&kOK+O;6{Owcd0gXg0g|q&wfC)(uMYjKO?|tFhF99!5lo_!n}(Cw+Fn)N2PR=t zElECPS}tfqKA=!;$<_Ph%ZKXATk6Zp^6S%QiPA$oPdc>+P3wNSj=o!oH`(IwhLZdd zS>BKg-q3)vh6mi^9S+?+#z-u^bz8XF3yj?|aobi;6J}I2kKg9qlPz|>i2M$)*WJK{ zr3ggnC+vc;*UAerkNmc2c&ZF`~NSO`eI5htT$JZufU+vwL*HJ&*8+H@So`|8Bju^pBa5%hgmk znqWTN%p7<2wp@_c$Wqfh=L?z3oizh9!U&}w5t}kSRgn*;u@v#fAxNgV_B6^a!eNqu zdVX2uN;r~sw`}#o3e|E*X<_lyUKR}a#JD?wEfTOleTFG-uC~7|Y!>ZF>uK5#fVv zB%|VOfWU8G&XexFN<8>0w(DQf&Tl37p!&#p`c%cN(Q4kPxE)nNdER3ts8X%9_7`no^ki-R+ zV`@-p*OXs3jB_-h+oe9PBxt!D`QS+sWqVNYgMbQtBjH>HoQx&{Nr1E(PS7-zzmP|&8A?CMc;RbI zJcNA46PDmBIh!&B^YdTv{5NpC?s7nY8gLnCBd63*zGKFvJERULgjrc`BH|RUwh918 zpBZq9H=De(gCDEJ=62oz=wIE?v-I~aW{J)|=A3HIDm{K zN#8>bh{Ko~(q7m5j#f)HQg=oEa0>Csl=o3RAG%zueKR~k#D`OX%IT4`ATY(*GdV?s zyS|LOzLZX4no8*>C@mWywpgAb`FA>(-#y#R0ZbZ&HHg5epE_R-!X8YU+L=1LOo!j*Qv>MXC{;6!QzI6do3#O3Aed-_ zWQ=7LK{ENu2^OD+Wms-lWG8IwL@19H%1j?-o1vS_B8H=yt3>!qI*dt`dYKrGdO5mM zwnO#*sdX*_B&mt}%M1F7JZ%m_I|t#8H0oW4yOSiv6anrSQso-Zg7Wcz&D(cT7tAE* zZMi2VQwp`-A7t8L-VzAsQYLoSY9;Ne?DzXDgR^Yy@p)}4TqbA0O8(&awJyRI z2B*SB=apLf=f!$c#T5q@_ijkXM9W=-i%erV0z>AY!umHBHkzw(#nePb@&+N_NKUT9ix_!}n_oJHiV?d%48h z&;n$0yFgi7!%1Sgr<;Pr@j}GU5f|KS$POC320erJ#v2r!!j5ZSIdZesda@u-S*QJ=E`+3tXXFHu}I;L#c%W(cKT>+ZXE`ulVY%c%KbYnGtC8Gl1T z>)U3o_g0!?Mv@+A?Z)$dLdvS>px_*MYdFv8xK8jOrkAdrmL#M71 z1G^guKM3aY@GLPID=V8I&y?gwvz{v)^PjGq1auqFRlGOSBQ>+?fwz++eQ|<+-|k_A}UmVxe(~7F!}aCxw%|dUYNE6cQP5AY~0o+FW3 z*~7HDE5s-KwZvEzls&aM-=Y^4jF*M0n&OIZ-l=kl2r1G5sl)i-IoO)t_spyONn83M zOZ}>n7@jyOu7GWJN$DRz6iGPTP#HsjT4a)J`AOw-h`N$ybiyU;;CMz!*EVE9FgEm) z1P0bwVL|IBAzEurkVaV}vbQ*(gb|!MyVn>d$B!t;VcT)Cei|lfk4fBUsJHSD)Jz+m zLUO%qa&x6;Do4+0XET>{mtvBzfwWK;nn-?NgN1ml`9O-U|Hy}BnWs3tBxUv zlGd85qL;^vHs1RV_oR#JDFq%XLOjlrsOj{onHdv(9`~Elm|_>JY=@VVExidSmb=x` z{_YC3&eW>Ay|3Ht?$O3f%UV3HzFsh=#*Bc+B~8rCA*QtFh5~Z1klREh-^2qG!(mqC zFiM7#TTC#Tyrm7(S8ON2{RcTm&+r=!DSD^6EsqhHHTbK#I1OrMk1BOhOHud7Qa83? z8?>wp)vsymO-|6YfnA-q?0>rYmYtu{>*>ph{LKD0Dzkc%Bppp?BF;o%%R-(ShTpa6Dy3DM{a<^^nc{+c7=Jr%vqH6tSX!ePq2fnt|y@BeI zs4t2S`iaoWp;qI(F9Mw`hu&dJhh9)=AOt++V>?(9HKa$qApOKnP+m(lL_MW@+(t@5 z+|9l9Me@B0fKBWy#PnTL!wq6|Xa3_YQtpJX{wb=ya|A?xL9rpy7P&KQlJq#|=yRK0 z$5C+gnJO*LGt~=VweWHLZ$UJALnt{cgaMJBfU#ltGws|yXo#DZC7fac?K6MES6#GX ziJl5NTGI&M&Bk2HmK!=(@GUqi?qH9#rZWSnQQ#=Dj3Pfumd~zxm`)Z8n3KPN#}9YB zg(&gksP8AB;}Q@whV~z%Bz}YP7$f1vOZ0{K3cW{w^I%hvPEPmtygWTY;ta%hz**(v zYP~tyoLvv~$B}%6;sOCqAj3`!Weri%S;3ctCrRs3pQI=B zQUy|LtncRsE(u9_%mv3*B@N^XDw`l2k6>0U=0a$RNspOFk6lr5iq}+@TAqJ{Hh@RC zCeSBnBGN`}CX8T-nK7-XGuX;GPk{w7%dlA_g!=a4{)X%`v)4>GCrKXDP{nnj-0|ar z2@!Qt{#HC&lWF^DaW7~5R&wT{lzt7Q;2R}Kc&QbMc09$MSDoJu{sbJcoz{373$fO? ztBj)YBORY}mZ>67XJ6@-tjqd>QwTi!PfLte7aaboQXsVwyW9|0hrpx{(d4Mer>nL>D7|Q<^@|%Wn zD)SY$^(sRGtwGA2};vwI%+C099-`S(gzl$*h}N@Ah$MSNV?C9D3cGBy3E%|G=+whI(nWbN&; zeY!xPL_r>}tGPo+$GrE26HfFih6@s?CyGz{p@SgxM3#bR&^o(TA~+P?$%o{LT|jWi z+nI8wE$7>~cZ>_b0tS1;3FRBPed5ss`JMECen@-?r52!2fTXRQjI;#Mx3hpx(esjt z+DjztD3i3?ny4>Sy7gwqqb2Pu*|;t_jPNRR)Drs|Qba_7q!pcM+{I;76!}=O;;$nt zZO$Sj1uTulr>wZ1-EbH&ZLxrC_9G~97#T|`a2Vyc5R+ABs`Q;{f=w-8SEV=Fd=X-o zb?GYyrUVmuP*$a#BQHxd+w`1VyZgH5Hd3S4RlCzh?4|v-@iHi&qu^C%yzB8Y%qmdg zi+;Iy7_O9D{XKbv;b90E?hrMmfsqCCCd1SZA|!{p9a>Ok(gxO*IJDbDsB>rw`9m9z z3v+14Y2#%pxY_H*`B2SetU?>)Ivti!FquV1rY^@aA}<#IiapljvQER|vO-eWUX^Le zKJUa8lNFx}2hifMh8B~JpoA8mL~>g-Ol0EVuu8*9Sie~>gxv;P)ZEl+qME@yJe9mz zYe|2xRuAYW$M>4CE&8?7HJGN=C2|sWUj+}2k|;Z-|DHY z!0fqxD?~CwJYVn7uSTtkI<7r&Jj25WcdDr9M|ZUnF>aH7F)_}I>XbSi8)ZBF&RCwk zSUtZyjDQ{u?LgfG{4qq=>@U|!yG#4rp0G7n& z0#%-SY&t@jEY<((CX@;sphhx^9H4n^$^?};n!A(<(?a!O!UVQwd=V=baDo4Qu>%N7T)+TgLPqSJ-TT9{jx!G#9ls#gRq3I=P7v>bo~%Q|tb)%$?ehY*iX;nw z$69vq6y393on^lQ(mrJ17!Ut2@3H*f6y-!+gm+~Q#JqjllThS+R1U-Jq~J#@kX#w`H7?! zni(wNOW6}LgQPF?_m1@FTDonCF{IrptZV(mbu}o;so+iFKYbEE`xEu}UwrWdX<#YP zNR(jCQaT}{Loa!S>ihQ2&_;vdrKVo)z+pIBhJME!YDMi7j?8Lxi#|ZMw?NKn)K|cE20plZD}J)73eb1L4h|wzyJ68Cg6ireDO+40t|l>9JExzJ#ADSG#}$~4 z6{9#Y_}kScx+x;l3+f={y>vJT8<40BK}GRJH$*J6MZrCflVY(Utw$vS>yM6s@S#DqCcB8XY<_}GWe>X5z z7!Ll%?t;(jZb$S|P2qrCNHZR&Q%hI9ElU}W%x=c~zD`aKMCDKU1$7GRyc%70P_5LYCILWIYp6^gu+R|6Da$2|#87^9}|a{qbo4k1BWrXDA(g!sR&UZ{h6L zTA$0yi&!2(dsb~OzFu2mwk`v5FjS?ly7-r;stft8iagzwBMWtT)vr~C%D+T=gAoUY zcA!>tPS2iLtA(9~hd!~IbHX@XE%ntV37GY;AMAj|BRtGjkg@f#x6c6NRY3|viOg#_^MXAG)W09>5RkQkGo*}f@ZTZ zfd(d6dc&~`aNl5Tp5XgTq1-cn(qa--<*bVrGJo=Y(3{8E$xaFx9~5FIXLSj|HhMv~ zU7Q-%FH11s0B8&grV!e2E88#v^F+IVjR!HvP>If!?{WvKhKeLwYo(2NzGS4$CydG# z%cGk^IJ>I!<#5rh$CsDBUY2p}$Fhuo^ogp%de9^S?kULWAZwrCca=c`yziuItM)#X z>VNEcfb`+0yi$KFwd*tSGL?KUWY6w?#+-kaurE95*DUy*Prv#>rZIkg?Edopu@#l1 zk65PPPXDx_tc&M)m=?yWP}}pIlV;zD=9=35vCNe|lILZ54xgO*t%Cf-RFEhzz`8Om zmbNN3Yp!7JY))KZ*dVTEW~wu5;;NP_;j6$NL zq3^!m;sl)AtK2WcEc!FyjbT>3Uah*8?+tjAmEH@GDMSUGDMtm$=tS9ZcXj$T`Y`eN3wwFx&Q=w}4$5*vlwZl@lmbIdsK=nX; zm$foiY@^eybGox~%b)U9daWU6vzYTar#$1%`z6+Zzj%GFvf4|X8H-lex+zPx+PXdJ?oiu?Y6_ch)It&^uE-2l9?V89TfhT)13#-G`yc7!c}s0F>f5i}-Ota>YpIj#`)xmcXSwro$6t5A_}wt!)e(deHJqnD z$W%$fqM`f{YseIxTNoQeTXx+(gkjlKI8$XX4U+3=Gi4sLDvtn@)B{jh2*6T_?w_x1FNwv}*Ea zPITW^UoUsYvE3ktdA$jH8);q^9f4PvY@48`Z(m;qa6dOduBP}x42V%SYIyQ1eP#jg zwh94LcPB__7=zBNYpA1N?@|9$;jYfsU@7#LoK7h;1J!Cy0%{9IBxYs#ORy2_n#En} za^Ciw4?$tH=^KgD?GYLHEh2wCIWN46H)SHZwS1GEaFKAllcBS4I_8$spCGX<D?dDk zRe_6_upQm=fBTKQ(iFw1 z9kmS@_cA|BJJ;V_lfiqwGOzrcS^n}O_^USEq~pK5jTdXdJ$Hl`iDQ-IHw@7Qg}j*! zHoNX?fK05V1)9`Z9_YhGPFq^%7-h0P4ib6e0DN+x$0hmQ%K zmldLVzx73X*mS@JQ^D??XT;oZKL!;)$4^PmZ2!r%y7UagnXLl8+FoOgt#e~?+M;|x zNrvb}j~wP1p}1v713vBr1`6UdI@rp)s5%swjU6~z#0S=t2jd(>yANUGGC|gqI|F~h zgockS*+buRwhBp93?tQ}G&V8_Sw8!j^i4{!D777eFI?v_X6y&Ny75Vme)a|zvlq9F4=5gpP`^@ght=Xo0*L=A{48GgHlSaG}QxFheb@w_iu zDA)FQiKSK)cqM}qT@r91N|s;m5N;WK`$llGi2Z~QIAL(W?D3#Qb2(Fm+{@d;DR_a3 zB!b?VBITgBs@+S(6A||q(Bf+lgi2pnwrH(ZnL=b>ZU&lm!MWD5dqHFERX;Ih`|av{ z>)W;si$m!y;lDqto(xUl!2@M9Zg^KFN{u~ToOoR(xTB3@pAC9aYQ0T`lLPUaE`mwW z1nM~h+G8j+x=Ei=C~6-0fL}(k7Xz5nB%efilfBrCs5OkBd?(Nfyj>^Iub*_E{&zx` zD~QZbBo3$2#&(o*Pe9jGH2!-ia5+7P!DW=k(CfC7wWfN|V{&IO-aW#2PGQoT%QoO` z#xXU3&kM1dy5&Xn9y1Yr&<&t9=h5kGav>|N9qZd94+o=lI1@zh4$!@JX3??e9CU@6 z^iwFN(gS-?E|6n8NEUVx8&Hlfk(4{v-%SkXpxMAk7Y{Rv;g0f%bYn z_4>TdSkrw%18EpJVVjIcKa^zV_E&-9YWiTG>B*2?v}ER`txSi6;6|W>1F?Z%a$Ygy zTJx(@yA+AdL<0Q?V|_A0YdG}_aLm0DWY{*-NO zr?_rOvKhmMbK0UuLVS?DzEyLEyiea$LG|)kOf4d6wS63us);`-s!5XusZ80@lbVsU z(MDOKjMF&LmSlRf1!HMPxj=H~GivoDco#U7t~QJC&c&W37`3s5!nF!1%3~mmYx|N0TtqVQqU2_S zAGD8Ctp1q3&<}JRvW2cT?>ELtQLQnS>>$uLiUz`smM58Y@698a~!! zdr-8^q4GqYbx?lpq5!5XPXycGi#wCJ!v=&)DKY|CO5Aks$oy1NPb%@u(e@s{( z>n*~|q>LY@YqRmXe-BNL@q{i4^*+9Y1?Gs`Ra?5`fXsQ^Kv;lAytEZYYoP9uC{gUP z@F^=I|NAC&Ge=nQG5c-FF=dG~V7kLr;=A$oT0s4VXp1lhk6Vj%G|4DdM+b~R{Wk>%>3N7M*rrXidHT@_eCB=gi(|!uVASkr;FPXbXz-u%?oEN zo7GIr!DY0mQ*6DcKw#P=k#KM+A07KODR_J0X#5BPH0az!@W#ey0=rU5GSE*<*?C$@ZhD=8)>!Ro8F@s8JSnt8H1Kjci z$8o{TM4^_GX+5qyr`AUk3`8cKR-EP%pvCCya6xYvfFa7dP4i`(>DPq=WlFQtoUl8j z1zhVIc?8R9J8y6_W&f%|xe8LK4v%GJgWH0d5Q%nTyQ+!ZaZY{eN>jikJc4oR=6IsQ|enZYAldN2>HmT`gHh&-Y<%SAE}DOq~N$PeM$c2NL!6 z(Ni@b+bG41%-&jKi9WY63#cmkv!JGq?O>k!Y)GDi+LBgh=HxeDi<$QE{Z!Cad_3xQnI3yj|97Oc*>mm{KOgy)wQ2%%viKKRxDVv zwN@=!S&G-oS~{B1>{u?X>vmmlMNGT2pblkE)65^DBKimYXK)R9b`2R|i~<97JcK4T z-Nr?O`%v>U^Z__{zlqx}5cUZ$MZydll%me&?3KmL>rw+}XPo=Du(}NDNw7Yp-%ekA zqQbga*BE5{3{v&M{UT?L9D6;1RcSTPl_$ow8>a_eeVra=sKDAbQGtQ0F@pPekh&q3 zNP&wIwVLW0y`IHUb4l9uQMlv4&Y~8FVPC7}k5$J}U#+>H`c@jYK&s-7yB zpo5ap{)m9;B7Mh5fa?Bl5FF!!