UNCOVERING THREATS THROUGH WAF LOGS: A THREAT HUNTER'S LENS

Summary from the TLDR InfoSec newsletter

WAF logs are often overlooked in threat hunting because every request must pass through them. Defenders can look for potential reconnaissance patterns, including using non-standard HTTP methods on public pages, CMS helper endpoint exposure, systematic enumeration across multiple sites, and infrastructure-based anomalies such as TOR exit nodes. The article also includes KQL queries for practical threat detection.