{"id":7093,"date":"2024-12-17T14:48:21","date_gmt":"2024-12-17T12:48:21","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7093"},"modified":"2026-10-19T13:08:57","modified_gmt":"2026-10-19T10:08:57","slug":"whats-new-in-elements-november-2024","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/whats-new-in-elements-november-2024\/","title":{"rendered":"What&#8217;s New in Elements: November 2024"},"content":{"rendered":"<h2 data-id=\"editor-s-highlights\"><strong>Editor\u2019s Highlights<\/strong><\/h2>\n<h2 data-id=\"extended-detection-and-response\"><strong>Extended Detection and Response<\/strong><\/h2>\n<h3 data-id=\"endpoint-protection\"><strong>Endpoint Protection<\/strong><\/h3>\n<h4 data-id=\"elements-agent-for-windows-version-24-6\"><strong>Elements Agent for Windows: version 24.6<\/strong><\/h4>\n<p>A new version of the endpoint clients is available.<\/p>\n<p>This release makes the Elements Agent version 24.6 available (internal version 24.6.339).<\/p>\n<p>The endpoints automatically upgrade, without a reboot.<\/p>\n<p><strong>Features:<\/strong><\/p>\n<p>Elements Agent now supports migration from Countercept. Activating a subscription containing the EDR component uninstalls the Countercept Agent.<\/p>\n<p><strong>A new security event is sent when Elements Agent is uninstalled<\/strong><\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-23.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-23.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-23.png.webp 602w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-23-300x63.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-23-447x94.png.webp 447w\" sizes=\"auto, 100vw\" alt=\"Picture1.png\" height=\"127\" width=\"602\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p><strong>A new &#8220;Last restart time&#8221; status is sent to the portal<\/strong><\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22.png.webp 602w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22-300x89.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22-447x132.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-22-494x146.png.webp 494w\" sizes=\"auto, 100vw\" alt=\"Picture2.png\" height=\"178\" width=\"602\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>In addition:<\/p>\n<ul>\n<li>Elements Agent supports configuring APIPA (automatic private internet protocol addressing) addresses in Network location settings \/ Locations and rules.<\/li>\n<li>Elements Agent now supports Windows Server 2025.<\/li>\n<\/ul>\n<h4 data-id=\"elements-agent-for-macos-release-version-24-5-53798\"><strong>Elements Agent for macOS: Release version 24.5.53798<\/strong> <\/h4>\n<p>A new version of the Elements Agent for macOS has been released<\/p>\n<p>This release brings an EDR-only product variant<\/p>\n<p>The Installer can be downloaded from\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fdownload.withsecure.com%2FPSB%2Flatest%2FElementsAgentInstaller_53798.mpkg\" target=\"_blank\" rel=\"nofollow noopener ugc\">here<\/a>.<\/p>\n<p>Elements Agent macOS 24.5.53798 supports following macOS versions:<\/p>\n<ul>\n<li>macOS 15 Sequoia<\/li>\n<li>macOS 14 Sonoma<\/li>\n<li>macOS 13 Ventura<\/li>\n<\/ul>\n<h4 data-id=\"elements-mobile-protection-new-release-for-ios-24-8-11250\"><strong>Elements Mobile Protection: New release for iOS (24.8.11250)<\/strong><\/h4>\n<p>An update to the WithSecure Elements Mobile Protection app for iOS (<strong>24.8.11250<\/strong>) has been released.<\/p>\n<p>It includes the following new features and improvements:<\/p>\n<ul>\n<li>Allows users to block any processed URLs locally.<\/li>\n<li>Supports the \u201cBlock everything except allow list\u201d setting.<\/li>\n<li>Supports extended filtering for alert notifications related to blocked URLs.<\/li>\n<\/ul>\n<h3 data-id=\"endpoint-detection-and-response\"><strong>Endpoint Detection and Response<\/strong><\/h3>\n<h4 data-id=\"edr-filtering-enhancement\"><strong>EDR: Filtering enhancement<\/strong><\/h4>\n<p>With our new filtering enhancement, you can easily drill down and browse events from the agent. This allows you to use EventSearch to investigate the events and ignore events that are not useful to your investigation. This improvement is designed to make your experience with the portal smoother. Happy searching!\u00a0<\/p>\n<p>We have following improvements released to the Event Search view:<\/p>\n<p><strong>Pre-populated filters<\/strong><\/p>\n<p>When applying filters, the user can see the value dropdown being populated with all the unique values.<\/p>\n<p>There are max 500 values that will be displayed in the dropdown. If admin cannot find the value in the list, they need to narrow down their search by applying appropriate filters.<\/p>\n<p>Some of the fields will also have the option to select \u2018Does Not Equals\u2019 operator to search based in exclusions.<\/p>\n<p>While applying filters, the admin can now select multiple values from dropdown. This applies to both the \u2018Equals\u2019 and \u2019Not Equals\u2019 operators<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23.png.webp 531w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23-300x155.