Tenable Identity Exposure 2024 Release Notes

• Dashboard template — Tenable Identity Exposure now offers a dashboard template to help you gain visibility into the recent report from the "Five Eyes" alliance and their associated civilian agencies. This report provides guidance on detecting and mitigating Active Directory compromises.

• Service Accounts Misconfigurations — A new Indicator of Exposure lists the bad practices and misconfigurations that can affect domain service accounts.

• ADCS Dangerous Misconfigurations — An improvement in this IoE helps to identify issuance policies (enterprise OIDs) that allow principals to become member of AD groups implicitly.

Tenable Identity Exposure version 3.82 contains the following bug fixes:

Tenable Identity Exposure version 3.81.2 contains the following bug fix:

• Domain Without Computer-Hardening GPOs Indicator of Exposure:

  • New reason related to the Windows Defender Credential Guard security feature used to protect in-memory credentials.

  • New reason related to the "Point and Print" feature of Windows: hardening for print drivers installation and updates.

  • New reason related to LDAP session signing and channel binding, to mitigate MiTM and replay attacks.

• Dormant Accounts Indicator of Exposure has a new reason to report domain controllers that have not performed any authentication (based on the lastLogonTimestamp attribute) in the last 45 days. This period is customizable via a new option.

• Root Objects Permissions Allowing DCSync-Like Attacks Indicator of Exposure now includes a new option, "Keep MSOL_* accounts," which allows you to exclude those accounts and reduce false positives. By default, this option is disabled in the security profile, so the IOE does not flag MSOL_* accounts as deviant.

• NTDS Extraction Indicator of Attack renamed "Allowed processes" to clarify its use in "aggressive" mode only and removed the unused "Allowed NTDS destination paths" option.

• Performance — Tenable Identity Exposure improved internal monitoring capabilities.

Tenable Identity Exposure version 3.81 contains the following bug fixes:

• RSOP-based Indicators of Exposure (IoE) — To enhance overall product performance, Tenable Identity Exposure now performs RSOP checks for a small number of IoEs every 30 minutes instead of real time. For more information, see RSOP-based Indicators of Exposure.

Tenable Identity Exposure version 3.80 contains the following bug fixes:

Tenable Identity Exposure version 3.79 contains the following bug fixes:

• Indicators of Exposure

  • Unsecured Configuration of Netlogon Protocol - Tenable Identity Exposure now sets the default value of the "Skip registry key check" option to "true". This change assumes that users have applied the February 9, 2021 updates. This modification applies only to the default profile, leaving custom profiles unaffected.

  • Computers Running an Obsolete OS - Tenable Identity Exposure added last the logon information for active obsolete computers.

• Indicators of Exposure for Entra ID: The following Entra ID IoEs now ignore disabled users and service principals.

  • Dangerous API Permissions Affecting the Tenant

  • First-Party Service Principal With Credentials

  • High Number of Administrators

  • Missing MFA for Privileged Account

  • Missing MFA for Non-Privileged Account

    This is because attackers cannot immediately exploit them. As for MFA IoEs, the Microsoft Graph API incorrectly returns the MFA status for disabled users.

• Indicators of Attack

  • DCSync does not trigger an alert if its source comes from a username with a prefix MSOL_ (hardcoded and valid for basic mode only).

  • Enumeration of Local Administrators does not trigger an alert if the target IP is unknown.

  • Golden Ticket only triggers an alert if an attacker authenticated after forging a TGT (basic mode only).

  • OS Credential Dumping: LSASS Memory does not trigger an alert if the tool belongs to Arctic Wolf Network (basic mode only).

• Email alerting now only supports valid encryption protocols, such as TLS 1.2 and 1.3. If you overrode your Secure Relay to force a deprecated SMTP encryption standard, like SSL v3, you must remove the override. The only allowed values are now "Tls12", "Tls13", or "Tls12, Tls13" (for automatic switching based on the server version). Using an unsupported value prevents the relay from starting.