@)TFLoi(B6y4E^KCM5(coWt;_o@rNN+O#Z%KLCm5 z<-RD1=AuWMF_ckbjUlQUB6;`xqDSjy2fVFgjb1&8=FhN1vqrl$b=2KeV~t{no-NB` zjh8!+Ip+F`hW8BO-3fP%|1}??uNX>xB4bF1vnk4=g2l5CBCb_(2x-yBAy*rCT<)t1 znU$dO&2Qqv*&t3NV;#&&&71InX##H0VGjuaIAMPD>E{0ED_rSDea5$DVNosn}tL7mK^L6 zCfpuzrP7I=JVHqz=O|u)4&f^TS@2>3_Q?3!-#o;(d)C8U=a*xcIvRGk#Sw?=lXh-A zDFhD&vtFiu4ULPlY)bNf*J;v5*WxEGbz&bNnGBzjkrtPBbrmhGuT_n#t#$h``BSw# z>G_*j_u2alOB$QE+Z2zJtKb*z6B7BzcPEq_Dklsdf^44-&|Uy614r3*aXN zKf)$L?{IC3^T2e6u-77eH*IkHW8Xozb*u@0*YX}Qd$*2UzmOA2nRI7!uGqpw>5QW< zuNh>@)u~Ri#rE;i%)oBFWb8>2lw+nODBC^smHP;&S1G`{MM> zsao-pUDbwpaaf#p-XhbR(a1k><#C3a7YgRNpO^0}C z-dzXFjgu~aULf_9_rk#zVe+eTR(sgQD=^P#(v>T1IjvH-8=GtNqc92xNVQ86u5O{> z<6z>j3_E1Nc)eIGOa?k1uK-h6f3_Jpt*Vk3i-zx-yjgWK?4I6M--j;T^9hj)?BBlA zIF6a36gY4!L_FWO13h{N1a?I&$bV5?Rki2d(?}anJ$DwP#B(rTb0$L1$D7XJcxWC{ zS(=59a$vFdJO4`Rwz06U1IZexx7V|HwZ6fBJToA;tx1q)keU5o zm9kwgcW9XPbjOxKE?&^PwVS0e&8sIxG{+Tz5XcVmm~MjZN_oaz#~dh#Hu`1{N(j>w zI2jo~BFtZn(9=J^)}oqN4#2^G#Yt{@&RnI~Ba^D{Nf#j(5_yIy~Bb{AlBWNJrO_(n8eW z9FKUJcINca?}hTqG>x=$MV9TyZBeT>HdU)O%uy_@ew+*seCT!w3J)w5KLVLe%pl~1 z3d}4(gS8mGQDfB9HUd6F$-rs zLpJS5zFW6ou-|PeH}x-_D(lu(k`0wZnzfP8)4uG)Y)TD%=`JQ(nInXruRLj`R{WHt zS0B)4J+#T36vb}))|72YrIcz?(&#B2tSYy4(M$3NcD9ag4JH|7bcg=dFfoe{J;V+@#5u`yUrKmP2x~2=?8h?# zgq*~@X*WzM#BMe8DoMlsyX&MQb~GJBb6r7Qlo3@kPwnjPQL6E5nzBD**87{kj~YOr zqs!_}A%ebyrY46u)JDhjPXDek$^8xU?I0@EkP+X!y1iy2us`u zNXo!Dz+z3RhGaXMF@ykc^UcVAcWsZL>Z(SFieF8xPVEu>8tvsMLmDCL{>RU`Yuzo& zeh2qa1DU{%;SmkHtquKg^iD>=xeP|&Pz&Ds%#*)gC#x{TNwHF*SH!Ir=HnFR($7Ln zmZCGRfG@N|n2=zpctGSn$vJD`Jl)`bZD#!iM46t78Vh9k?UFknYpt^F&qFV>(tX)< z%ZSB;CFwR8h=s=a`jXPjeRvC`M28nn7pD46uy= z=14YUTdX;hyaLzb*5a5#Uiy$QriizTZx{dYep)D1Syf$I=VtpuIFbWj7o9)mEI$UXnueB*bFM^lE551fzkiXAuc- zr31HI+4kd7-qPP?cwIL*nIATsKAiIR`X$?lstI$dBxQWTHd!nNlZiRuo_AHLpKlG+ zvc2Vcbg{b15K@Yf0aH|e)6}Bc(pv94GZAXsC1SC@<6(9SDn5&LQX*hLaKAwE$<(xB z@ZS9S3g-_16Nsy{LdgX!0n}hi^S>EIM`=w9)^rc>?FpHAm9FsPhtXDFr|)5 zf^r8Qfl$Zrg_zDOVI^zPrlwaeT_?Ir$-%*P?!&&OP`J&47j5S}SMI}=q9J_ev?s0G z^ggtIcv{?DD{I?pjNL#fQIsuCcEUcSq;(-+<8BJ4^2#FZzVu(Ohsj~ z`dEsuh9~LSlV@3vrMem)O4DO~=D57z>%WlSGWBEDetD=dMM;@IycH0)Q$h|B&4_`% zXW4ajvI-2~RM43;;KiecZFIR?JdS7n12B*HXh+O5Z~3GUP^f+Y?)+FOU5^2LqwzY^ zjxAGh9L9w#cGNCr_6a_I*-d-rOqiDo97%L^ee_5b{QQM!(<8l?77oKhq&UMT)G>B& zwS(-+nI3(sMt}ktF(hDoq`OanKlUBj*BzYKl=!ENg|JD6kRfDq==>>pR`yJEVH6r} zdk~`YAt}r(P=kC#)`u+w6T4+z_>jHUvj#j=cZ~tQ_%1`QrxSb?2sb~vT2|am=5wu2 zT)?jDJN?&*u04M%(g@Bxeb;@@Vey3jyj8+ zu*g;C0ZtgI+IhzYu+G?wNV@?n*$m2sb1Td{J?FG_dgc`G6VE1AC&WVYP~yv9l#DY| z5Q24OA)#+IhqQMFf3oLl;EotMKQ`y&!BF~6)ETl>If%TRK|`YZuZ(oE?l`jjzF$zt z7DJ+irM%p_si!%k(2@PV;ui-*{vo76L#-@FzolnvQ&%5yYDhb&Z3el06O12FNk3S( zFbAkoI&7tSRDy;F7i2?-a*WvqkIy9~AE~WBnztkv*Y5y9+$#J%M}rLXDj|Go2Vvai z$Pps-iWkV3?5H)SE`m1J15brG2~Of{8OZ2ppJ9sP8r`Oj_TVwyutX5cRwcc-JzvjY z@?7d%&;@0CP(rl_U+wQ6Vi$uFWl%@V#5@~5*JhRLiIYQ_S4a|ZP560a>8=VmfwPp6411g(>uHE$XuD3QoAo4dYMX&!(?5A4e zBV}&FgYVC++GqH);H1gT29o5=%?2+N3rctPP55PFBMEXE?HYt0$hO=Q;KBNlT4xVi zIDCEEv{cs*gX(RBx{iY$YotP2r6sm%+;#e@JMP%)MFIpIGV#3R-ONb%N+;?vG3YU! zf*ytHhGZj2cLa(meRQ?j%L9SKSr7TuGm(5azAoCQiSN#j3E!i5+I!a~IhHvtfrn>1 znK>MFkMD#11bIAjYSg~z|04~}`hITZDAgU#Q^@2&Dygn2=+`t>=C^dU)Mm+h z?*zyhU`APjekc^|g>Y6yYkNnCXTPm{gI$6;ikEw$Aig=eoT^OLY!!gTihS{*zJ*k- zF#+p_$#ra48f*N?RNJw8$Ba{!_aleA8Afm#kTg6tI-x!Svb}UOLct)3vkIL;W z8Mm^!FTcM`R)3w*RGA^0@^d0n@*z3zyXkqcbQFOQdf%7eM#9rK?OoEA$qL&LtqcqH z8Wz+~3-*D}ouh5>AAbNz&f35Jd3U1PttMe{QRF!3^*iz`kueOuv947UzTDrh!rYK# zB^9dk4{X3J#L9*E_}lkkWzP>`@5T(r3O%yV@@ecu@177@o>329=Uc@_ggY}U)JDa- z0*J}lx$p^rnw{pu2g@_dz8*1{8sco!8AGuR*BqiJZE= zuOi=Hlw6m>H~;Jvv;DDgc;;zF3-RhA?q^sWk$hTfRKr2LkluOPJ%veTE{7>C`A>Qq0)K%q&KOwf##Hg@TU=4{TW3`8cAU`+tj-5 zgz#Ed2YHp*pup%*`X%niqOw<9@tGe!GkhN-;t6LnbTO+UuPWjrhK)kpxiuN%AV7&B zN1LyzYVk5&=+6zrIKuFDTs+WHdSQ@V`lT^i^^0at!)@+c((1go+=`r^aPOx23%^a> zx@SEVS`q`VXEdJU2J1Q}x@)VyN*ZrgK>msRjFr`-(7};|fZY({G#?@C7{Ue1CvlU{ z(OO*=AepcdxlhMN%331dLVIn`7O;g`7r2W`doDoBYJg97boCiidTaKBzFH4I+{C3N zY5Blk_L;AIk09;Og!^6}z9q^J{1@2vY-XIDGwA0}d6s;6IbTNG3PC!nT5FfAZQOr8 zERf#;?HZS7vm;zPK~lP-M1#Bu%)j@|3X=SWqs;r8B6KqFX9~D7BL)%!ZeEt)d@~|S zavT5Lf*qwQ={SvO63rw9rRc%~8E`3Go~0_L@O>?yPcDVr?diumUNKghex}b*MhsH!H<4tithA>s$|X^t7&Q|L4w{QhW>N>ai$i9J+@H|D zSASJ#Tm+OzekMHDv3M%2{i2yR9UUqbz4C4c$VTNN#rIL-MyuRY2NqglL|KX{c$ozK zqg8&EYPQqtdp}>Tz87l6GHsR*>4gVX#MCQ&R?y4%mQm&EIQxfaoF{rlzSh?L3ES#?OsWFjJTIs={t#xtiRfVUTMi8 z$Pa$q*;vX#w_jnGy7c{3o|nI2u#*e``ek3>=vvl(2PMBowWKg8*IL6yczzd2r>4tg zObX{!R3!HHHr!g!g=K)S3W#u7DXCHV{zcalYM;946I)hMgMT@!!# zmRX5BZ`;_e+8bTQ$Oj*Unp-~Tv}@cmjJ~*$y!Gg>%r1W~O3mEmOE|H&QJ1I-D|;4f zpgwDmRN)!{1<|5@rN}pb`2Y=O&)-L?&t?NA;$Gy_)3YwAt2Uo`AE}Nf{{muEyT5vxnuv;w;^izs!bExt z8N;LXHE@5kkOZ?Zt+{&fB+DVR@E}G3IJ$=1^@u&2LM3-H*4f*V&H6|Vj*H;YGG^PY++|hXX#{Td#v^C zxXFg}+so_|io0V%<3S>&x(aM;DyO))-l#q z-m!5nR6@GtP$cDghd*4@KXQB6j=xU&>;4!WU`J0D!Dyh%=FZScsd4-ASpF+W63rlR z;p6I6rVziZ2!px1r}r4XqkM#NRKrf3xbf}rQYXuPoK|hYFA;Kbm-MGrY`oVUw^en@ zm_lJu)6P9F`493XJnl7Cu;Bwr^S;!=(TL%&{RE5jTmjn-+m~Q0K$pNcWb6q%0FQ0V z+pSFK4x3CG!&3^;Bx!{1K$Pe9#2SDCAJ^-x2X22ogq2Ivf89DJ#k zWC7TT%O1w3Q}QyiC_KqbnC#rSTOlaTCfZ!paR+Sy3A=Dbk)E<>%jd{yp^SmZ@GSw4; z9Y*N5>PnNF>ME1K$b{F{zY*J-EXNIF9;c^uOfj!0C>iUdu!WXX!P(fU^A-}#o{TBd z+X(33m;&C1_~tow#7js?iZIwz({&ow21YpK6>sFQe?TLZsm`>29h;l;p*Gr;D6H3v z4?7T7r?C4L&6P`ly(^cKLfbz%YG(aAoIb=OHY_%}%DW6|HQReGROp%RHL)6u7BeY* zY!%V+&Wn#Pc*zvBO4qH*SS8xF+f5&OBHZ^(!L z!N)Qm8AMJ=e`kaniW4NjO(769_t?Z~Jkaxr^g$C~lq<~b)y%?)0NA~0>YldL>U3?- zsH+>C1N_W1_`6O=93=z#FRJ9qz8c>ONqAymQCThog&Km|9*CMg2MeW=xYS;VT$D~W z75g{vFO1V3a7n9G3*J){58@J0b_hL+A<up0b!tE zXhL8&0uu6}r$xRw9Pd?IK_pY;sAg-9D}t!62i1P0X*D;)WuKs$MTb2g#Va zlh)U&F(@z@HY>2rDz6{w8vitg#Iokys!w!^hTJ*M;XieLqi_GLhn3e5FT zQ(DHA5e{r2A&pp$6thmkf)BdM7)uoHI1DVP!i}lg;#EhN09rSFQ_9{7FxJA-_kvEu zVWgIrEcayO(~WrJwQwu&X+`w9b^_DdGCDXbmcX_^q1b#mBwT(CZSvi-aS1GLY2mJM z+;frV92&o$g+{w}hF<|~Y8$nk5no_sb{2gU0hyN;zcQdLVrPSUEaye^PR=`1O0bhf zgF@fOX^l=dGyiF8YeqPy<9<5MvT>p9X@$N&k^1BqdVTTA4}1((OJe>2EjvCkk4CyH zuB3USb@YH3LR0o`SH3VxpvV6yXM#v`COj`(XeMA*C8aZN7i}+EvbH!;UC)Cb3>WoL z8QCVBA?GPrrW6z&9|?p>z3QY~dn-s86~}~6hoN{5;sH%3PfTk6j0Vtr^hnMBtl!*5 z)y}coes*0XngqMp)02RKCX=LoG(xVoVSZZBwL09tu${mbnb7d;A5$ zc?P(ob$DF1kMN>QHiS$k;uGSzS-#p2vN`!E67{10Y)(;4r=O8YIaWHSZnZJrZ>GOg zFL^+pauT_fV3ivy5jqiUBQ$g{P~z_`Y3!P0sHGnx#iv9zFY)jrQnKe48&uSy*~|tT z6%&)a-^$@*mq1)I;{aElTQrbh+Iz5=0Mlh325v&9vY|U)){1)s6caJel4);8NhUM& z&$s2-vQEqa5Yu8%U1)Eh)MbbxS}p>b(n8Nfc3rmG*U11z{bg5|8>UR5zzk?$v^>@K!Ps9~2VkZITZw~YkprJ{DWhCZ=5Bi~Z?y!X;eSrqE?Lgz>|m7{@w`0tl9*!gw~ctFmv;5$f(*&NIHbqu^dW$^D_gE-2q=y+=~jO-=(riKT}P};Usre{p~S)7T;C;uH^ZEBUE{^05ucR1~4fJcw9JIj1)te zN(1zc6%=zp7h}ab+@RucoxypY0MaAf?*{GBX}twwDjylSm|D)Tl>k)Ne{bSI!(dsW zWoB^7{S$YN2m4x)NS+!XHC6(>-BDtcm%!o#s+Mu{;lLoqEu6F*x$NEWN#-=z{cgUK z!o+b}cyCPY{i_slRAGGYBl8KZb5b=qAP)&%9MR7Y*! zN+NS=O3MV52yL)eCF8!v0m5AHy!TYmH!8Mn=n)tB4GTPEqoB6>>{+Rg zJFOorfnrjAM9w{`B@x6aL{XkmS*#9*@%@e+rXpyTB+wrOX3ThQwx?