Adding new threat hunting query

Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json

@@ -6,6 +6,9 @@
   "Data Connectors": [
     "Data Connectors/template_WAF.json"
   ],
+  "Hunting Queries": [
+    "Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml"
+  ],
   "Analytic Rules": [
     "Analytic Rules/MaliciousWAFSessions.yaml",
     "Analytic Rules/AFD-Premium-WAF-SQLiDetection.yaml",
@@ -25,7 +28,7 @@
     "Workbooks/WebApplicationFirewallWAFTypeEvents.json"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Web Application Firewall (WAF)\\",
-  "Version": "3.0.2",
+  "Version": "3.0.3",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [

Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml

@@ -0,0 +1,59 @@
+id: 16a81a04-3d26-4118-8f6d-6dd3389583cc
+name: Bypass Attempt via Double URL Encoding
+description: |
+  Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories.
+description-detailed: |
+  This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations.
+status: Available
+requiredDataConnectors:
+  - connectorId: WAF
+    dataTypes:
+      - AGWFirewallLogs
+      - AzureDiagnostics
+tactics:
+  - DefenseEvasion
+relevantTechniques:
+  - T1027
+query: |
+  let StartTime = ago(1d);
+  let EndTime = now();
+  let TargetAdminPathRegex = @"^/?(admin|psemhub|bin|config|setup|install|login)";
+  let ModernWAF = (AGWFirewallLogs
+  | where TimeGenerated between (StartTime .. EndTime)
+  | where Action in~ ("Allowed", "Matched")
+  | extend RequestPath = tostring(split(RequestUri, "?")[0])
+  | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))
+  | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode
+  | extend NormalizedPath = tolower(SecondaryDecode)
+  | where NormalizedPath matches regex TargetAdminPathRegex
+  | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action);
+  let LegacyWAF = (AzureDiagnostics
+  | where TimeGenerated between (StartTime .. EndTime)
+  | where Category == "ApplicationGatewayFirewallLog"
+  | where action_s in~ ("Allowed", "Matched")
+  | extend RequestPath = tostring(split(requestUri_s, "?")[0])
+  | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))
+  | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode
+  | extend NormalizedPath = tolower(SecondaryDecode)
+  | where NormalizedPath matches regex TargetAdminPathRegex
+  | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s);
+  union isfuzzy=true ModernWAF, LegacyWAF
+  | summarize
+  FirstSeen = min(TimeGenerated),
+  LastSeen = max(TimeGenerated),
+  AttackCount = count(),
+  SamplePayloads = make_set(requestUri, 5)
+  by clientIp, hostname, action
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: clientIp
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: hostname
+customDetails:
+  WAFAction: action
+  TotalAttempts: AttackCount
+version: 1.0.0

Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/waf_logo.svg\"width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/waf_logo.svg\"width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -326,6 +326,44 @@
             ]
           }
         ]
+      },
+      {
+        "name": "huntingqueries",
+        "label": "Hunting Queries",
+        "bladeTitle": "Hunting Queries",
+        "elements": [
+          {
+            "name": "huntingqueries-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+            }
+          },
+          {
+            "name": "huntingqueries-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+              }
+            }
+          },
+          {
+            "name": "huntingquery1",
+            "type": "Microsoft.Common.Section",
+            "label": "Bypass Attempt via Double URL Encoding",
+            "elements": [
+              {
+                "name": "huntingquery1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on WAF data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)"
+                }
+              }
+            ]
+          }
+        ]
       }
     ],
     "outputs": {