Tenable Identity Exposure version 3.78 contains the following bug fixes:

• Conflicting Security Principals Indicator of Exposure (IoE) — A new IoE checks that there are no duplicated (conflicting) objects such as users, computers, or groups.

• Dangerous Kerberos Delegation IoE — A new reason reports all accounts where the attribute used by the constrained delegation (msDS-AllowedToDelegateTo) refers to a Service Principal Name (SPN) that does not exist.

• Active Directory — Tenable Identity Exposure increased the size limit for the AD objects it manages.

Tenable Identity Exposure version 3.76 contains the following bug fixes:

• Shadow Credentials Indicator of Exposure (IoE) — A new IoE detects backdoors and misconfigurations of shadow credentials in the "Windows Hello for Business" feature and its associated key credentials.

• User Primary Group IoE — An additional reason reports on all accounts where the primaryGroupID attribute appears empty due to insufficient rights.

• Password Spraying Indicator of Attack (IoA) — In some scenarios, this IoA caused system performance issues, including memory overload, but it now groups alerts related to the same attack into a single alert to resolve these issues.

• These IoAs no longer trigger alerts in the following cases:

  • DC Sync— When the source is a user or hostname related to the Azure ADConnect tool (basic mode only).

  • NTDS Extraction — When the source tool is either VSS Requestor or Veeam (legitimate backup tools).

  • Enumeration of Local Administrators — When the IoA cannot find the source user SID (basic mode only).

  • Petit Potam — When the IoA cannot retrieve the associated logon event.

  • Golden Ticket — When the IoA cannot fetch the source vectors (basic mode only).

Tenable Identity Exposure version 3.75 contains the following bug fixes:

• DC Sync, NTDS Extraction, Enumeration of Local Administrators Indicators of Attack (IoA) — The "Basic" mode no longer raises alerts in the following scenarios:

  • When the IoA detects event loss or a significant delay in event ingestion.

  • When the IoA cannot identify the source of an attack due to missing event data.

• NTDS Extraction IoA — A new active option in "basic" and "aggressive" mode called "Whitelisted Processes" exempts legitimate processes flagged during attacks.

Tenable Identity Exposure version 3.74 contains the following bug fixes:

Tenable Identity Exposure version 3.73 contains the following bug fixes:

• Users can now set the event gathering duration for Indicators of Attack (IoA) before triggering analysis, with values ranging from 30 seconds to 9 minutes (a trade-off between latency and accuracy).

• Golden Ticket IoA — To reduce false positives, Tenable Identity Exposure implemented a 10-hour deferral period during which it automatically allowlists legitimate users.

Tenable Identity Exposure version 3.72 contains the following bug fixes:

• Indicators of Attack (IoA)

• DC Sync:

• The default value for the "Defer Time" option increased from 1 h to 12 h to allow a larger window to filter out legitimate events.

• The default value for the "Allow Unknown Source" option changed from False to True to prevent a false negative caused by the default profile's inability to customize this option.

• Golden Ticket — Detection of Windows Event Log loss to prevent triggering false positives in certain cases.

• Enumeration of Local Administrators — Managed service accounts undergo filtering processes to reduce the occurrence of false positive detections.

• Indicators of Exposure (IoE)

  • Protected Users Group Not Used — An additional reason in the IoE reports all privileged users who are not in this group.

  • Last Password Change on KRBTGT Account — Support for the krbtgt_AzureAD account in Windows Hello for Business (Cloud Trust deployment).

Tenable Identity Exposure version 3.71 contains the following bug fixes:

• New Indicators of Exposure (IoEs)

  • Managed Service Accounts Dangerous Misconfigurations — Ensures the proper deployment and configuration of Managed Service Accounts.

  • Enabled Guest Account — Checks that the built-in guest account is disabled.

• Indicators of Exposure Enhancements

  • Domain Without Computer-Hardening GPOs — Integrated new checks designed to address null sessions, which all domain computers should explicitly deactivate.