{BoGd5Kc^dX` znM1H;WbM{v%2ob&@TYpz34m#~B*H(_X_7w0g**9DtsmV6zvt_D{A(AgTdyn7W2Kh> zNA!jBxCi&=e+LVlk@yiX2A(;xrcJk%sfF}bE1InSynuaIpLXv*GJo`T3XhK8glX|$ zAMdt}omD+gnlI_nE2?SOV%%J#%{e=iGW8@IJ+2QvCd-B!Oi@U&*K1as_V|z(Fe^wV zNZQhSidy8017%IOT2~W%UC0T%rL1GXu@>6(rupY1J0GimUF;j&C+x+-N0RhukoI}j zzdcjcrDG%fp~H0M1F!}F0^_OhQm_P16g`<|PIPgrNL+FefF z(z{r-zI7c!u8y?u-7ml;66!R+FGX_We$g5YB-yoPvL8R7b~;0sIt-3(FHoA8Z_SnO z%0IqZWeO*j6y`;6rk$03&dL4Edf4svl5 z0;J@YLQzWIm3t$f3;*P|`D@~qC6B}%=^vzH@)$O;RQGNpD59DQX z;|OUx1&ad@=8uy-fByAcL+se`q_rKspVckW&kknP+cUvx#cRvt5Y=)#3}aJHH-(!B z88ft(u^;|2qhImzDXcl%P2!eUwFAY)`uyw*U(g@&9r^H3*egN!o2KUSniK1Yi%i38a{yofGHLBC#?ty6;ku-p1Bf6V6-06m_Dw7nw};I}ghHlg8jG7~E4U72t(SpMkvXVP;eda}xYGY_`YLna(IB2{`Dm zT4M{!+2+uFk0@Tp$XkRJ7oqdSy{;dIEN=FpZpQKJL#9o44AWuVWo{33+vM$Auud{O zO_A-dF_cU+BbR+up1Vn(m-4Hdx=?PfpA=QBF;cV-uwrJLx%!O=!#}&VSF2x04SnT+ zw`owq!-^xQSh7D$#($!Ddr5_HoCT_w?n5|rl85)ACr-C`fT#|Y3MW=}_X<Uc)X`C6myTl(Zx%Q#J}n1baM&LL7P#HV@0|sof@&jNC?3pTA?7 z4;li7R?20k?}rM(e{#g#CM32QztOq9yiAG|+DSgPSi8A%Mat9!#0;pSJzC(&W9J(3 zHCV_Lue-AlagEz6EYT>plHK6Y7+RHdRkfI%ZAy7sr~PIi_1s+>Vg0#4@)Zs7RD580 zO^Sl}{BF2Lv|mM~o>m9-B+G~|k|@}z=N_{kV)Ae6{0L_HNX-Q1B&ugB@G5=wm6;f4 zHl;ti65huE4DwNQrf44=-rx(omgg2~dtzhsq%}IgEd?3<4Ue#BtJpKs%%flG3Rx>) zt6apkLsrf&I{sX@ST4JY=NBO*80GTZ8VW5phFuEsQr0q9xi&P_O86E*#}a+4MMwCG z(Iv@eKKx-zu)M0FUG8~-{rB~T`yuQt1E5jNC<;0U#2Q-U{S1`-4MoHgQ7y2VL#&m% zvXx~lT|N%s}&aBGPP#&f_19|XlrJ(Z3P578~Q%Y zwHf;U2ywVQ8=We`{>WjZJy{M4VvQ-v{s|MJttq;JDhhj)ZL993d6A%|W}y~)lfkgL zlWM?+j!1Vw5^8SCmy#Jps%`!n+ib0qE`Espl)wY3ou35QZX&EhMRpzo0 z9kEhwxUg_p=$aU(jA&~^H=waGOE*w0jgnQQVq zXtR9_Si~C|t^g|WyG74Iw&)9{!R!td@IzMpH26XS3)$C=NI#( zs--3@HZ0A;%^Gu^!jQ1z{qy0Q#_Zld+G?-=jTGFftNHhppd*Xz(8HNHN3(_Rl|(e zMSzk0>+==}?{x92KnIny8Klim8V@;M`Oj&{8w=%%lTH;&OtQ%v$XQg)#Y(}io{+DY zB&{#Tq^&L5j)j9L9y+siJ*$hPuZ4F++5|PvJj2a7lG>N@3fh;_!^!_sA8P(F9&YZ@ z*8Wd@dyJqa+S%dXEv3CZJ+?sF5??yS#x!ny2svSGR6g~fOTW+ecZw~iYKkpo(%L%B z`0pRORs94_D`v_;*8`c6iI6T{;+(!f&f(N`_vBsM3>p-3H$q|(ovkr}{!;7TMWrH?F* z_&bC0L^y=)I6|b%XmI&r>?AL7@cHK&)S-SN>uK<`iE6h*zuM{0lCv=KJ zvJ~*tK?)4TZC2@SEIn1oTqH)}<5TJ58hEpzqVrvB;(>Ru%C$RaSXG8Tgr)Xe-4-g7&GZ}`- zWv56y$KCLwERqt@=0#c;K3vWp0Kq>FgzLZbun-4zgV<)(PAXl&H{L zj2x@y#7@LOEJ_=OCT!V6K3b%&b|R;Xl&%J}e1l8eP9x|C(uKk-!@I7vQKt@#f1eFEautx_a) zc-dAuB|ql^Z&ex?o(W3inQ}Kvl79C0kWD@`yLb~f;Idx3xK+LBTUGdd5dPv?ZwjZ{ zNb!Foa&!IEUFUC@*RL%=kj=cl4XU?~{XI*4%Q+QXl~;({AIi2Qo!pcncu-4Cf7}j+G>x7wpQQd^ihP-p z*B{Eg+_Ar@7>j#cccY;}UQ- z&P4gL&B5|OTHeCrPNo{1O8J}uRjw&s1)VyTge$qBC`r}+0!0M*)nN@tiAk2N@n)M1 z!eS|G&_&Zc$Ov9&-a9P|S=E71V$3}OiW6z~X%%27Z=Wd-K7*Dh6;!bzcB{x(lUk}} z-9tpPOv*M-sOTI@$~6eqF>t{pWUeQ<0-16SwC>`sU_|Nl)6ngk%p<3cKLrxiSKo!_QZzt-3M#EbDb&m1j%@!`p|EnB!6G*?qZCDgKQg;wmB1*dlz0mbr29d6DZS0 zA1sek&)e^TJB2MgIp2!}oZfOHBkL8VJpj~8fwdE0W5fo&2|_)Sg1|zuLrd7AH%|}0 z5@~v8!czykPjhB&j7;c_KDL&=@cYdvlkZplB zaSe})*X&vj=c2w+#o1aT2^D8r$4*Gwc!NF2^CS&Ej`@MpOk8+{_G(-=Ii8Vxp-g1D z-X=x{cQeOj)XQkLRQLcWS>%NgD}M8ifWZsO$}r+~E-tTJduq)_5ZPOJO;ivBY*v34 z!xlcHZN{4?-UrkP1<(lzW+~nX!7pDF3^ScApf-Y6HEU5H{ZdBelRB8%xUPyjLo3X4 zEmH~P6}DbZ$rTmR8CDC=;eA__I8llCCHkC;P3sKlIhP_U)D%ue3|VU>dw@D^bVwmz zO9t^>?1|GpVibc$6{3+Ssg0dvecykrkA6zp^jC`NLEZzXJ}h)C7Sll%JSnH*zQu0v zkh0F_ABux5FYELA2$v{iC@=ucHyl>~Xd<7a8me8bT&b)c5+&tQ+ND&$z};~aL8e7@PU?d3;XdY#T(;-h65M|dn(W&x$zVf9d|3EWq%6} zgx!F(sS3^qQ-ykwX=D3&^II6P>kQ%i?)4^zi><#cDe+x(1QhE%d8=PS-%G|dw4^&zy|l{vx|=B?)kr5cNzqpz za}hh*JJX<8Lp|%pbO`erYmFE$%Q%0JA7@dl&LLmec!SNs?cE~p^(Uh=YOet_wqY_= z6YDx7DL2ROz6&!C!fAp}=Pq$Pm&xSC8>v43Z-1DCY}lg$s~+3lra`1aHp4xIpYwFR zg%Px`2=zOVTNsZx2-7FiYU^v9(d17O@)3az*2Fdad*baaxwpZKk9(~(V3mQW{-J zu2lo1YT#K1$QD;*$dH#*l7zg@l6nGHOoOaB?SnQjheT*`i?DueKHaL!6yyWbJE%Miq0|&Qg#qIm8&XI7^j>w;ZX#S z)Yy@GZU0w+=ZcTXhKJh}YKMAkH50e9SIWfAxqBThz~T9(d7~jHnT`k@%p>c_fYb1ZwiFYH=IDP!KBGDcU1C3 z8V`FCrKPUz&X$>ZUQQPDCZzw4tJ&9hsn-h4Yt@DY;P2hePuN-05?MP`^Zy8OJ#N_8g=r1(IL%p?UlTiDo@m!iG_%Gpv;YRltzuS!73!4x|VFEINAfq z2=_qsVxpWq$zkNG-Wd^L7{%1|>P?c=5dvc~rZ8%Cw3Ir|X&lw<)WEHk6oS@fp!R9< z_0{ou*PDcL&RomYZshBSSLQ^mb=gthZ3J6o5EH7ERe*h z?Hd@|4PtbsEXSJ!+=&;VMHA-0o7Zb-CL+3e7olAOPM0h#8MDtAZoW20)8z@lT1EUi z1c=^Oa1Dh4lpGce2;_HY5ju`MI~O1nguRw9LGrpXJcHOM+*dfE09S=c%%Q;&QE(+LJO!41lxOMu+F9t?I_bXy_8|BQ zJ$OH26vIZ2qCFmEdLOVsVHglJ26i8$B))_4XCt9TOZ55p3cW}Dd9WB^j*j>D?C##6 zv3rqy@DwHLCh@0+-<1}zK7<%^Ov3B?cKIwmj~pg~%feOIg2V_JV$oG2gp(wn+3VmL-G`I`GQ zVj^NAy|ran^iHV8zFkXa{r16tm!NaH$zUe~8R#nHYH5o*4#!!l2tSd1sad!x=>Z-h zJk}|GjGBjNk*op`^>(bL?MKL^n@JFD`x+BQp*aIJRuW*lAABhP<7GWYX8czjxIt3i z!f4F2+3DGpAT!DpRA0C0hf#L1R#$35+6fM9jW?^&)Sog2hQ) zO%IAfNe^gZ30lFFI&W&1jviWu><`efk5MgPVtHxJ`JWd(P%@*!UL9RNR0=TK5kp%$ zJJxf#Yfk2AVm6tS7r|Oy|K4We6x*|fr?EZ75^SuipX&!E&Jx~BQyAi>jlPUtod$+) zpaM#QjQ?-&m`0FAb0!rqe;87($adZ;QY|k%B%AgO$V6$A49M()+amGI<7K^wjm}(R zACg5<-@stkxW4Md-6AQx7L22{PXuBQSD~^`B#+57)-ih+l~t5wwdy0Y(0(Jis2n7# zT$nP@@S&`eG=j8VpwLg;(nt1}CJ+?ayZz|^Of0(!kEj^yR_`l{??@A0_e1rEG?ZKj zq(B?XvK0YH+8Mu3gwO@-1G%wD+x+)R==+p__YVk|6+koo_e)bWZ59{0oL`bg1X43V zL|;-=P6m2JwDpAG9n?{gfc$?$fkHr5m*&yYFi0y4cD9Runpw77C4eDP7>YpDf+OG% z4JSn|R`e*CAr>|eBP5Lt%utnU$qpPs;(Q6=7@B|#;Ls2is=yR7xM4#L^W`bdq&}u5 zu&3l@t9(H{*HZ)4G!EKADo{5|ssQ~okmoq6C+FynNT(xX7(q)D9`ja@EeIJ^U_k+u z2R&MVMM=%UzX*Z@0WSi-FCJnNG4%EInd!5FkPYzYVe3L7B#wCjwxH-s|2ITZDErf1 zmQZ>B(hk5fheP3C+KmI2X;=zq0@q4j_Q)5sbLlqzTfoX#Ate6w*C1s!F+6y}B&53t?=-FIQa#%{)^hrf2MbV6d+063m^; zw?Y6j#Pjver`51fErz3)_Y*ukFo;O=uC$etVVm@uiD6!(zd(()wUVtUAMCbn^^Pwd zAb((FwJ7%jh+Nd#-{3wmw3XrFb)ZZL7qxcouSBZ?VG&+*xivmyK=}R0BX)57FFBl0 zhL|~hs4>DAs4+p!5IhlZ7ec0dICm5a2rkq-nEX)~JqSMP&$BOL5&&qZW*}t>0nlT4 zKq?eOoJ?Tg8jU_61ES&Rd*4Y=in^mcSIZ_mY!q`F2q==eCPs?74NN=kJb@AB76L7Q zAW#Z~N@af_c^s6nj+rWWDC0(jDnN)Lmu>QSO4OO$igiIVNHqCM z`j8$*kf~f?mno(wtEuFYd1Yl#JCVbPT;-DSmY-Vf%lPq823ZgQK($15bSCA z%UU12J3Cbk1pO{b8`QIahVZwG0C4x~w!9lFYM$@`=c1n$6S4D^832)}%NW*B-TW(d zj%MmN_`R3mm%qD8xY?3*8*lfj#^|utIU-6V7`M0XuosNm_bJcC(iwj7Nhdbj8z6h@|V5x1)Uv;e*acSQ${}= zrdLfeh%2`tzGBVZ1Y8q^D=CnTA0_mc3g5Ss&P$w8pzN`od+|1 zA7d{Xo#M_t;csT?R$H6P%O6=9MSfJ27GAF{G3P3P?hjPxsxKQQLsfntw^o?xSvfXU zmg0S_GE|l_?Jb5q7}y3|(p_FWveXDW36H*GHRgrV?gvBq*dTwfVp479ZGj%|-rDy0 zhSm(5x&KLVqSSIs7@De!HN}S?M|5Va);_P6h zg^msnwUx1afMK1wpgpTt9yP3tH|7AWix^Z4sk@e`ABMS`GK8Xr9=Q8M87TI>0y#xR za;4Tp6a9F_NLxtQ+FKxxZU*t_RGG)=qTPV6WO1{~c@V_DkcQxoqQV+iF9N79CcHY7 z@=kBd08F&|=~#J@y7MHBj}r@!{`bPSSdZ#ex(ZG1HD57qJkO|-O=+ha^Ci*mvq#&BM@#Z!(e7l`!g&dg#j;h!9cN7omx^mmP57_dbC(Fv6 zG-B8J*29!EnP~r@-wbZ7(z*c) zjA6Rc;@>1yyS2Y_M-dqVpFXYl{v?Xu|Bg=K(vNS&+pn*yr!qH}kNd&To#oEU9Y37` zBMrvB*cgBe&LaR=VPg_jjU@-z1Ew;t34%4t317mXayn=!`xsed=d)DGLgqAHz%tY> ze>%eGZV~ zlv17Y+)Bq;NP7wg0TUg_lL$N!y~oA|cl=zzi7f}8Bv*m&gdFC7S=41p3T_QW$hNff zm5KuV087KHHq&XxRSyJslbSXGst7V*=P8uqE4Sb$l1^#Ram{{TEeuV*dlX1SUc>yH z+8!j!DsB<%VY9$_CR~-4hAxt;zj`=O)kyla!O{ikr4?J%wlypyye-s)Jj{(C<;91K zgpOOWKzZybJP%BaME>jvQlseu5I!j%v@!>=lERxL`zDj=8E1O4gfSOpC)WmTDR}d{ zc$=y{N@QslTnoeVf=#^3gMPVV>zL}sZ*;B4d)*6uP#dxG{V<5P%2RQyQ0YZcu|RR1 zMCyh}CXx+%x)N-JC}E@(LiktX5ymXdWFxXfo!BJ81y4Vunzt9v&XabDy@*^ZqoiJf zOup|F;G=&;R*~xc)(7!n@{Sn>$L33D^gpHmdf5U$1wFI$H}~?