[Ravi Nandan Ray (Rajaravi99)]

This is in continuation to closed prs #15285 and #15253 now closed
Required items, please complete

Change(s):

• Added a new threat hunting query template: WAFBypassDoubleURLEncodingAdminPath.yaml.
• Integrated coverage tracking for both modern (AGWFirewallLogs) and legacy (AzureDiagnostics) Azure Web Application Firewall structures.
• Implemented robust regex-free URL normalization using KQL token slicing split(..., '?')[0] to isolate request directories safely.
• Added explicit entity mappings linking extracted target entities (IP and Host) directly to the Microsoft Sentinel Graph investigation matrix.

Reason for Change(s):

• Provides cloud security operations teams with proactive hunting coverage against advanced evasion methods (specifically multi-layered / Double URL Encoding obfuscation techniques).
• Targets defensive blind spots where attackers attempt to bypass basic front-end infrastructure inspection rules to access sensitive exposed administrative endpoints (e.g., /admin, /config, /setup).
• Helps identify early-stage reconnaissance scanning traffic or active perimeter probing that standard rules might let trickle past as "Allowed" or "Matched".

Version Updated:

• N/A (This is a brand new Threat Hunting query template; version initialized at 1.0.0 within the YAML metadata structure).

Testing Completed:

• Yes. The updated KQL syntax and structural parameters were actively executed, parsed, and successfully verified inside a live Microsoft Sentinel production workspace containing standard multi-tenant Azure WAF log ingestion engines.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. Local schema structure tests (DetectionTemplateSchemaValidation) and syntax evaluation procedures (KqlValidationTests) were completed locally via the native .NET Core SDK test environment (dotnet test) and returned perfect pass statuses with no schema alignment warnings.

---

[Ravi Nandan Ray (Rajaravi99)]

Hi v-skharode, opened this fresh PR and closed the old one, Please guide to generate the proper solution package. Until then I would try to gather successful execution samples for both modern and legacy logging modes.

[v-skharode]

Hi Ravi Nandan Ray (@Rajaravi99), thanks again for opening the fresh PR. I’ll review the changes and share the guidance for generating the solution package. Please also share the successful execution examples for both modern and legacy logging modes once available.

[Copilot]

🟡 Changes recommended

Direct references to missing legacy columns can prevent modern WAF results from being returned, and TotalAttempts overcounts requests by counting per-rule log entries.

2 open issues

• Normalize legacy WAF columns before filtering AzureDiagnostics · New
• Count distinct HTTP attempts instead of per-rule WAF records · New

What changed in this PR

Adds a Microsoft Sentinel hunting query to the Azure WAF solution for double URL-encoded requests targeting administrative paths, continuing the work from #15285 and #15253.

Changes:

• Queries modern and legacy Application Gateway WAF logs for suspicious paths revealed by two decoding passes.
• Summarizes matching records and payload samples, with IP and host entity mappings.
• Registers the hunt in the solution’s packaging manifest.

File	Description
Solutions/​Azure Web Application Firewall (WAF)/​Hunting Queries/​Azure WAF - Bypass Via Double URL Encoded Admin Paths.yaml	Adds the double-encoding hunt, result summaries, and entity mappings.
Solutions/​Azure Web Application Firewall (WAF)/​Data/​Solution_AzureWAF.json	Includes the new hunt in the solution manifest.

_{Review effort: Balanced}