diff --git a/Solutions/Business Email Compromise - Financial Fraud/ReleaseNotes.md b/Solutions/Business Email Compromise - Financial Fraud/ReleaseNotes.md
index 154c0371603..6535bab7b51 100644
--- a/Solutions/Business Email Compromise - Financial Fraud/ReleaseNotes.md
+++ b/Solutions/Business Email Compromise - Financial Fraud/ReleaseNotes.md
@@ -1,7 +1,6 @@
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
|-------------|--------------------------------|------------------------------------------------------------------------------|
| 3.2.3 | 22-10-2026 | Removed unsupported AWS S3 **Custom Detection** (`SuspiciousAccessOfBECRelatedDocumentsInAWSS3Buckets.yaml`). |
-| 3.2.2 | 20-10-2026 | Migrated **Analytic Rules** to **Microsoft Defender XDR Custom Detections** |
| 3.0.10 | 10-11-2025 | Update in **Analytical Rule** alert description |
| 3.0.9 | 05-06-2024 | **Analytical Rule** description updated |
| 3.0.8 | 04-04-2024 | Updated **Entity Mappings** |
diff --git a/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml b/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml
index d7afb5bf6ef..bbbb64d0358 100644
--- a/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml
+++ b/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml
@@ -30,15 +30,15 @@ query: |
| where EventID == 4688
| where CommandLine has_all ('net user', '/add')
| parse CommandLine with * "user " username " "*
- | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine)
- | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')
+ | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine)
+ | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394')
| project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
),
(DeviceProcessEvents
| where InitiatingProcessCommandLine has_all('net user', '/add')
| parse InitiatingProcessCommandLine with * "user " username " "*
- | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine)
- | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')
+ | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine)
+ | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394')
| extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName
)
)
@@ -62,5 +62,5 @@ entityMappings:
columnName: HostName
- identifier: DnsDomain
columnName: HostNameDomain
-version: 1.0.3
+version: 1.0.4
kind: Scheduled
\ No newline at end of file
diff --git a/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json b/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json
index b138554f123..6649d20aa8a 100644
--- a/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json
+++ b/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json
@@ -18,5 +18,5 @@
"Metadata": "SolutionMetadata.json",
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Dev 0270 Detection and Hunting",
"TemplateSpec": true,
- "Version": "3.2.2"
+ "Version": "3.2.3"
}
diff --git a/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html b/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html
index 4457dd7feb6..b224158be67 100644
--- a/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html
+++ b/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html
@@ -3,7 +3,7 @@
- PR Qualification Report — Dev 0270 Detection and Hunting (3.2.2)
+ PR Qualification Report — Dev 0270 Detection and Hunting (3.2.3)