&BMfPd2KZWMy%pB} z;`o?D>6(%Z(U$Drcb*Zk9eNtB2|sXPh?B5zC$EaekiSm0No2oYj0w-i3Cz}r@>yb` zSHdaC8v&0|!J$KnZ_sa?tOHXN+eo!Ze2h#3md?M&d=|;(B{oCw4h@Ya#@?X>7d1Wo`bmD z!w?W}0qBz*WXb_vkx^a2%}S-{1AoYJUFxI6oF)^# zJ$o$YeNup3xW?uH4cM@`88zzQF^)b0XsPGI*oCvtWqB>dXv2GHbxBS zY8+2RHRSxY!@-;=)fyZ%Pd3%k_C1ik7Sq=LGMcooPx(OMa4xQE)17-Dx}2h|x`X;BqHo(PoAxx}uHs~}wGc$Hnk@j|JftzJ z9CXBR&*A>H4zBat8cS}e@Hw^;dx{m%BJjFt^OzJlOG|m(>LkH4r`gP>`4VUq;Bm`` z$RG1SJU)HUmK=$B)5?dFYu6&0hDFpOg#AZlEBZ^k!IqNucugzFS-F(M{u%9#Ji0cs z@xqN$;z$O&TGH^z_J{^Ko2k<<1f+#=L|dIELVg0v=-cxsvC~~L^wJ`T9&@1fMqU4S zL*Fc-7(q*e>M?6J>H;}yz_aJ{IWhd9wumQO67L;~9eb`1z&4uYk+$G)voIBV09+HQ zH}$xB_f6KO2_Rlh>#Mmlw!%l7mLZnnl=(@K9ghvr0dBc_xEY+6+k`*$;zBKZ_4+!JtT+CDHBF!-m6KwKd9A2ho854aI>*sBrV(jtQ^ZguSM zCk!ZbhJU|CYIxaRcelLg+!bax{@&4Yw)fXguRsd)C;TME<6;NVAbb9YqVJ0|VLx1> zV6d~eurO-mjOC5{;Nt0Uv?ev*g(CrnT_TU>gBT2jP>W~_(=p1Vp5Y~LBizni4=s_O zp(*LgdYX3W*5#%uiEYjvV>lv8(d`XRD~Nc^@Ex2^plh(P;}0lTc@s*_e2iO4L}h)x z4*IQkO+s_2#Xp+ewxt~fuF5&}TXh-dW}eYN?c%hue8@j5hRZW2W_OiKG0 zL>IG00~n4`>aG|?R7*5lNzrTVDJA;uq0y1XgG~N&+)46H-OfElG~Uo?M@ZW4WT;8= zyS`702fNqL*NxdLDn%VC%9YkSCeP_T)u4f>#SY1PR73U2!@PD%-=!Y6>h7RHm|dzg zCwgoqK|xOTW#H1=q302~2IPxT^rMx)tQ1+|a!kkju;>sya2mIhK|zDOpKU+D~P{mRiz?v>a)iA<8t3lW0MvJDXQU zTW+*RQNH7aAEU%o(iz7wGISnZsI({+YGzDx=xKRl?gu5HOP#XM*>3EJbv1<>n03AW zu}8mQfh*~WBh8{i!nZAVuy{P_#nNrDaM9x{)KVNS`wchp5G6*Lj=iK~pysJjE@34~ zwNPC`g!&@r`#MBDA&!+&iJlP4GP5L>I6{8c@fdH&#y*5;8LU+H1YuO$moP9B#>9h? zodbS4?KpAYIQ3)FHfJ%|9-M!NgSq-{UoK@O&!A#)R#`W;PI9Qi((?j2wAWgwiiSl!qc{%9ZcJIPDiR{8=_w`Mtff$HqIQNKjgc78TLD<8)i#W^ZY}jl+0iwB z7t8>4u43cVGV&Bm<3U;~6Mm`nm;_`?48uQRA2<{_w1y$f@<87#jvXE;kG@hX_73H} z_Un>}888-6D65H+%wvilmJ7dZx=Au5?u@|)I|NF<-W}NC!JFJ=s#w{kohqiL2+c)E z>nEu~1p1Mx1%H7_du`h&i$UMwNoQ*kgxH7mAH8*+SG316=yl8!7i22ytLm%T3V@t? z8c$P1(;H_M!#_mABN-5UR3ddRMaShc-hzt6$>Q2Lc$J+blj1YRju^6*NjQRWM`AmE zAY~A{K?Bj!V!uiD7`Y#%r{;#m$x9yD6J{lp7SV90bJ{sj@*R37Sj>B$Oj!EcP>mTm zU`ScQih80lP!~u)Q!6W-hQ{YsQ}(#m0p`{StSMv9nKC<>tr{U0y}LwyVtwD>X3<$W zM-51n#6Pk$@&=foAjAf}!8kE<|23wKhjlLm-Jjg>pT7yw^3Pv+mO05rY35Q7^~JMYPE#NZ%-zenPu|69QT~%jUTJo z(2Um!FYHwGRtxmzRgP0@$h@%p1JDc(@gQYW2=PD_*kza;K|o)ui+H30;$eeyq_U|R zr$)O=P`d#p_^)e>`bvtPdaP3SpNw_v@(|V`ec&65sB>W8NrpXAxP|$t$HX=; zsD~|c1~Z+NRq>6s_c>c{y6<}OrU8`q2rUs3nz&fF8qyHbAW5JKJ*$(A%kxtV2(v`2|)I0%H5F!ssDbGxT3Ab>p01thPL zLDU&NCR3gn+H_*vv2e2^3Zs1R*a=Ak_QYAI0G^M9yNZMICFh`Iq~AWEntR{z0ic?n zJ3I&Fp#0diP3PP|;|wbuxG^a?%X>Kf#3K!+nAS9F{trNoS-A~Lj#==jMwQ~eN68X3 z&n(nzqb$$t#pVM~<>{q|>Tcg7jjCI)&bf(44(mTzwP%jbtDHWfuW0!2AkwqY*6e?2 zq@$binI5Gc2uk+H&7=Y8O1;c-hlq?Ei4?WF&yuB; z=9f&#BNx>KoWZn_mYB!oiqWwP@+i6=Z$~`!C8-OQj0 z`xM>G(B(+REJoH^-j-khdcV^%`knVxM8au!khpMtpt?rYX1`>mtQDquu?nGjW5Eh` zq1-Jq*~L45h_%8}9ITW;q-6}Z0>(VyQA(ff^u>ZA2JRR9+L*QFCdg?)3|C};-I^YM zq0A^$(vK1L@7gM|VQ#(F0g;cIt+B2?LrU!kU5+f=7c1|Tq{sy>E_QYc8ERa1zSH_`KES#D7?uU`QGwm%H;zI@zKzY_(H3xF?&!sH_G4KZ3t zJ$Q@M{ywrNVEOMG>`JiP_wp}}y z&G%m*E-yJZoc?&mB?H!Aa`x+mw;39v&#-(EG*RCe`3du`HjSDb&2WaW<^2>AEc!jo zw?Bk&zfr>Tpl>Ge^Rfn>=0rZ%mhkov5Fa3E!E0^^=cXfruSTx?qJK1y)6w61q_|lf zo%R*D7nKdm)A9MXas9mA8yb{9M#hqtn%$zMaQ?qsw&M51#Ynf+?#9N)ShG^`(pyzn zU;P8Lo+uF?7cNj?QoXzB`5P$VesI41yji`9q?eUTfjcUTIMGi;YLPAnNzzievR#ID z=(8g+0LwHQCW(FCurP!dm;37xNrV#;)j#yl-g3d2f%Ykp?*9Isy zCx%gbEO-n+G+Vq0KII{~dJU6}D%ady+vZW3fhiOqxGV*H9@g+-9#$VbAie2icaRN> zBJ#8bH%MKnE+dO*Q89=O^&JQ;BXMhdh9T7= z0rVYwH+}dv>6fK{Z3hXihSP^Mtjs5$DXfcFGB)H%#M*d}rQh0cnBhka#|!aY=hB+y(ia*XI0)Zi_Z%_Kk^)Q(icW?_Cz9avLXKKA zLam2?90Io9bGC4xOsZ(aRGqQvF?=WdVE<^VZfJ>U{OmO!6ObUF9T4W4MiCwaFYo1d zFlfD6TW{A7YXyiIw;|vRyT4Kn<>g?6}0Qn;N zz7U5D5Ykg!-3y`x;C~%$+%Dyn``<39Q@EvcQZ{7>ReD%gmnc~2 zrfNQ3DTDkB4;p{T1wogiH|F8{8H%R=Drj#@v^B>rKV*+*VOrK{;d@jd_+B1PR6uC| z-6@mcMI6se=hMlmNWW}P0LsAq*R~?M^y>ZUtY3}3n}wW%P&BI(=3>;7YCW4xB4g zMCs~OuXT?yH z(Mv=|8(o-)GB|{cGP;Zqy~m8+nWKHq_s93$b?>@+ueIN`*V^m-|9zhQ{Cq$?y^_2q z^87QxIt}b zO+ZtKPFu>ltL*p#P7+Y5pl{E!HXB2tjRjfd|u!d>QqK`;& zS9>?G^52h(b?mxLpJP`t2^TZfm||991S{Rb9&hur;}jvY9xs;Lmolo^p5E`h`*o4+ z7hmO_`7->4gdxz&!~8o2M}0?@UFM6bNeRkqjsf3nxXcu2dyiG#MnRGo?Snsefk)w~ ztoq6xXLLb}?XV8mVU@FI6-zR(8(SdH&MXwQ>}>S$&ZjjjPyeG`Qg=~|$FoTj^P$xN zf>5yg%iPHCnbIt^6=01q#GFDt#$5aQXW3L@bG8=D7TzVg%+PA{bYxf49ONHn&ReZo zr@=N!xw2so0Vaw@iL~&@D#z3{8wc}v|G0yXaZ1Gxq`m;ngKwNN`4~jywSlF=z{bmp zFCn^0Ib47ztf3^DY~lT_z}?Ca$LSPOO7Fn6&lK5{wRID!G!3mrt$=WXWw9S?GRV-X z*v@n_Ik%PbBxy;=O|lj1*l^D7e!cPHTA3l-{Oe9O_sOp}=9<7++r;(}cA9$Z(6Qs) z*no|!ExlihIlEu*4Bd_E(vh6Pg=7n5161BQLT$f+{_K|z8ejUxM?P;&l+=H(t85A> zQun=pFe#)%z8puc>(cj8j0L8^o?Yb;>&R3`K-#!3s-^>5=}#3_=Mrdja+>T}NF5X~ zSHympviyN~8@=ErL3fpzSu=Ow`2NVD*4I%t$u4TrvMOZqHX)ZxR$mXxVa1jV_zo-V zRB55GDX(KU|2605Yqe-yt=TE$0Qb10ultmI4o<9!X=#f{2Igc1Q4*RZD=<>p7 z4+I6*0%(74s-zTc#p+M>+e4|h^u*hP;_cciJ!WaPZ-&7XaxUpSGf`u}UeW7Dswirh z2heQD!*6&bz0jz_E=uQgb~(%pkYCOH1FI+(w^I^cW5@el^=-Ny%v(hKpt}<(->g&> zrKgq>ej6DvI>u-1N#y+v=SX1EN_s)ol?rjAg!=X$kws-9^Or{JYJylIQL9ulV5 z55fjZ-cQF#jCFW0-iyKQm`w=Og@^$)+Vg+%&sff{x)|}105q;kza%-Aw%TegNh!WG(RR*3$b`bx`;3EpyVKc z^a3R;~lYS*V;GNQJ?-VyG9VcoR1rjbeyPVJ@q)-;^;x2{crA-2%9)`IU4Hh{72YaYTp6Vho$p* z7Z~9Tx>MXHlh6I|@^*yIQSVqvQ?T+f*XuNow#7A-k!8PyfOG$fi(b`&K5n?6#9!*j zjW7XJ{2jk&X@pmudzTSzj`KQ?Y%E1F*p5jTuYr$<<|sA!IvaY{85%u$>IU~8rg(d$ zwtYTL(P*$zNE=yD~?mSK&wz=@ilT@MP#38MAONgcbibs()W z>4zXrWd2_V27CIaQVA*n`n$us>jr<0&!^g1%!u#-OyNm}&iF!1#hATwz{$x;T5S6x zABV?q!9t|mKBHDSnT6}5bE(kcqSS%_!45m;K%t%$8v0J$b?X}w70u|91iR?^o78f2 z@SNflP^~jGNG9xEMi2dh6D~F>j+R3D)d-0W4XeTq+l*uBu2Go1=1rt#+$YxK7K()- zR=t#pVldZKDSo@KAy!;{H2HICUvpl!LD@e}`}HWE7R8c58W(OkG0* zy_ePfRxj6y3b6QpQz8s4MAgDChv{bN^6l{u8jhbbSjE?`&5$|qO`u^IABGz*nPo@> zmRkdT6u{nzrhPyQWKDSp2Y5||FDZ^WN%J+Td(814rL4!#Udu<<>>sk)ZuOyF6$K}^ zmQ?4El$qL_g>6QAI~prg?^vFSc`?pR(}j-dOggjOUrXPc#9>a+Hzq9Tla-THe2ns8 z>_;cBG?3&}*D1>wF{Ozve?46l-*?$Ada1iPap(I`H&zd!dTo-WR@7_w!g*_w#dx%VrKBo+fw2QQ!Q{# zm`zscR4_TOKWnR23LujIz|_MU#f2&p^Nk&LEnr68#61%7ka8&7V!qydg^&T8o(Md~ zjufO9P%4rsj=Q4qE3tU6u@kq!@RRzz{1HDhWHb#eElV`>#`GSWK)C8aL5T#K@ZJjQ6q-+KDL7~IbpY1=#NX9B-Vm-&QS|g*i`Q3izqaWq{ zlN5^&<`87|P|05Ax75~?<3Ikm|4t4H{PDgX5mxeP^VbSOMVz)psTgT$EG(TThw(xNs6h`kJxmpr-xYD^*)_%FNRd#(EekIjnzaVXP>oR@}BT)Pu zqbUazyt30j2v|f%_uX#15Y1ry+o#4`KQ{ccd4}<&PtAkg^2K{I2_Tt2Z zON|SmuW!^IpkCC&q6%e2(v&jC#8nP(XK!}T=h{9nRMbdWY+R1T0qj;DU`8Hi5Ql^5 zq__VlcY@$^ zRJMAm5-t*VQp?Gr=UsY_q&I`>0GpZ(F?U}{L+d!koHQi&8tY_U-4De?(J z7szI!2q_Y}lA0gSGFZ3k{JHXQZBNJNiT3!j+F_6rk|N7LB{a&1J1OGN#OTn`PlqVME8Ray)(c6@A zKQ{zo;}0GPQv%3ld2`sT1vdOZy__O?9L{ zCh(+5?&nt+Ux{48bh>@Zr+(j1zS2!BcoIQ|OEN130{@tM>e8~$pW|67JvSRqaFNCh z33d94WfCT|!A)top32mvGZo+_Imed#LEm%ThjY5nmU>29zH_OfVI;v*6gQWYvm+=o z7s>>-6eCRQLS>Fi(uxpf6Rt{}`_|nDEgxR8qx3yX%zxvqrv)!-mBX$#^Nu>M&Mplp z^e0iTYTuM6g0q9xXU~EXm6-wyA2qxb@?cHz-@z006<$!h?