[Ravi Nandan Ray (Rajaravi99)]

This is in continuation to unmerged PR #15253 -> now Closed

Required items, please complete

Change(s):

• Added a new threat hunting query template: WAFBypassDoubleURLEncodingAdminPath.yaml.
• Integrated coverage tracking for both modern (AGWFirewallLogs) and legacy (AzureDiagnostics) Azure Web Application Firewall structures.
• Implemented robust regex-free URL normalization using KQL token slicing split(..., '?')[0] to isolate request directories safely.
• Added explicit entity mappings linking extracted target entities (IP and Host) directly to the Microsoft Sentinel Graph investigation matrix.

Reason for Change(s):

• Provides cloud security operations teams with proactive hunting coverage against advanced evasion methods (specifically multi-layered / Double URL Encoding obfuscation techniques).
• Targets defensive blind spots where attackers attempt to bypass basic front-end infrastructure inspection rules to access sensitive exposed administrative endpoints (e.g., /admin, /config, /setup).
• Helps identify early-stage reconnaissance scanning traffic or active perimeter probing that standard rules might let trickle past as "Allowed" or "Matched".

Version Updated:

• N/A (This is a brand new Threat Hunting query template; version initialized at 1.0.0 within the YAML metadata structure).

Testing Completed:

• Yes. The updated KQL syntax and structural parameters were actively executed, parsed, and successfully verified inside a live Microsoft Sentinel production workspace containing standard multi-tenant Azure WAF log ingestion engines.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. Local schema structure tests (DetectionTemplateSchemaValidation) and syntax evaluation procedures (KqlValidationTests) were completed locally via the native .NET Core SDK test environment (dotnet test) and returned perfect pass statuses with no schema alignment warnings.

---

[Copilot]

🟡 Changes recommended

Version 3.1.0 is missing its mandatory release-notes entry.

1 open finding

• Add 3.1.0 release notes entry for the new hunting query · New

What changed in this PR

Adds an Azure WAF hunting query for double URL-encoded administrative-path bypass attempts across modern and legacy logs.

Changes:

• Adds the hunting query with IP and Host mappings.
• Registers it in the solution manifest.
• Bumps the solution version to 3.1.0.

File	Description
Data/​Solution_AzureWAF.json	Registers the query and updates the version.
Hunting Queries/​Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml	Implements the new hunt.
Package/​3.0.0.zip	Generated package archive; excluded from review.
Package/​createUiDefinition.json	Generated installer UI; excluded from review.
Package/​mainTemplate.json	Generated deployment template; excluded from review.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-skharode]

Hi Ravi Nandan Ray (@Rajaravi99)
Thanks for the updates. The solution data and release notes declare version 3.1.0, but Package/mainTemplate.json and the modified Package/3.0.0.zip still reference 3.0.0.

Please regenerate the package from the updated solution data, add the correctly versioned 3.1.0.zip while preserving the existing historical archives, and rerun package validation. Also, please remove the trailing whitespace from the new release-notes row so git diff --check passes.

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode I have removed trailing spaces from the newline in releasenotes.md , I tried to regenerate the package from the updated solution data, but I am unable to get 3.1.0 ZIP, I have attached an SS. Can you give me the link to any documentation to achieve this. Thanks for your help in advance.

[v-skharode]

Hi Ravi Nandan Ray (@Rajaravi99) thanks for the update. The solution data and release notes now both show 3.1.0, with only one release-note entry for that version. However, trailing whitespace remains on the new row.

Please regenerate using V3 local version management:

• Temporarily set the solution data version to 3.0.2. A minor bump from the current 3.1.0 would generate 3.2.0.
• Remove the existing 3.1.0 release-note row before running, the wrapper inserts a new row automatically.
• Run this from the repository root:
  pwsh ".script\local-validation\build-and-validate.ps1" -SolutionName "Azure Web Application Firewall (WAF)"
  -VersionBump minor `
  -ReleaseNotes "Added a hunting query for Azure WAF bypass via double URL-encoded admin paths."

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode , please have a look at my SS, this is the result I have obtained

Is this satisfactory, please do let me know

[v-skharode]

Hi Ravi Nandan Ray (@Rajaravi99)
Thanks for sharing the results. The solution version and release notes correctly show 3.1.0, and the new hunting query’s 1.0.0 version is appropriate.

Before approval, please address the remaining items:

• Commit and push the regenerated release outputs shown in your screenshot; they are not present in the fetched PR revision.
• Remove the trailing whitespace from the new release-note row so git diff --check passes.
• After pushing the updates, please confirm the required GitHub checks pass on the latest commit.

[v-skharode]

hey Ravi Nandan Ray (@Rajaravi99)
Deployment and hunt installation succeeded. Runtime validation is blocked in my workspace because it has no recent WAF telemetry and lacks the legacy AzureDiagnostics columns. Please provide successful execution and positive/negative sample-test evidence for both supported logging modes, including a modern-only workspace where AzureDiagnostics exists without WAF columns.

[v-skharode]

Ravi Nandan Ray (@Rajaravi99)
Thanks for the updates. I need to correct my earlier version guidance: the current WAF solution is 3.2.2, so 3.1.0 is a downgrade. Please preserve the existing XDR detections and workbooks, regenerate the hybrid package at the next minor version (3.3.0), and keep release notes in descending order.
Also provide positive/negative query results for modern, legacy, and modern-only workspaces; the legacy branch directly references WAF-specific AzureDiagnostics columns. Please remove the release-note trailing whitespace and confirm required checks pass.