WAF hunting query added

Solutions/Azure Web Application Firewall (WAF)/Data/Solution_AzureWAF.json

@@ -6,6 +6,9 @@
   "Data Connectors": [
     "Data Connectors/template_WAF.json"
   ],
+  "Hunting Queries": [
+    "Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml"
+  ],
   "Analytic Rules": [
     "Analytic Rules/MaliciousWAFSessions.yaml",
     "Analytic Rules/AFD-Premium-WAF-SQLiDetection.yaml",
@@ -25,28 +28,10 @@
     "Workbooks/WebApplicationFirewallWAFTypeEvents.json"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Azure Web Application Firewall (WAF)\\",
+  "Version": "3.1.0",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
     "WAF"
-  ],
-  "XDR Detections": [
-    "XDR Detections/AFD-Premium-WAF-SQLiDetection.yaml",
-    "XDR Detections/AFD-Premium-WAF-XSSDetection.yaml",
-    "XDR Detections/AFD-WAF-Code-Injection.yaml",
-    "XDR Detections/AFD-WAF-Path-Traversal-Attack.yaml",
-    "XDR Detections/App-GW-WAF-Code-Injection.yaml",
-    "XDR Detections/App-GW-WAF-Path-Traversal-Attack.yaml",
-    "XDR Detections/App-GW-WAF-SQLiDetection.yaml",
-    "XDR Detections/App-GW-WAF-Scanner-detection.yaml",
-    "XDR Detections/App-GW-WAF-XSSDetection.yaml",
-    "XDR Detections/MaliciousWAFSessions.yaml"
-  ],
-  "XDR Workbooks": [
-    "XDR Workbooks/WebApplicationFirewallFirewallEvents.json",
-    "XDR Workbooks/WebApplicationFirewallGatewayAccessEvents.json",
-    "XDR Workbooks/WebApplicationFirewallOverview.json",
-    "XDR Workbooks/WebApplicationFirewallWAFTypeEvents.json"
-  ],
-  "Version": "3.2.2"
+  ]
 }

Solutions/Azure Web Application Firewall (WAF)/Hunting Queries/Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml

@@ -0,0 +1,59 @@
+id: 16a81a04-3d26-4118-8f6d-6dd3389583cc
+name: Bypass Attempt via Double URL Encoding
+description: |
+  Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories.
+description-detailed: |
+  This hunting query screens both modern and legacy Azure Application Gateway WAF logs for instances where a request URI, when stripped of query parameters and decoded a second time, reveals a mismatch against its initial decode layer. It filters these anomalies against critical administrative keywords (e.g., admin, setup, config) to isolate targeted evasion. Verify that the flagged clients are not authorized web scanners or legacy custom applications utilizing eccentric routing configurations.
+status: Available
+requiredDataConnectors:
+  - connectorId: WAF
+    dataTypes:
+      - AGWFirewallLogs
+      - AzureDiagnostics
+tactics:
+  - DefenseEvasion
+relevantTechniques:
+  - T1027
+query: |
+  let StartTime = ago(1d);
+  let EndTime = now();
+  let TargetAdminPathRegex = @"^/?(admin|psemhub|bin|config|setup|install|login)";
+  let ModernWAF = (AGWFirewallLogs
+  | where TimeGenerated between (StartTime .. EndTime)
+  | where Action in~ ("Allowed", "Matched")
+  | extend RequestPath = tostring(split(RequestUri, "?")[0])
+  | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))
+  | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode
+  | extend NormalizedPath = tolower(SecondaryDecode)
+  | where NormalizedPath matches regex TargetAdminPathRegex
+  | project TimeGenerated, clientIp = ClientIp, hostname = Hostname, requestUri = RequestUri, action = Action);
+  let LegacyWAF = (AzureDiagnostics
+  | where TimeGenerated between (StartTime .. EndTime)
+  | where Category == "ApplicationGatewayFirewallLog"
+  | where action_s in~ ("Allowed", "Matched")
+  | extend RequestPath = tostring(split(requestUri_s, "?")[0])
+  | extend PrimaryDecode = url_decode(RequestPath), SecondaryDecode = url_decode(url_decode(RequestPath))
+  | where RequestPath != PrimaryDecode and PrimaryDecode != SecondaryDecode
+  | extend NormalizedPath = tolower(SecondaryDecode)
+  | where NormalizedPath matches regex TargetAdminPathRegex
+  | project TimeGenerated, clientIp = clientIp_s, hostname = hostname_s, requestUri = requestUri_s, action = action_s);
+  union isfuzzy=true ModernWAF, LegacyWAF
+  | summarize
+  FirstSeen = min(TimeGenerated),
+  LastSeen = max(TimeGenerated),
+  AttackCount = count(),
+  SamplePayloads = make_set(requestUri, 5)
+  by clientIp, hostname, action
+entityMappings:
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: clientIp
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: hostname
+customDetails:
+  WAFAction: action
+  TotalAttempts: AttackCount
+version: 1.0.0