  • Native Administrative Group Members — Added "Exchange Servers", "Exchange Windows Permissions", and "Exchange Trusted Subsystem" groups to the allowlist for custom groups. This modification applies to the default security profile only and not to existing custom security profiles.

  • User Account Using Old Password — Added two reasons to distinguish between privileged users and regular users.

• To boost throughput, LDAP search requests now batch results between the Relay and the Ceti service.

Tenable Identity Exposure version 3.69 contains the following bug fixes:

Indicators of Exposure (IoEs) enhancements:

• Dormant Accounts — Two new reasons to distinguish between privileged users and regular users.

• Computers Running an Obsolete OS — A new value 'lastLogonTimestamp' to show the timestamp of the last successful user logon in the "Inactive obsolete OS" deviances.

• Domain Without Computer-Hardening GPOs

  • New checks related to hardened UNC paths configured for domain controllers (SYSVOL/NETLOGON shares).

  • New checks related to the print spooler service that should remain disabled on domain controllers.

  • An enhancement to ensure proper Server Message Block (SMB) signing enforcement on domain controllers and other servers. It validates the "Default Domain Controllers Policy" parameter and checks for correct GPO configuration on other servers.

• Resultant Set of Policy (RSoP) IoEs — For the re-execution of RSoP IoEs with up-to-date cache, Tenable Identity Exposure now aggregates the buffered events over a short duration to reduce the number of changes to analyze (by default 1 minute and only for the "Logon Restrictions for Privileged Users" IoE).

Tenable Identity Exposure version 3.68 contains the following bug fixes:

• Computers cannot appear as deviant due to the reason "Not protected against delegation." Tenable Identity Exposure addresses and resolves any existing deviances related to this issue.

• Indicator of Exposure (IoE) enhancement — In the Kerberos Configuration on User Account IoE, users with smartcards are immune to the AS-REP Roasting attack and Tenable Identity Exposure no longer flags them as a security issue.

• Indicators of Attack (IoA) enhancements:

  • Password Guessing — A new option "Password spraying detection time interval" specifies the number of minutes over which each failed login attempt classifies as a potential attack in progress.

  • Enumeration of Local Administrators

    • A new option "Filtered access rights in aggressive mode" considers only specified access rights fetched from the event 'A network share object was checked' to classify a potential attack in progress. This list only applies in aggressive mode.

    • The default value for the option "Heuristic for Domain Controllers using versions before Windows Server 2016" is now "False".

  • DCSync — The default value for the option "Allow unknown source" is now "False".

  • NTDS Extraction — New "Deny list" in "Basic mode": diskshadow, ntdsutil, esentutl, esentutldefrag mode, vssown, copy-vss, wmi-based technique, psexec_ntds_grab, wmiprvse, vssadmin, vss, impacket-secretsdump, vss_requestor, VeeamGuestHelper, WMI-based technique.

  • Credential Dumping LSASS Memory — New "Deny list" in "Basic mode": mimikatz, taskmgr, ipconfig, arp, powershell, net, auditpol, whoami, cmd, route, processhacker, net1, csc, procdump, osqueryi.

Tenable Identity Exposure version 3.67 contains the following bug fixes:

Indicators of Attack (IoA) — New options for the following IoAs to limit false positives. For more information, see the Indicators of Attack Reference Guide.

Note: Beginning with this release, all IoAs on every security profile have the "Aggressive mode" option set to "False" by default. You can switch this option to "True" for each IoA in individual security profiles.

• Suspicious DC Password Change — New options:

  • "Aggressive mode":

• True: Detects the attack whether or not the user is authenticated.

• False (default): Detects only authenticated users.

• "Password change interval": In "Aggressive mode", this option specifies the period between two password changes (30 days by default).

• DCSync — New option:

• "Aggressive mode":

  • True: Triggers all attacks based on the IoA rules that can generate numerous false positives.

  • False (default): Triggers an attack only if the machine is not in the domain. This detects fewer attacks but avoids false positives.

