Default rule set is assigned in Azure Front Door WAF

Overview

Azure Front Door Web Application Firewall (WAF) provides centralized, edge-based protection for globally distributed web applications through managed rulesets that contain pre-configured detection signatures for known attack patterns. The Microsoft Default Ruleset is a continuously updated managed ruleset that protects against the most common and dangerous web vulnerabilities without requiring security expertise to configure. When no managed ruleset is enabled, the WAF policy provides no protection against known attack patterns, effectively operating as a pass-through despite being deployed at the edge. Threat actors routinely scan for unprotected web applications and exploit well-documented vulnerabilities using automated toolkits; without managed rules, attackers can execute SQL injection to extract or modify database contents, perform cross-site scripting to hijack user sessions and steal credentials, exploit local file inclusion to read sensitive configuration files, and leverage command injection to gain shell access on backend servers. These attack techniques have known signatures that managed rulesets detect and block at the edge before malicious traffic reaches origin servers, but an empty or disabled ruleset configuration means the WAF cannot recognize these patterns and will allow malicious requests to pass through to the application.

Remediation

Overview of WAF capabilities on Azure Front Door including managed rulesets

• Azure Web Application Firewall on Azure Front Door

Detailed documentation of Default Rule Set groups and rules for Azure Front Door

• Web Application Firewall DRS rule groups and rules

Step-by-step guidance on creating and configuring WAF policies with managed rulesets

• Tutorial: Create a Web Application Firewall policy on Azure Front Door

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1190 Exploit Public-Facing Application
Licence	Azure WAF
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.