}#2`nB@~9^ts8KdQAWE zfhx0PgyzR6NO71w?Fd#c7VXE+&U&%rlH}v5H$0m+q};Q5$$kC$x>xlg z+(?gvl=;?wXV2YGDgI^s7ZTmSH~Dw2#s7C8++gkggK}Y{M^5q26VjU\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -326,6 +326,44 @@ ] } ] + }, + { + "name": "huntingqueries", + "label": "Hunting Queries", + "bladeTitle": "Hunting Queries", + "elements": [ + { + "name": "huntingqueries-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " + } + }, + { + "name": "huntingqueries-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/hunting" + } + } + }, + { + "name": "huntingquery1", + "type": "Microsoft.Common.Section", + "label": "Bypass Attempt via Double URL Encoding", + "elements": [ + { + "name": "huntingquery1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques.\nAdversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on AzureWebApplicationFirewall data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)" + } + } + ] + } + ] } ], "outputs": { diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json index 24b1c4f11c4..8f0a6c211a2 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json @@ -77,6 +77,11 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "16a81a04-3d26-4118-8f6d-6dd3389583cc", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('16a81a04-3d26-4118-8f6d-6dd3389583cc')))]" + }, "analyticRuleObject1": { "analyticRuleVersion1": "1.0.6", "_analyticRulecontentId1": "46ac55ae-47b8-414a-8f94-89ccd1962178", @@ -374,6 +379,91 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Azure WAF - Bypass Via Double URL Encoded Admin Paths_HuntingQueries Hunting Query with template version 3.0.2", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "Azure_Web_Application_Firewall_(WAF)_Hunting_Query_1", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Bypass Attempt via Double URL Encoding", + "category": "Hunting Queries", + "query": "let StartTime = ago(1d);\nlet EndTime = now();\nlet TargetAdminPathRegex = @\"^/?(admin|psemhub|bin|config|setup|install|login)\";\nlet ModernWAF = (AGWFirewallLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where Action in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(RequestUri, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action);\nlet LegacyWAF = (AzureDiagnostics\n| where TimeGenerated between (StartTime .. EndTime)\n| where Category == \"ApplicationGatewayFirewallLog\"\n| where action_s in~ (\"Allowed\", \"Matched\")\n| extend RequestPath = tostring(split(requestUri_s, \"?\")[0])\n| extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))\n| where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode\n| extend NormalizedPath = tolower(SecondaryDecode)\n| where NormalizedPath matches regex TargetAdminPathRegex\n| project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s);\nunion isfuzzy=true ModernWAF, LegacyWAF\n| summarize\nFirstSeen = min(TimeGenerated),\nLastSeen = max(TimeGenerated),\nAttackCount = count(),\nSamplePayloads = make_set(requestUri, 5)\nby clientIp, hostname, action\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques.\nAdversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories." + }, + { + "name": "tactics", + "value": "DefenseEvasion" + }, + { + "name": "techniques", + "value": "T1027" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", + "properties": { + "description": "Azure Web Application Firewall (WAF) Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "source": { + "kind": "Solution", + "name": "Azure Web Application Firewall (WAF)", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "contentKind": "HuntingQuery", + "displayName": "Bypass Attempt via Double URL Encoding", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -411,10 +501,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -425,13 +515,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -515,10 +605,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -535,22 +625,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -634,10 +724,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -651,22 +741,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -750,10 +840,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -769,22 +859,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -868,10 +958,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -889,22 +979,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "URI_s", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "clientIP_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -988,10 +1078,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1007,22 +1097,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1106,10 +1196,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1127,22 +1217,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1226,10 +1316,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1248,22 +1338,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1347,10 +1437,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1367,22 +1457,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1466,10 +1556,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "WAF", "dataTypes": [ "AzureDiagnostics" - ], - "connectorId": "WAF" + ] } ], "tactics": [ @@ -1483,22 +1573,22 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { "columnName": "Uri", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIp", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -1907,7 +1997,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Azure Web Application Firewall (WAF)", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.

\n

Data Connectors: 1, Workbooks: 4, Analytic Rules: 10, Hunting Queries: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1937,6 +2027,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" + }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", From 5a466d00332777635a382f3971ba8331860c179d Mon Sep 17 00:00:00 2001 From: Ravi Nandan Ray Date: Tue, 6 Oct 2026 22:26:33 +0530 Subject: [PATCH 3/3] updated connector ID and re-packaged the soltuion with version bump to 3.0.3 --- .../Data/Solution_AzureWAF.json | 2 +- ...ss Via Double URL Encoded Admin Paths.yaml | 10 ++--- .../Package/3.0.3.zip | Bin 0 -> 21789 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 38 +++++++++--------- 5 files changed, 24 insertions(+), 28 deletions(-) create mode 100644 Solutions/Azure Web Application Firewall (WAF)/Package/3.0.3.zip diff --git a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json index 64770bb763d..9024d01044c 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json @@ -28,7 +28,7 @@ "Workbooks/WebApplicationFirewallWAFTypeEvents.