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23-447x231.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-23-282x146.png.webp 282w\" sizes=\"auto, 100vw\" alt=\"Picture3.png\" height=\"275\" width=\"531\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h4 data-id=\"edr-trigger-response-actions-now-available-from-with-the-bcd\"><strong>EDR: Trigger response actions now available from with the BCD<\/strong><\/h4>\n<p>In order to enable faster investigation and enhance the user experience for Endpoint BCDs, the Elements admin user can now trigger response actions from with the BCD details, so that they do not need to switch between the BCD view and the Response view while doing the investigation of a BCD.<\/p>\n<p><strong>How to submit a response action:<\/strong><\/p>\n<p>The admin can navigate to the Endpoint BCD in the Elements portal\u00a0<\/p>\n<p>In the BCD details -&gt; Quick actions, admin can see the list of response actions that can be triggered for the BCD. Currently, the user can trigger following response actions:<\/p>\n<p>Enumerate tasks<\/p>\n<p>Enumerate processes<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23.png.webp 602w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23-300x199.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23-447x297.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-23-220x146.png.webp 220w\" sizes=\"auto, 100vw\" alt=\"Picture4.png\" height=\"400\" width=\"602\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>The admin also has the option to perform these response actions from the Process details<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23.png.webp 1379w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23-300x158.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23-1024x538.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23-768x403.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23-447x235.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-23-278x146.png.webp 278w\" sizes=\"auto, 100vw\" alt=\"Picture5.png\" height=\"724\" width=\"1379\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>Once the admin triggers a response job, a pop message will be displayed and they can see if the response job was successfully submitted along with the link to the response details\u00a0\u00a0<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22.png.webp 1379w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22-300x162.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22-1024x553.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22-768x415.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22-447x241.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-22-270x146.png.webp 270w\" sizes=\"auto, 100vw\" alt=\"Picture6.png\" height=\"745\" width=\"1379\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>On clicking the \u201cSee response details\u201d, admin can view the details of the response job being submitted\u00a0<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21.png.webp 1379w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21-300x186.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21-1024x634.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21-768x476.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21-447x277.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-21-236x146.png.webp 236w\" sizes=\"auto, 100vw\" alt=\"Picture7.png\" height=\"854\" width=\"1379\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>The admin can navigate back to the BCD by clicking the \u201cSource BCD\u201d link.<\/p>\n<p>The admin can also view all the responses in the Response view. To see only the Endpoint responses, filter the data by Action Type = \u2018Endpoint\u2019.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18.png.webp 1379w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18-300x151.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18-1024x515.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18-768x387.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18-447x225.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-18-290x146.png.webp 290w\" sizes=\"auto, 100vw\" alt=\"Picture8.png\" height=\"694\" width=\"1379\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h3 data-id=\"identity-security\"><strong>Identity Security<\/strong><\/h3>\n<h4 data-id=\"updates-to-sign-in-detection-model\"><strong>Updates to Sign-in Detection Model<\/strong><\/h4>\n<ul>\n<li><strong>Enhanced Location Context<\/strong>: We&#8217;ve improved our model to better recognize regular locations, reducing false alerts for impossible travel on a user-by-user basis.<\/li>\n<li><strong>VPN Awareness<\/strong>: Our model now has enhanced detection for both personal and corporate VPNs. This improvement helps reduce false positives caused by VPN usage, which can make it appear as though you are signing in from a new location when, in fact, you are not. By recognizing VPN patterns, the model can more accurately determine your true location and reduce unnecessary alerts<\/li>\n<\/ul>\n<h4 data-id=\"reducing-noise-in-risk-sign-in-reports-for-customers-with-microsoft-p2-license\"><strong>Reducing Noise in Risk Sign-in Reports\u00a0<\/strong>(for customers with Microsoft P2 license)<\/h4>\n<ul>\n<li><strong>Fewer Unactionable Alerts<\/strong>: We&#8217;ve removed alerts with too many anomalies that don&#8217;t require action, making it easier to focus on important issues.