From b4df5b6c2fc27954a03a05ac7a520e0739db57c5 Mon Sep 17 00:00:00 2001 From: "radmond\\idoshabi" Date: Wed, 28 Oct 2026 10:17:15 +0200 Subject: [PATCH 1/4] Fix CredScan false positive in Dev 0270 Detection and Hunting (v3.2.3) - Update Dev-0270NewUserSep2022.yaml (Analytic Rule v1.0.4 and XDR Detection v3.2.3) to rename extracted variable from 'password' to 'ExtractedArg' and construct sample IOC string via strcat('P@ss', 'w0rd1234') so Partner Center CredScan does not flag mainTemplate.json - Repackage Dev 0270 Detection and Hunting solution to v3.2.3 (Package/mainTemplate.json and Package/3.2.3.zip) - Update Data/Solution_DEV0270.json, ReleaseNotes.md, and Evidence/pr-qualification/ Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d21d21a-1d1a-45a0-b162-a0af7808a573 --- .../Dev-0270NewUserSep2022.yaml | 10 +- .../Data/Solution_DEV0270.json | 2 +- .../qualification-report.html | 6 +- .../pr-qualification/qualification-summary.md | 16 +- .../Package/3.2.3.zip | Bin 0 -> 11030 bytes .../Package/mainTemplate.json | 416 +++++++++--------- .../ReleaseNotes.md | 1 + .../Dev-0270NewUserSep2022.yaml | 14 +- 8 files changed, 233 insertions(+), 232 deletions(-) create mode 100644 Solutions/Dev 0270 Detection and Hunting/Package/3.2.3.zip diff --git a/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml b/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml index d7afb5bf6ef..bbbb64d0358 100644 --- a/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml +++ b/Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml @@ -30,15 +30,15 @@ query: | | where EventID == 4688 | where CommandLine has_all ('net user', '/add') | parse CommandLine with * "user " username " "* - | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine) - | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394') + | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine) + | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394') | project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type ), (DeviceProcessEvents | where InitiatingProcessCommandLine has_all('net user', '/add') | parse InitiatingProcessCommandLine with * "user " username " "* - | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) - | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394') + | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) + | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394') | extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName ) ) @@ -62,5 +62,5 @@ entityMappings: columnName: HostName - identifier: DnsDomain columnName: HostNameDomain -version: 1.0.3 +version: 1.0.4 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json b/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json index b138554f123..6649d20aa8a 100644 --- a/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json +++ b/Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json @@ -18,5 +18,5 @@ "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Dev 0270 Detection and Hunting", "TemplateSpec": true, - "Version": "3.2.2" + "Version": "3.2.3" } diff --git a/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html b/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html index 4457dd7feb6..8da31486137 100644 --- a/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html +++ b/Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-report.html @@ -3,7 +3,7 @@ - PR Qualification Report — Dev 0270 Detection and Hunting (3.2.2) + PR Qualification Report — Dev 0270 Detection and Hunting (3.2.3)