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Web Application Firewall (WAF)\\", - "Version": "3.0.2", + "Version": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ diff --git a/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml index 48f343c5990..da79661ab75 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml +++ b/Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml @@ -1,16 +1,12 @@ id: 16a81a04-3d26-4118-8f6d-6dd3389583cc name: Bypass Attempt via Double URL Encoding description: | - Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. - Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. + Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. description-detailed: | - This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, - when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. - It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. - Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations. + This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations. status: Available requiredDataConnectors: - - connectorId: AzureWebApplicationFirewall + - connectorId: WAF dataTypes: - AGWFirewallLogs - AzureDiagnostics diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.3.zip b/Solutions/Azure Web Application Firewall (WAF)/Package/3.0.3.zip new file mode 100644 index 0000000000000000000000000000000000000000..a42ac5258b477da609b5ae4d8a49c6e9e62e1024 GIT binary patch literal 21789 zcmY&;V~{9KwB*>fZQHhO+qP}no;!2Lwr$(CZS4Ja-}|wDIx4y&GP3&A$vRo56r_Pc zPyhe`AOJ8M#dNuBd^rbU003-60RYhdy)||+HFPmmwG=Tmv$V5xv9!0NvvRh#JJ#{G z$7VGz>&Db7rp{)kOVyj<{_+EP;Z z4>q~v%kB(9$uW{ByV*$54IZ^GqteBIi~cB$$l|toA=5S`c0M#J)vV0G;z$ZOo0sQ? z$B*j6O%ovE14F~{t-btl`PSB#q~_MnRtRw56oCa!F<51v7=$rtNR|`k0K}*iv4bTI za!}r!cd>|6kuC82$8GN~aJbyx=5zKr{43E#?J9>4hzIefi67JGDIV`V8ns( zP!(m!t&FA#;!XoSn+~$m@`UlW`Sm?Ck}}%E1#i!f_%^O6gd7it z7~--Buuy|J9=xmOlL}mFSkkA$IUEKpHelw|g&3VM3z{n@G$~V>*L_&6XVplQ z+Kge!>}ErGYD+_PN>~}Ny2ejr2g~KCah%ia?9M5sHAST&`&71&vT8OPyEK6k^4YU- z0VYObIymLP^*%h_Uq;d(!mpg7lXvJM--dV@=?Fb<0xA|i%!4+n13Zh2)fFle9V*?1_k2;Ec4KjnH?Woi%^&e^ zE2)sFfH#sljGAZ+(r9}K=x2iga$mm^!9fy&B(O^%2(|Xugqb{X3xy0g2Vhbv${f{A zBZ+|7eMsu=&eH4jXwIms7fd4k%^mr>4#Nnx*1#$ksR|Efzv6@Lc+67f%D~{qjSeah zi?;D`(u-8u8ybgTGwG!vt?dgA1qa+ynzSN6)TJVc<&;?B#o0RDn7P|USrELnU?fzg>DKPS%(8*Zae2xGHaOWCyWB-Jh7G|yO(u>9l| z)mI82QATyes`KM4C$39m#BRm(B=I#)S2(h11Nx34?Tj;rr+@49uAXdvofHtXmjVqKw4y7i7$^dYc#@XDpvFvBt!c}F(Pc^`>b1!csktx(us$_a+^)zT z5SzwcxNkc)+Prt%Dv*hMxWH1qp{~62&K(b4&4x0oc2K))C7i4sgPR*-89a?6itV3g z#>H=Ilh4MsAuzb5Zo9@|+a!-2m%MDhYu}{hYI3@Ef)#9vueiLnMXCyZEWl0O6<(jA zbICJS`C+P~7h4*-r;E*kMAJuXhs&-WC$fLAqVz}G<*br(^FqVNJpEw0|znERtS;fW^;lg z`vfV`dRlaoRc@WyY@a$&blr?ny1VgeJGgOXOG4IxZ2uT8){oBp3=V$kciNDSV33Ox?X0@@cL7o?95td+t zQpz$Zmcguix`W*)I`KYUqg&14gIj$Xx!1J0_wsz<0;qE~Lo92QfWr*LK-H2z5bJ^@ zN{*SP#5iKAEoNyrmWDI<q5^T6tEAjc@I%xz$Y1 z`cY#SlyIfSN^F)UFH`k$^F0{-=77_~r?kkpNJ-A-B6HW~b!z;sv?}~^we|o@py0Oe z$wXi(m|bww%kuHsi}a^p_PL+^RdF{|DQ2vx4kA9CQmm!DOGV<-*xPiyv?EBhGO3c& ztv=5}33yMFf3OV{6y9b6R(9_Sl6m#0Q@`P9e^QlU%e`D-#q~ucFQ;x>a9E8GM%L!i1$6z)MGFNej;mdU%tpLM`!K<(X`^5>DvAxZuHtC&hQpm!vks zWM_&MFN>Uzy2p%h)KU*pFx;u1hHsimF?8q5zUkivcBCMur)XW~5C(yJVIt~T23qakCQx;4W%f`BkjM$^Mkh08RpCc3NNIoOYatp#?< zHEzug&(P$bs5XCl(5IQej4$1kHG_F?5ea6ds z`}(1soAi0}4fJsC3-GYIe+PH}_B6k*$Q6kX3A1m7BlmYvt_ZcT)>w6+o}%-6XXWu` z@165|bG`7|#C(i455AF^j)}+qhYP3W2EF`}h8^a`&Do-(O&M!2Z!PsqVazLyoky(N0h6ED7NBk+f4C!OxYPfX9F>hn7e|LytjIkKd%=koXc!9Ahx;bZ5(;dk5UX@05q z7m2}pg5AS#hoR=Y8+aIBGSV}yoxL6ppAMSPY$elDIv|?T{l%j2`KF43JR7%-!%avr z?@Xf7z!tq)Z@YHYj;-!lwtOYs(;CCO1eB0=H}~+~c3M!2SH1}C*-s%jK2q~8=HvZd zrzN^SeGB1UtDGAX12NxVY}6lZRe)z44!^8_vvh5=x#xC^Gw%4fS*$O998`P)im$Sov~)No>eapkXvhgO#2`FUAbzt53EB=lG z)okNZo-*WQmvaSUf@HKYH%iTXPCi=ePWM+H3XS+$L2B*Dg&HE(t# z2Q)aSDweQGUas<=q8o9iTJOguGp>%X@!z3QBm-`5f6ZkV*naVv4xs3_Rptyok#@RN zH@cZF>3-6fl3P`apzvok6FyG1vzQIr4C@;IU3}H|yZ@P_{{dI{|9p?M+e(Fw zH~>J)0}ue>Ki^|(XlbWnYU^P0&;9&g$8+6%>9i@4#PH!y{DN!M&Yk}UPUzsE^s|E*_4Z7#TIt#< zHB7A>55vTa(|ztHO2!=RW$cH)%=p*4e2Qxhcayl~mHj|zvA!_>!VmO^d`CVq9QLXo zqGu2|M9Skv76(16huw9xaAr&xtLSlk%CWmw?wA<^0eqk%a{z(D$MsypdDg||C=#$R z@vsPwAh2c};n|FNa*5H}$*AK9O&e{a`zH4)6<~uGe+{P7LyG4>$8^?-kWE#Ous|MudFhcqmgl z?4|#{DL?Xs+6{J_G2)*86G9i+WMheV4WMi+8{vt+HSRNYrcRE9bLv;H6Rl859iQQ1Am953Ud|#!$}wU644d?5;^?D_yCtrBI~SVC4CatvW+p-k zFUeUrv6N6MfI6TMfS*%CBvRDnZB>qQFKZk3-Ot?qcG77}n1a5KCU=vm(1-R@m@V%i z)$t@oadu=S*ZcxyTP{Lcq3(e$@;Z~P-oT6U{-iOq3Kig(V4o z3|9MHdR2FXlw=&}ids=C%K6&R0na#o>wr7NHCN$-grSxn=41xe(O$;svu%tG4@|RO z{aFqVP22Rfv%e-X98Hm(pJ}*sSV6Z975>XD-OlfFft-!Sumg}Y2 zsjlo+{pHdRdVOyx!2JqBIF#ZL9830R$wWDpx0h5H2Sz|5(_<8;Cd%keY}nZj4>0Av zT+#G_J!5Hs;6V53G5&3x3i2Vy&5E9KTFE9~M^ z#1GETCkLtSLc(82^0a*PFvTe391*!ui@B`4W5u1zQRT3JP`G zeK}NhEUoRb<|eV`jd`x(w8CbXV!d0J?A(qT>I4;m_yPB1f3bHva%d<44NtHac2%00 z9CYVsl0s-awLf4KCJC)9At>$e-g7N?o zYx3x3jB776N8UF%IcSKIT$*p{AX26f@l3<35i<^Kw22AH%#_#=Ft=4StR5#|<9&sO z{UPoxLzwi$Q0qyJHZsk&mXuJ>#k9c7wlG$n3fE>aaP=m+%7uj(vC3+7?o`C`(nbec zXSA6Ge>b!mUL(B!~IqiVF>ztQACl81&?VrsUv z$Ao6DYi6(x!xnE=uX15oCZw&Lt-#u9FlK2r%4!wY7#b|t{cUh?{vR%OeE-A6j_-fD z&>HWjne2c3$E9-_tHw>NW2K@cORIPu%PQBcxX864qv`3RY@386HB>vh(IM@pvC-i& zQRCm=rml0iyw~JFmV<&`Wo~fr#)NKdY-F(JvN?C%>ZhG9TXw0QKVNF9*|D+qC{wSf zwky%Tg;CaQ%N^9@5dLpU-x}uoG8$EV1J~pZXfr{JSTtLjBLlftG*ek_;kbimF)+3& z*DFn8u`tbY#!CxXu~w~WmMTyReHA;dj~UFI(-`hm^aNVjr;(sFHNm7tdg)a~eXX-WgcKtXCXEsXa~$j4 zt#2!_#tcUSZC-mugCY(%L45W15g;7x_4%flY2Mr?YV|!B6BdLXA5t4cOEL&aG%toc zU^7a|ql?*Yn?dSKWH{i_31}T`R*yJp_81dD>NlDPnm0wrOdqq}Kd7YDB5i(BeSn64 zxU9$MEs-usJ5?$-)uL)9Z&R_7PKUyOM!I5lu)7|2va{tp6&pwK)SV^Ry*$tPR0Of4 zGg$S?yV9B+s(B_Kt9dTDnh@^>`GmRB@^84((x0hOWD?b5XR5O%&eg5;CRcZ7ZcrIw zdpKGbBg?bp5zMotIo9O6AYC)xTOUb2ULSGFi%pbt!x(mgB`I%aOJbs?iZiLQrO04I zvY<^+78?GB$y~sG$~?r0kDJ9p@L_Py#a<+!<3%`nK$TOC&dHS8a<5jZd^BOPJxP*C z3W!*hhrf(TTprv4xWmzor`x9KzsSRH~veCZ}d%#$IM~5Rd7V> z3(1h(J`>ZHS55{_LW*kwc_z+)E|H!bXeVorbacIaCn;7q=C`tplHHQien){vP(FW4 zk++pGVHS8&zyL{ZPBDMS_r;VFj_8?QcXyPJz&mhh(8y~#%;0SbP|vEpO!Yj(dgpI8JoyJ1Np4)$vT7{gb?w`Vqcvv8h>ld$7MTok zzMW4nqiAw>Ho-D@8LeZuB@n>8LUEB;qQE?U@+wx;LtP?Yc{Vf4AK_?*RtQiz9m6@d z0I`KakU2an&r|q}kIRu}vK>@NAjGOIY z!<}Nf_Cx7pbNmC(1;NE5@~w3H^>y`B=I;7&KSAu?i+i{itMa%I;-i677L%DVk z+}sKal%wPG<>2~te>l82_<8m=h=#z&_2ck;V{W=5FGs(l`#Li-!=IOnm)oN)5dLSh zpOTh^tNvpOd$E(-NjAQXOwXEi9QQp1Do_q4&Xvp5PUOd0O22BlRQiv7<=&5o3tz4g zy2(9e=}snd4+3*6+&qf^W;fH{BXppKUE&eFr_0RCfGcsRq%#JvbMlbU8M{r1byoFJ znd5KtKn1WJKOLUMxvz%zDByRX6b*=7a}n3wHC>ATStI7f4%74*8fKg7nA44PcenwwCDo-1Ot(zR1Je{L zh{6+bfZ-{?Noh`!EP5g3l(h#l8VsT7ikgNDMO4xk7Cg+^pyX^;E=O(5;qHeBlJ&PEy2ScPJ!w(q2Y>IFjyp?aD*T9#21uDr z#jOq~N+_HX2$1^hCqX2}8P2B$+%K126}h24CzZf)pc$g#Hn&jvDuNhFGF0eh>fc&= z)0D3u?Hp---X~u^RA1gwUtX49pFT^J9_o40sXb^~_sezk-AcU47Kb;K$RnS%#2*Frozz#^XX>h zxU;wAg1knSn&vrQ$XxEM8JH19DE)}olLOoV8AEF-3e@wfX$K=+T_ zBQ*ed<8jUAWCx@mbU6zj5MRdD_W!cD^7f4-ZTu?Zozol?O2c>NaX9zKDYCxoyx4j? z&ae$RZ?kFs ze*1EsbnjK-!C$dm|B7~gE5QfVN6yoyD)v6%d4GWT)tyZB*cU(#FdYG~yF~DalT12- zhkLw_v+jTXUZubAsrQuW=XaidFCEhOGMr- z^>HOZ%jL)iPm(CxgMuFfRPY-K=PKZ2G!aMwq}6bOrlI_WJW|b2`a#AEUt{7SM^A14&>V}@BzjrZ9boMdlTr0S`tThpcoX{~{+Pd5voC;J1=Yb0YVqd1ho zSB|mxJS@X<#UeXlV<${`tnk4QN66xX0%0yC?@{lJmBl6O&1W zTJH}s?J#c%m~$x=yKA+Qc2)NKewM*$w)S|xw6?p92wFemzNpGc3-i&lWJJ9T?EsM- zP$pZE(LMw+Ifh){8CMg|H#K8|<>d^D3WcFOkTtZ5S>|-65$JR#z>93{gK#e|M$=&M zWiE)lthS2!{b>Csvp`#6y0e!