Enhancements

• Optimized the computation duration for Indicators of Exposure dependent on Resultant Set of Policy (RSoP), resulting in slower deviance computation related to the RSoP. For more information, see RSoP-Based Indicators of Exposure in the Tenable Identity Exposure User Guide.

• Added support for limiting data visibility for Entra ID tenants in roles permissions management.

Tenable Identity Exposure version 3.66 contains the following bug fixes:

Indicators of Attack (IoA) — New default values for the following IoAs to limit false positives. For more information, see the Indicators of Attack Reference Guide.

• Golden Ticket — New "Aggressive Mode" option:

  • False (basic, default): Triggers an attack only if the targeted user is a domain controller or a user belonging to the Domain Admins group.

  • True: Allows attacks even if the target username is not a member of the "Domain Admins" group or a domain controller. It also allows attacks even if some domain controllers are not monitored (in other words, they do not emit any Windows Event Log).

• SAMAccountName Impersonation — New "Aggressive Mode" option:

  • False (basic, default): Does not trigger an attack if the TargetUserName is not a domain controller (DC).

  • True: Triggers all attacks based on the IoA rules that can generate numerous false positives.

• OS Credential Dumping: LSASS Memory — New options:

  • "Aggressive Mode":

  • False (basic, default): The IoA recognizes the tool and considers only the predefined processes as non-legitimate.

  • True: The IoA considers all attack tools as non-legitimate unless they are in the allowlist.

  • "Allowed processes in aggressive mode": Optional and applies only if the "Aggressive Mode" option = True.

  • "Basic Mode - Deny list": In basic mode, only the specified tools can trigger attacks.

• NTDS Extraction— New options:

  • "Aggressive Mode":

• False (basic, default): The IoA recognizes the tool and considers only the predefined processes as non-legitimate.

• True: The IoA considers all attack tools as non-legitimate unless they are in the allowlist.

• "Basic Mode - Deny list": On basic mode, only the specified tools can trigger attacks.

• "Basic Mode Attack Whitelisted Processes" (formerly "Whitelisted Processes"): Optional and applies only if the "Aggressive Mode" option = True.

• Massive Computers Reconnaissance— New default values for options:

  • Number of computers — 5000

  • Minimum number of computers — 100

  • Percentage of computers — 95

  • Sliding window — 240

  • Waiting time between attacks — 240

• Password Guessing— New default value for option:

  • Number of accounts with failed attempts — 10 000

• Enumeration of Local Administrators — The option "Heuristic for Domain Controllers using versions prior to Windows Server 2016" is now set to "False" by default.

Indicators of Exposure (IoE)

• New IoEs

• Privileged Authentication Silo Configuration — Provides a step-by-step guide on the configuration of an authentication silo for privileged (Tier-0) accounts.

• Privileged AD User Accounts Synchronized to Microsoft Entra ID — Checks that privileged Active Directory user accounts are not synchronized to Microsoft Entra ID.

• Enhancements

  • Dangerous Kerberos Delegation IoE — Introduces a new reason to detect the current configuration of Kerberos delegation on Microsoft Entra Connect account (AZUREADSSOACC).

  • Reversible Passwords IoE — Validates passwords configured for storage in a reversible format based on the settings defined by the msDS-PasswordReversibleEncryptionEnabled attribute within the Password Settings Object (PSO).

  • Local Administrative Account Management IoE — Adds support for the new Microsoft Local Administrator Password Solution (LAPS) with a new option called "LAPS version installed" and validates the LAPS version configuration based on the user's selections.

Tenable Identity Exposure version 3.65 contains the following bug fixes:

Tenable Identity Exposure version 3.64 contains the following bug fixes:

• Indicators of Attack — The "Allowed Processes" option in the Indicators of Attack Credential Dumping: LSASS Memory and NTDS Extraction includes processes known to raise false positives.

Tenable Identity Exposure version 3.63 contains the following bug fixes: