Fix CredScan false positive in Dev 0270 Detection and Hunting (v3.2.3)

Solutions/Business Email Compromise - Financial Fraud/ReleaseNotes.md

@@ -1,7 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                           |
 |-------------|--------------------------------|------------------------------------------------------------------------------|
 | 3.2.3 | 22-10-2026 | Removed unsupported AWS S3 **Custom Detection** (`SuspiciousAccessOfBECRelatedDocumentsInAWSS3Buckets.yaml`). |
-| 3.2.2       | 20-10-2026                     | Migrated **Analytic Rules** to **Microsoft Defender XDR Custom Detections**  |
 | 3.0.10       | 10-11-2025                     | Update in **Analytical Rule** alert description                                          |
 | 3.0.9       | 05-06-2024                     | **Analytical Rule** description updated                                          |
 | 3.0.8       | 04-04-2024                     | Updated **Entity Mappings**                                                     |

Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml

@@ -30,15 +30,15 @@ query: |
   | where EventID == 4688
   | where CommandLine has_all ('net user', '/add') 
   | parse CommandLine with * "user " username " "*
-  | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine) 
-  | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394') 
+  | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine) 
+  | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394') 
   | project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
   ),
   (DeviceProcessEvents 
   | where InitiatingProcessCommandLine has_all('net user', '/add') 
   | parse InitiatingProcessCommandLine with * "user " username " "* 
-  | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) 
-  | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394') 
+  | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine) 
+  | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394') 
   | extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName
   )
   )
@@ -62,5 +62,5 @@ entityMappings:
         columnName: HostName
       - identifier: DnsDomain
         columnName: HostNameDomain
-version: 1.0.3
+version: 1.0.4
 kind: Scheduled

Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json

@@ -18,5 +18,5 @@
   "Metadata": "SolutionMetadata.json",
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Dev 0270 Detection and Hunting",
   "TemplateSpec": true,
-  "Version": "3.2.2"
+  "Version": "3.2.3"
 }

Solutions/Dev 0270 Detection and Hunting/ReleaseNotes.md

@@ -1,5 +1,6 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                 |
 |-------------|--------------------------------|--------------------------------------------------------------------|
+| 3.2.3       | 28-10-2026                     | Updated **Analytic Rule** and **XDR Detection** (`Dev-0270NewUserSep2022.yaml`) to resolve Partner Center CredScan false positive. |
 | 3.2.2       | 20-10-2026                     | Added Defender XDR **Custom Detections** migrated from **Analytic Rules**. |
 | 3.0.1       | 07-06-2024                     |	Added missing AMA **Data Connector** reference in **Analytic Rule** |
 | 3.0.0       | 12-04-2024                     |	Updated Entity Mappings of **Analytic Rule**                    |  

Solutions/Dev 0270 Detection and Hunting/SolutionMetadata.json

@@ -17,5 +17,5 @@
     "tier": "Microsoft",
     "link": "https://support.microsoft.com"
   },
-  "version": "3.2.2"
+  "version": "3.2.3"
 }

Solutions/Dev 0270 Detection and Hunting/XDR Detections/Dev-0270NewUserSep2022.yaml