(%%eF1112EC#`~5w8f(eLRK&(|CXzT-akkDT7i%w7 z+ zK*?MKY2rF(+k(W&!o)AJ=Ui;aE}A$d-F*(`+mvlWj`)I9F42@kyAgcgGWQt4y^w}0 zAxN)bB;>qE*mt3>;}x$ou9@}t%m-O;AbKjW`*s;l{Be%vhvntBemjOb5-=RSccfx5 zx%3O1g-JT!WoqSh!15&>$~)z%SXXA69xaO@_}s29yI|hiRVpX}IkSFj{XjakGP^I= zF*PiBR7D1;?)iZ1w?IKxsIEHjX!S1B1TxPJx83`_1G)wk)O4`*i%=g7;?U8Cj=7ut z)t1;Z*8&E}Y{u!T3+al@Oti(@y1l#p+#&>?-{9Wf287$s;*`6S;0EGQn(M^C-sZx0 zf<>IX3rt3;>XyiJB{?yzLg;5l>`ve*eJ>eTaI)U)_t_0ho8G1<_M>5VmL*>Se1F-o z-q{AFS_yJ)%!V+pvDS$5p4`6&8ErwZ|0!arEwX#MILWhL`-y2Kr+t6%)mKT2SSQ&r zqED~a4h$3KNs6rQUGjZ?gUO2z0^A% zJmt43#;Tz7p~dMA{cqt&MX-h?t|;e&Dwn8`0v)g#j4z&pjn!lStj4dDO)#>|w+5-< znX|$g_*##&-VtPxgu@k;5d^4BCdsCsR33+@2Wf6QT(SYKN1SwBb2bD+Q!hziNTW3t zlu$$ev$K)Ujw2OSaw;Dze*s_FGEEx(Cp4JRIQ zI<|?1mgzZqxQZn=M&P@$)6N{j2Hr?i5suy;|8|Z`Eoy zYR&!r_uWqKcys1OJzl2(f7l~4Lcr7VMkc06Q<_UtL3tR6UE-1tqT%s@AnVc?C4;G5 zW*7~g@{-9L_M@PIINkaby+ecc`xwkR{53<|dNs2kjuK-5)3Syyn#Ac&{3hC^-3XwAGgSi?&;53L2#61mw8@`flcY!6hh183+YW=N z&DE-Lo~WJysRxhZe+Z(}89>QlAqe#=Lkb3vYVGaiwFVg4W%k&=tEPzi$INRUe@bL8ei8B!20H>F9uxE!q z)EDtSWeAk52ijTgs5xm*arEBT9(eNShzSHZgN!&aR5XW4r~97~oX2g3zmXo%Nfk)1 zvc6m#xg^GCFz1|_mDZ6dDr|vrJb_u)nF%8$B;REoJoQ9J%iK~~s=Jg0uK|s5kD*P` zL?(^dOzXoEGhv!hWwMuY9s>(tQed%22n`%Yl?U!JvDJ?`$NxB?p^EE4z2(CJ6DDq_ z_%DC3Ce!j)=UPquF5}2UDf<~tz%xpa@KVnc>3WU2tUSFM`U^N^JFj*z7GkV&R~Sd* zM?O5^ELB9F$iCDpT$T0!#|uw%N}W1(A^xk0@fL9VTare>$Ubi2jbH%XE4j}e z$tb$d?s?#sT;)XO-z!;BZU);biG{`&@o{07tZH~dpr#+S`KNx!c7bAxti4^fPZtQ3 zD9Gb=HFpTWi4uaGZSqh>-Z|zu#;81iYACf0_0l^_}XUd(n zoNwdaF)jcL80--zlyBtriANLUchdj)A@L=YT7W_UlD2X((h@-5&H_F~&r2q1FOjgL zOww*^qP|e+)|(xVmb9~EA z5=`hpS(W}*6_#kW={dP}_chOLq(-l+cBhTdOZ#o(Wl%sz!K==A*W+cFRiMNd{c`az zT*-Z4v)7IDp_n9? zh-8L%zTTl}=2Kp(gFi;d)u zIGnSkBs7YelstD}EQ!qpsyz4D zbc8Zlss~*gpj6-hHIh-}0L^PtCaBEO+@(yI7OD>uCa^u@i&(jU3;b`9OY27o7jzF1 z&e7ojd2)k9;l!2bP^LXr1TIS`AqcFO1dY{-SYg~^5f zWiL0PnleP|p~zTS0(4y{a-jp!P)3mh5sxFekQ!%lJhCD7IH)DY8^K29Cz4udX0U`W zWlzWqlD^R2JJO?T>9!@tkanxEuJsew)u1S+f;WZ#1WNquPt@ao^NS})151HMq6Bl6 z(g_(IddVwP-?w*$HW~~sHT7}_4#U|p^gHHID{7~3WLB$N^Z~NH1#(uSwh~?ia$sb$ zO*7n^B813CQopR%97^HpfV_XusZp%&LO3qtRo@lf^|P~tfL2COljI*u^HTVO`?eE& z$jJ{e@WI_%@sm|mfW8xUa1f!|4U6s&R97!a+2Zx>%O%a)1PzNdRrNcqkfJ9{oDvB?Ws}v$e7)$#vpWJSP*}JgG>*VA>RQ{A-P^YlYtI_ov%%_PV9&uk~ z-O=XRZF+jVU7z?R3gL&?c@~+Ez`Li$-LIdg=GrxMr>~>7fFjA+`3_pb@Dbh;#Khv9 z-nGjrWNEES)-w@B4@4CD&sCF^0AwaG?_j{uAD;&BsDd|ehSJd|T#j@87S3+1^|`#f zh~*KqXVvE7>$N3j>oOn*Lsj~!i+^#dx{%+h$kSapvQU>-{aR(H{7bYq7;#`|2Wmy< z^z4bXTG&~5=o70sCydk8QeSP7fLRawF%MTsP%=w1hY;pVD3kklq^8O1Uo)3mv%E=J zj8YKH+q9{1&wwN|sMai?5f}M`6_e^OmSR+kWLqZf4B#i?=q zvIGMTfX1+33ZV_RvJE3JPqYizco2gOmFQggE_a}6s7RuPpN zNFR>MEA_WhyFL>yQ_1&2_U!Iw%=u>t`?8aM&4SO90gK&@!_f`tJKJ zPQban%Kb9TqCXSf7-rS$)v9ax-hf9*9(XEzC$W_E5jTN%Z`c9}8KDMC!>{wF+bO5Z zaud;B)Ys8s#K*G5deWYYmLpgW_nC?Q21X?cOE#?@P38}Q#o09DXnfpc%f)&tKFN| zZNEL5*>(F6hGkRXOqIbjNUo>NlzGgmJOWHo4?tldtk24+{o8v_1ncL< zx6^F)wT6!p`bcOL?6C3KG^9K67UTsJ03Y60n&{Z%Wb~bF=_p{#e^E|#+T|~f5dU6S z;`it1Ph5$?xBMg>Nnh%0d<$n@Y_MRc8+m8Fct>_+%S+_w84()R0qRZO;NF+=;=@Hk$EDJ){O}xB1ujMc zck#@i)BFK|lb#=HZw5KZ9!uwncQIQG=dcHn3cA6Qc!jB^m}K7@_S1X)w=4EzZb8a}dQ z4}H(sDkM=cj8u=(*vKGc`Rr%XHz~!U)OHBIaGl4Pu^;g2#wR`c*$*6G>|m0??sgn(woTbfe?&5Mx&EP`sjN`K9HDgGZMJ z4$5Nb7B>3ZGVxMV7DQ2N0YeC#ss3Jn$J}?CH%~gBYg3mHUM9D#PNu;>SJXYGBC_#; z%o^36Tp166W$|LA!+w`UbVxtd8?HW_=WTcpH6W^F`0W~E#qFl!j=a0Z^S)@IT-)O% zmReEZl?+aFNx+3DS$@4kxMlF|8^OsU_7gtfguwx`$AcEl>Nx}2 zV<$a1%rh3q0a%V8!J;HcSVbYq*HsEc>F*ShC z3$dEI)Rv`2cva36GZS1(7kqM(Xr?pbcLGqQz)j= z1A9;|kYhVY7IqOEP?okcCotSHi%kT<(@kVSPW*CS`et@Yo&clCaDqHQDl?T9naJ?C){sXU_d!s-K zB`qAyUCGt5v>91qY0lZ)sWW4+99_;K7*2?%omcHcrSJ4v%;q*1-Rm(@+A}R4ia&#^ zH?7NwCKSnjKWFKt9w0?e%=>^?9AK zru&2j(lBzuHW`n8D9Oz2uL8%_^ua#UlOelk$;?YznGOlTjX(znVgteCykf}7Z3q}H z=r1asbcuTOckaym{j&%OFPir_fIJVjVYY`8nUTT3@VE!_OpfYa)ai8?6nhkd!aMo{ zw%qP)d08JfuL;=?ez&w-90D~os*sX>3g1ZZx!6H8$zEfa?>8b%*iqLgfKGGE^Ft=C zM8R~gt{yJ?TS_Z~JV*VIz}0E^So5yggb?sk>&Dpw54Cnn3?xp zx!+y6Lbktfr3w)WPQbg{FtRD9Hc0&HJ!38H!w97x6X;&!>m2Lo3*s|}pZmQw+sDUT z>b$43d=8A1Aho$@L8~6)nd^?s)*|B5WEM4R9`*Jt4H*mtFe09 zBJa4)Kh=9PigBVTT13=p`#2_56Ms@vlO_#PnX;uPH6v%Ejj}`; zr*Wb!$@FFm#?p>*feMlMB{{p!9>Nb(q;@)>Lycu})QETt$>sGD>zOXfNejPKJ!p=s zq-f7bmeeuk{+$*dV)zv1vL*Z(g#<0XP0vkS%Aa_Bg*+BDEuWEAj9@4Sv6R~8?e!@1 z$XDuHqL+Ocg3hNyzny<5m0a-s4ziJk&i(+7S;mYNVq$-D3)MY0O(m*EEsAJwuyf_KcIc`tDF7Wi4N)VrikKablC?Sf>@K0WJz=K^u=$YRM`c?po!} z_3u(xl?qI?AqFli`zEUG(%C_l9=57u=d%W@bnrx;=N(%xMt z_OG4HE!+?^mq>d$i|%;xguK+emk8?7T4eeB2p*6=#K(uzl z@0--k9AU-B?6)PylqJ%D=?+_o@5b9}0reZAEy5f;Zc%QYDWRV+x{mu^Z?HQ56~w_6 zEyea_I@F;4J`mY5=sJWadaVa-{o*4om9;n!V!kmZ)Z)YAM)9*}TKa)z0&sdYmb}x= z%}Ufg2zG>^i*uCc+I`N0h1en7CLaJJ9Mwn zB%@dz9WVm*-xM6A=OLNvsD{;zAMJGX6VTe$RsX(N4A~lX^k~w+ejp;_6SLFt= z2(iP6AI%$|86Md38pTnEC00K7kLm7Mp34`f~9_(E^bTEZS4p)FPyP#Rx>dN zm(iw9vGt+?foYRO!oj6{bnMrp;O&X0adk>TZleTGKf*3+D<`n(b1jmkW~w=B8ml@E zgVVgtPnKyC<~I6wcW{a0!1&sN_9Vjs#KJD5J!sH1wsSYKX){cZQXl=EO}Kk> zmko2m5vOu3tWE_H(*y?uV4X0RjlUhC%See{rJ}{KyZ>_2xx}NhDbl_1Vg+)#d21Fdk3@W8zy$8n*aLW@M#|1MJ zg<4Lg^|!6}Z=zso7JZ#8x zou(bBPO^_zwg@JvUu~kgm87R0snREPwPYPV--oqb^?hS8bq-8D2{CmZNYvX$Pt|~I zqZBhTduxp)`rO7WpsMK4f|@$EgMAuEsy|sF_~pm@NdnF+FX{9&_FtJG@L#1al?W4W}h+jYGaG40ZVI+Q(4Gk=JR=pXc-!8PRBHDrJ>3Jlco5SrL@8y5}k zL(R|72jJlSCT_bx*eAdg2{UX^iaMLKR~9p`OAVZzaqi#3>N2P&!TOYbJALtq3hQQF zW03JPNYw}Ti<~ub?DYgzrPVxFo*3J1tSYD>Ub-_*v~DLGpv=ru)miS;6}D#Sz^xXf zVy#xjR%I#HT(rJUo3~-zv}VXW==S*WL3`;5tDL1bYOTBF2s~Z;DjswY9`X2Ru;?G$ zz%4CKJs-A#Nj>eDvzceCty6DQ_@pWJ#_db>b$Xbg0&Cku1qQCh2=3!S>V{Y%1uja| zYN~7WdKO2`C27}3;f@14i&`9peXW{5RvkxuwdQ`3XLPi^GdnnImuNBp_7~^En%#V> z^pt`6kSD!_W-~B}Pt##g=a?H$B*z{KwK$`4{sx&k8?D27KI!(w_k4M&da7K44oXJ* zBLb?6^c^Dss{6k|aEuSiQ(W10)`XhtTI(R0ln}6R4#T5*rd^3?)3Ox)03@21`=TV8 ziymplP)3b4hNx3}G1f3wk-95Ms8XSTs`4U)bSRdGDo+)P5=nT*xT^)4W3x9&6|yw^0-XoNOjba zT6{Q69#!$iCU~5McvAlCbkL!}t+dq8tf^RdAE`RJn)>wk0MWsj_fo7OLfP*oK4Xqz<_(>wLTXo?>e1Y-J= z_B|vv)}lGl??abyJ9VqCi1?|UzgQA%T2ewp!o@|Xq@hkZqOQ*M$J9^d^2Ar~V%+8) zJ1nWpUar%ejxK!PI8F&`r`!U{*24Jl!k%_$)nIG6VdM1f>#PEjhxAmnE|fK3t~YX&1+O z^;Vnb%d>-f4Pr5)J&EjN<+4+JUajqdtb{B5Gp3$-MiRdg>hQ}24j;wo8Pjzl#e2$) z3nI{1uiPy_(wrWxRNNs>6g^@-6eWQknAq#ri{mV8c7*9_P-j{=GeZr3ZPrr{&54yL zf0Zx(lIzmm25$VTYEE;+*fSv4ams}~btSb*pa-3O?6Uxp1dw8zC{WW%$<0d7Y7u%w z``~G?RFFjCbh1j4%=EL}&~Z(fz(^=;&-mS%tA5YSj_Ltq@sUr6SY#=yq;wcJLCUdW zm>zRP8|2*+GAI5;epTI(^GG9YzVz5#iWJFy_?|r(axu|-4#Prm5=v1newG0V zf86~ReOXxm`d1&C(Epc0mdO&a3}yLWz6(1Y^EVrtJSVe*d^_qmxq2B{|D}}ee!WY{ zprbv$0(AC-+^yd%kE>t3D5N~82mph38OF8awO7m2?>gs!fmBg9`w(2HI`8S|#4&E( zTDXqx#kB_c@IIw`fucHWKxvjv;aL_$RK}F zgyYK`ch)>U*7{*LC;VqxR|5GgEyM4s8F!wyN3L00SFc$!L^8Jdve7>ArryITIJA)eOu}Gn3MR&tV;GjS zdgGTeYaBfWC^P@;-YN8h6z4DA><_|KSEEAbt*mMOI7z6uEnwO z%hT1l1xGLJ4)3M;VTZCo{+%v?alp^kj-E-M z$-nP_(K_<~LS<4Ij({I|LQX5$h)K}!{v_xK?hu{zJDuxVq?QMWG#t-6zIBfsgfQv$ zp-wrIwhK~9s&gc(Yv0vMB_n%Tzjl$rjZNc1j?hDnFitbvmgAq}LfeX~2CxhP!Kcyh zI`oqZ(A)Gqi&N46?m21+AJ0TnURO{QrbpH;P&m1{m#9h4kPW2Id6oHjs{nXAyDjhJ z!fA>rYqJ?bthG$;bnluH-QF?W4iU0@+81@X25sfbqsrsC8I;zjFO-$OktVjKA*cF^ zO`E?l=&jkRXazVEUxHRabP1Q%W8!N#ayLs6=AskiA19*p2$_)MX*7tF$uWI?pc~oTTRi4qTQ~epEO~qw8`200zy{C1>_wX@m zAmZKCKc-}{v8FkR+D-SrkbK}h(t!0zd+-csWflZG%2$c@3A)xny&XfH2N>~*lC>t} zu=#g!3eoqi|1j{2j)^|6SZVC9@hln1{V; znM|H*v$bYay3926$}}580bH`b7*o=Yup<&gc8sb^1tfB}We4^sp0dm+I2GZq@?hS8 zD^grN;ypeU=)J7~KBJ15JO)IRmW8w@BckZj9+XkUD4G6Vdi-k1H4tG5Ep*eLA%fY+ z25lZGE64u4tth&HizYafKK%XC`=xuXFN-BgYs%{z9L)E)quH<}4xun`F_q#BlQdw~ zP?bQP%5?vg;I+pMVkNy$^TWD2dGwr=ruKf$R8XH~b#{5ltc#KweoD8mkMdwkD3OKZI4g&z_;RflJwK6JG|+*GFp8WMp|G+y1e;#l%3N^k~RO#yuxT z%K(2iIjt!