The following lists the new features, enhancements and resolved issues by deployment.
Current Deployment
March 10, 2025
New Features
The following Active Directory Assessments have been added to Discoveries:
-
Credential Access:
-
Microsoft Entra seamless single sign-on (AzureADSSOACC) account password has not changed recently
-
-
Persistence:
-
Tier Zero Group policy contains a scheduled task
-
Non-Tier Zero Group policy contains a scheduled task
-
Resolved Issues
| Resolved Issue | Issue ID |
|---|---|
| The issue "Tier Zero enumeration does not properly handle Domain Users group being member of a Tier Zero group" has been resolved. | 542953 |
Previous Deployments
December 17, 2024
New Features
Security Guardian has added support for Entra ID objects in Microsoft 365 tenants, which includes Privileged object identification and certification. Security Assessments, and indicators for Findings in Security Guardian and On Demand Audit.
December 10, 2024
New Features
The following Active Directory Assessments have been added to Discoveries:
-
Credential Access
-
Group Policy does not enforce built-in Administrator account lockout
-
-
Lateral Movement
-
Tier Zero Group Policy allows Authenticated Users to add computers to the domain
-
Non-Tier Zero account can request an overly permissive certificate with privileged EKU (ESC2)
-
-
Privilege Escalation
-
Non-Tier Zero account can use a misconfigured certificate template to impersonate any user
-
Resolved Issues
| Resolved Issue | Issue ID |
|---|---|
| A performance improvement has been implemented for environments with a large volume of Tier Zero objects. | 530317 |
October 10, 2024
New Features
The following Active Directory vulnerabilities have been added to Discoveries:
-
Credential Access:
-
Domain trust without Kerberos AES encryption enabled
- Kerberos KRBTGT account password has not changed recently
-
-
Privilege Escalation:
-
Suspicious ESX Admins group detected in domain
-
Enhancements
| Enhancement | Issue ID |
|---|---|
| MITRE ATT&CK TTPs have been added to Hygiene and Detected Indicators Findings Investigation pages. | 494070 |
| The reason(s) why an object is considered Tier Zero is displayed in object details and the Findings Investigation page for the object. | 479695 |
| In Assessment results for vulnerable computer and user objects, a column has been added to indicate whether the object is enabled or disabled. | 481991 |
August 15, 2024
Enhancements
| Enhancement | Issue ID |
|---|---|
| To prevent system overload from exceptionally large data sets, a maximum of 100,000 objects will be displayed in the Assessment Results Vulnerable Objects list. | 502873 |
August 1, 2024
New Features
You can export the complete Tier Zero objects list to a csv file, for sharing with stakeholder and security assessment engagements.
Enhancements
| Enhancement | Issue ID |
|---|---|
| To simplify the user experience, Am I Exposed? no longer displays on the Findings Investigation page. | 465773 |
July 02, 2024
New Features
The terminology for Indicator and Finding types has changed to better align with industry standards.
March 26, 2024
New Features
A Data Collections page has been added to Security Settings, which allows you to monitor Active Directory data collections within your organization. You can also:
-
manually run a data collection
-
disable data collections that you no longer want to run.