Solutions/Azure Web Application Firewall (WAF)/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/waf_logo.svg\"width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **XDR Detections:** 10, **XDR Workbooks:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/waf_logo.svg\"width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Web%20Application%20Firewall%20%28WAF%29/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Azure Web Application Firewall (WAF) solution for Microsoft Sentinel allows you to ingest Diagnostic Metrics from Application Gateway, Front Door and CDN into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 4, **Analytic Rules:** 10, **Hunting Queries:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -51,47 +51,6 @@
       }
     ],
     "steps": [
-      {
-        "name": "contentSelection",
-        "label": "Content selection",
-        "elements": [
-          {
-            "name": "DeployAnalyticsRule",
-            "type": "Microsoft.Common.CheckBox",
-            "label": "DeployAnalyticsRule",
-            "defaultValue": true,
-            "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
-          },
-          {
-            "name": "DeployWorkbook",
-            "type": "Microsoft.Common.CheckBox",
-            "label": "DeployWorkbook",
-            "defaultValue": true,
-            "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
-          },
-          {
-            "name": "DeployDefenderWorkbook",
-            "type": "Microsoft.Common.CheckBox",
-            "label": "DeployDefenderWorkbook",
-            "defaultValue": false,
-            "toolTip": "Deploy Defender Workbooks and their Content Hub registrations independently of Microsoft Sentinel DeployWorkbook. Candidate provider contract requires approved lab installation, readback and update verification."
-          },
-          {
-            "name": "DeployDataConnector",
-            "type": "Microsoft.Common.CheckBox",
-            "label": "DeployDataConnector",
-            "defaultValue": true,
-            "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
-          },
-          {
-            "name": "DeployCustomDetection",
-            "type": "Microsoft.Common.CheckBox",
-            "label": "DeployCustomDetection",
-            "defaultValue": false,
-            "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch."
-          }
-        ]
-      },
       {
         "name": "dataconnectors",
         "label": "Data Connectors",
@@ -367,17 +326,50 @@
             ]
           }
         ]
+      },
+      {
+        "name": "huntingqueries",
+        "label": "Hunting Queries",
+        "bladeTitle": "Hunting Queries",
+        "elements": [
+          {
+            "name": "huntingqueries-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+            }
+          },
+          {
+            "name": "huntingqueries-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+              }
+            }
+          },
+          {
+            "name": "huntingquery1",
+            "type": "Microsoft.Common.Section",
+            "label": "Bypass Attempt via Double URL Encoding",
+            "elements": [
+              {
+                "name": "huntingquery1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "Identifies potential malicious bypass attempts of the Azure Web Application Firewall using Double URL Encoding techniques. Adversaries often use multi-layer encoding to obfuscate payloads targeting administrative or sensitive application directories. This hunting query depends on WAF data connector (AGWFirewallLogs AzureDiagnostics Parser or Table)"
+                }
+              }
+            ]
+          }
+        ]
       }
     ],
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
-      "workspace": "[basics('workspace')]",
-      "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
-      "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
-      "DeployDefenderWorkbook": "[steps('contentSelection').DeployDefenderWorkbook]",
-      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
-      "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]"
+      "workspace": "[basics('workspace')]"
     }
   }
 }