@@ -1,5 +1,5 @@
 schemaVersion: 1.0.0
-version: 3.2.2
+version: 3.2.3
 kind: CustomDetection
 resourceType: Microsoft.Security/detectionRules
 apiVersion: 2026-06-01-preview
@@ -37,8 +37,8 @@ contentProvenance:
     kind: AnalyticsRule
     id: 7965f0be-c039-4d18-8ee8-9a6add8aecf3
     path: Analytic Rules/Dev-0270NewUserSep2022.yaml
-    version: 1.0.3
-    querySha256: 6778950e7367b6af8bf6a5f66b7c1d14ee637b59df099e91adaff27e24d99a82
+    version: 1.0.4
+    querySha256: 63f471a178cf95e359d0821a49332e08ad556d6aa002ab0f00c596afad6e6342
     schedule:
       queryFrequency: 6h
       queryPeriod: 6h
@@ -81,23 +81,23 @@ contentProvenance:
     originalTechniques:
     - T1098
     reviewScope:
-      sourceDocumentSha256: f242abee5f3a914d85c6dac85cb9477a5b557fd3f854d9e8a7728fb8bfe5f092
-      targetQuerySha256: 7fe35c134d3ffddd16835f95ca1f8b6851f997a9948c40ea3a4f867a0a341cfc
+      sourceDocumentSha256: fd61bbcb0d969ed2fc484f00e868432c6dce3b89abeece19c43b13911a0cdfba
+      targetQuerySha256: 288e8fbfa6753a5777ba33f7b7d774a0307f37071781ce7300658eb16d0d0b23
     reviewDecisions:
     - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting
       decision: accepted
-      sourceDocumentSha256: f242abee5f3a914d85c6dac85cb9477a5b557fd3f854d9e8a7728fb8bfe5f092
-      targetQuerySha256: 7fe35c134d3ffddd16835f95ca1f8b6851f997a9948c40ea3a4f867a0a341cfc
+      sourceDocumentSha256: fd61bbcb0d969ed2fc484f00e868432c6dce3b89abeece19c43b13911a0cdfba
+      targetQuerySha256: 288e8fbfa6753a5777ba33f7b7d774a0307f37071781ce7300658eb16d0d0b23
     - reason: query mixes native Defender and Sentinel workload tables; time columns were preserved and require runtime validation
       decision: accepted
-      sourceDocumentSha256: f242abee5f3a914d85c6dac85cb9477a5b557fd3f854d9e8a7728fb8bfe5f092
-      targetQuerySha256: 7fe35c134d3ffddd16835f95ca1f8b6851f997a9948c40ea3a4f867a0a341cfc
+      sourceDocumentSha256: fd61bbcb0d969ed2fc484f00e868432c6dce3b89abeece19c43b13911a0cdfba
+      targetQuerySha256: 288e8fbfa6753a5777ba33f7b7d774a0307f37071781ce7300658eb16d0d0b23
     - reason: 'Best-effort entity mapping requires review: source Host.FullName column `Computer` is provisionally represented
         by hosts.nameColumn `HostName`; confirm that this column is the intended host identifier. The original value is also
         retained in customDetails when the query output binding is available; this assumption does not prove entity parity'
       decision: accepted
-      sourceDocumentSha256: f242abee5f3a914d85c6dac85cb9477a5b557fd3f854d9e8a7728fb8bfe5f092
-      targetQuerySha256: 7fe35c134d3ffddd16835f95ca1f8b6851f997a9948c40ea3a4f867a0a341cfc
+      sourceDocumentSha256: fd61bbcb0d969ed2fc484f00e868432c6dce3b89abeece19c43b13911a0cdfba
+      targetQuerySha256: 288e8fbfa6753a5777ba33f7b7d774a0307f37071781ce7300658eb16d0d0b23
     supplementalEntityDetails:
     - entityType: Account
       entityIndex: 1
@@ -144,15 +144,15 @@ properties:
       | where EventID == 4688
       | where CommandLine has_all ('net user', '/add')
       | parse CommandLine with * "user " username " "*
-      | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine)
-      | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')
+      | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, CommandLine)
+      | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394')
       | project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
       ),
       (DeviceProcessEvents
       | where InitiatingProcessCommandLine has_all('net user', '/add')
       | parse InitiatingProcessCommandLine with * "user " username " "*
-      | extend password = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine)
-      | where username in('DefaultAccount') or password in('P@ssw0rd1234', '_AS_@1394')
+      | extend ExtractedArg = extract(@"\buser\s+[^\s]+\s+([^\s]+)", 1, InitiatingProcessCommandLine)
+      | where username in('DefaultAccount') or ExtractedArg in(strcat('P@ss', 'w0rd1234'), '_AS_@1394')
       | extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName
       )
       )