@E-VV@X1AO9^EifkfLZuwTYSz1ix&le0@XuM*XJsUh6g|yrRTY3OsSH? z2qt)`vu-J)pYQqW9;!Ph+}s?J(F6yVXU~*DuMA9@pXt0dw;vfM#27iHh_;2P9A;I` z_Uc+T0py7A!TuAYJ^gY#F&~J&?_#_q!#<-cfKJf{4vu2|TB2h4#!(gpX ziJ_(eYQ&>b-ps)dG23PZPg&|bYC*&G*AFBHm69|%T0vIDFPJcJxQ+4nx5TVX%Gy&lH3>(Rtw7f@zPLf9w8IT^Gk`Lg z{dS6b6>wx|Q7RZO+lYDSkgK_$&vdOIqMZG0z0E87nrfxx2j!E9qmg!gA?&1X0C-5A>%-Lm3scc z8>X-}PrSY0Q^phKyjE-^uezm-I?kcIyWjO0|Dv8bdZ>A`t^{^5{e<`Mm(<-H5;kAG z`6yXHQuLG@6}-mtLs!rEjDr02f>MEs1#8!IKOO7HyIeqoMp6;r6(^CrI1Kcb#H)h2 zxc`SnVpCKNXRTLOe9N`LMaS)zHmYm342qJu(vFK-Y?R-qQ4KlOcO5R93&&zgrI@?g zDI5_Plc`43ygi7@kK(lj>r862ExbEo26y9wg4?_lNae><@>`wp6tcr{z7mf21Bk|m z2a>F|@fM;D?~~42Hl8sdiiKq}l`#_e zi0^}Z`8YkYWv8^Cs@1(4xR-!rR$f>-i1&nX7SOvBim58|`8JQ2`YvBBw_9*MdIDq* zG9WF0KjiZFgW0O1G`+$_vffv{LoY@i$H}~q6WJPDNl_$fvGhk{LKu8%XeE?sibuPl zcNrg%K%00m-G1WMIqR6|^~^qZmJXCkLKqek72gmJ-dRP@o#v`fe_h=D7tGr%fN<%4 z(a9bovGEI@X3od;#rw~YWLM_#TauvT^cA?w7`z7MuQFEFps!3(a88|tjm+sQp0Koh z)ZhO}Qhl4=T$L`B{Btrx>?twVhnWT8G$al`>c9u*M%2S6^+V#e@hbB$l_VqjIvT`R z1Nw>EjkSI0AO8S??Dc=ud3Pf_ET^Eck;E8j4ZE_85z(|hF)r1UJ{*--p{@v`;tJ)3 zC)OZFe8mE6?48H7viFC8S5vw}g$~hI*;E$14=?a6&M8K&^DJY+!<-o8>LTM@0Qf{5 z?AW*@>Ro0OBq=qWL|;42lzsQ-ZMJ+#H_law9+OH~G%y?)v!IFYmj@++1kz_<)JmEjJvA^`}2YYp#Q&g89{R9U=w4h8}S>a$E(%+uT zl77)rOg4P52+(h6rp^1L2)?wnfatxz!GOrF-+c`DTfuL)A6T1(d)z$TYxaK6z5O(} zsl0(|#JH~JXWHs0pEC#=bR&mqtD1@mrtprCB})-CfT z|FSS>BfaSYGf3Mh!A(>3P2xn09O6FWD_Ul=TqkQb9D0L`(Q*v8r48dNpTbPKKxuTF z10_R?WxkvkDryLph4k5+FQN-DEpil=^j-p2Q~+P@s2kF!b=K{Md^DbZx`|Cq)bNJA z?l)Vl3@04Ofcab>y~oQ7K>R1zCOtdB!WQ`Rrz~Thtc(wxO$8sdWu29C<__jR1q(za zphNA?`P?Y`ZlJjK7~T+9Jj3q;)BHr=kw~+F=5Vca?Ad(wjPSt(|C`sv7-fcpiLMi0 zThSwx#T;hf%|aQ3z+`P$04*k&vvi7lGWYjCCG@@H76omibEwO@kJyG*pOi)ar*_5@vE|aqiEeHyY(0TF{VUL$Z>G{MU()dyVq* z6w}=npU3@b?IV91nn{a{@J)VJFKI9Ry>Dm;F2Tbms)t7o&w>ZY$eMn~$uzD5gC(LwS*N)OX(P!Wd zjIAY_bK!`FU(wqBvXKWp{?2=#GjshyqDyfty@{a`39OQz6K7ZzO8t^}P`>N<>s$<= zs#Tv86+*eaOUZ8;`^~Tz&>o2Yp$HHg4DTW8-@6ibA9X9W)O8db-FUMNxzdn<6CeJ% zv$l|e?7TrQaqj=CxFCB&Yb)kY;+u7ep>0uD2~2v6Y)z(Bth0iSa{exqNJ*1PpAyKe zs7UDRYrHk54owH5<>O&8k)rF<8pRThWmYQ?x}FV+dS7TXTDnL9%r*~c0D`3R4R@dKkD*E?ACptDy#gX5CucG5ANjtW_^M-v{X7sPjyZ& zvBD)B0;EFzN|tT;_6ZWil6Qbmoy!7D#v0_&&@e5lDz}`mCb$+bFE3#u?O#rgzW4y) zCP&UHt2QPjx`J@>7K>FIMde%IF_2p|#$`37mRjOTxNV-K4m#46YjQa@;h3FeIfz8n zh#Og$JY+wRtUh#|S0lZFtmrh)t1aTp-o?v2+^}y}$~>Twe;^K? z-}j+vo6?mFG=6xxev$5{$LaP=H?1dah)~6nH2@pd9ju+DBp@Rqx!8&kP{FL;COVWQ2^6!p5{~ZDK=x_SJ{C#vao?`y<1pRS_Kb~O*|J?oq D?tE$X literal 0 HcmV?d00001 diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json index 4e74482a662..172b0817474 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json @@ -358,7 +358,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques.\nAdversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on AzureWebApplicationFirewall data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)" + "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on WAF data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)" } } ] diff --git a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json index 8f0a6c211a2..ac3d5e7e896 100644 --- a/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json +++ b/Solutions/Azure Web Application Firewall (WAF)/Package/mainTemplate.json @@ -65,7 +65,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Azure Web Application Firewall (WAF)", - "_solutionVersion": "3.0.2", + "_solutionVersion": "3.0.3", "solutionId": "azuresentinel.azure-sentinel-solution-azurewebapplicationfirewal", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "WAF", @@ -189,7 +189,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Azure Web Application Firewall (WAF) data connector with template version 3.0.2", + "description": "Azure Web Application Firewall (WAF) data connector with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -388,7 +388,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Azure WAF - Bypass Via Double URL Encoded Admin Paths_HuntingQueries Hunting Query with template version 3.0.2", + "description": "Azure WAF - Bypass Via Double URL Encoded Admin Paths_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -409,7 +409,7 @@ "tags": [ { "name": "description", - "value": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques.\nAdversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories." + "value": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories." }, { "name": "tactics", @@ -473,7 +473,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "MaliciousWAFSessions_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -577,7 +577,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-Premium-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -696,7 +696,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-Premium-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -812,7 +812,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -930,7 +930,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "AFD-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1050,7 +1050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Code-Injection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1168,7 +1168,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Path-Traversal-Attack_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1288,7 +1288,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-Scanner-detection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1409,7 +1409,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-SQLiDetection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1528,7 +1528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.2", + "description": "App-GW-WAF-XSSDetection_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1644,7 +1644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallFirewallEvents Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1732,7 +1732,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallGatewayAccessEvents Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1820,7 +1820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallOverview Workbook with template version 3.0.2", + "description": "WebApplicationFirewallOverview Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -1908,7 +1908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.0.2", + "description": "WebApplicationFirewallWAFTypeEvents Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -1992,7 +1992,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.2", + "version": "3.0.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Azure Web Application Firewall (WAF)",