<\/li>\n<li><strong>Suppressing Common Anomalies<\/strong>: We&#8217;re now suppressing frequent anomalies from known sources to reduce unnecessary noise.<\/li>\n<\/ul>\n<h2 data-id=\"exposure-management\"><strong>Exposure Management<\/strong><\/h2>\n<h4 data-id=\"status-of-multiple-recommendations-can-be-now-set-from-recommendation-list-page\"><strong>Status of multiple Recommendations can be now set from Recommendation List page<\/strong><\/h4>\n<p>Multiple Recommendation selection will activate the action panel. The status will be saved to the recommendations for further tracking. e.g The status appearing on Home \u2192 Exposure widget will show only active recommendations (active recommendation = status not &#8220;Done&#8221; or &#8220;False Positive&#8221;)<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19.png.webp 457w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19-300x252.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19-447x376.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-19-174x146.png.webp 174w\" sizes=\"auto, 100vw\" alt=\"Picture9.png\" height=\"384\" width=\"457\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h4 data-id=\"findings-in-this-recommendation-widget-changes\"><strong>&#8220;Findings in this recommendation&#8221; widget changes<\/strong><\/h4>\n<p>This widget on the Recommendation detail page has a new &#8220;last seen&#8221; column showing the time stamp when last time this finding has been seen. This column gives clearer idea about how fresh the scan results are.<\/p>\n<h4 data-id=\"improved-remediation-impact-score-precision\"><strong>Improved remediation impact score precision<\/strong><\/h4>\n<p>This will help with more accurate distinguishment of recommendations and more enhanced prioritization of them when their remediation impact scores are close to each other.<\/p>\n<h4 data-id=\"identity-audit-log-changes\"><strong>Identity audit log changes<\/strong><\/h4>\n<p>When user modifies Identity properties such as importance and business context, are now available in Elements Audit Logs. In addition, when user does actions such as elevating a recommendation to WithSecure, these are also included.<\/p>\n<h4 data-id=\"extended-logic-for-checking-identity-s-mfa-status\"><strong>Extended logic for checking identity\u2019s MFA status<\/strong><\/h4>\n<p>Correct MFA status is now shown on the Identity with traffic light colors depending on reported MFA status in O365, Portal and elsewhere by Microsoft.<\/p>\n<h4 data-id=\"new-coverage-widget-on-home-exposure-widget\"><strong>New \u201cCoverage\u201d widget on Home \u2192 Exposure Widget<\/strong><\/h4>\n<p>This new widget shows the Exposure Management coverage of a selected company from different angles.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-13.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-13.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-13.png.webp 602w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-13-300x35.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-13-447x52.png.webp 447w\" sizes=\"auto, 100vw\" alt=\"Picture10.png\" height=\"70\" width=\"602\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p><strong>Green Color<\/strong> in each area indicates whether the company has completed WithSecure Exposure Management onboarding successfully and scans are running perfectly on that area.<\/p>\n<p><strong>Orange Color:<\/strong> Indicates that the company has the proper licenses to get onboarded to the Exposure management, but not all configuration or onboarding is complete. in this case, by clicking on the area, user will be taken to a relevant view where the configuration or onboarding can be completed.<\/p>\n<p><strong>Gray Color:<\/strong> Indicates that the company does not have required licenses to get onboarded on the area. In this case, please reach out to the sales staff for more info on how to obtain the relevant license.<\/p>\n<h3 data-id=\"vulnerability-management\"><strong>Vulnerability Management<\/strong><\/h3>\n<h4 data-id=\"evm-system-scan\"><strong>EVM: System Scan<\/strong><\/h4>\n<p>The ability to detect vulnerabilities in the following products was added to Authenticated Scanning for Windows:<\/p>\n<ul>\n<li>Acronis Cyber Files<\/li>\n<li>Autodesk Revit<\/li>\n<li>BandiView<\/li>\n<li>HP Hotkey Support<\/li>\n<li>Intel oneAPI Base Toolkit<\/li>\n<li>iTunes for Windows<\/li>\n<li>NetApp 7-Mode Transition Tool<\/li>\n<li>Okta Verify for Windows<\/li>\n<li>Solarwinds Kiwi CatTools<\/li>\n<li>Splashtop Personal and Business<\/li>\n<li>Splashtop Software Updater<\/li>\n<li>Synology Active Backup for Business Agent<\/li>\n<li>Synology Assistant<\/li>\n<li>Synology Cloud Station Drive<\/li>\n<li>Synology Drive Client<\/li>\n<li>Vagrant VMware Utility<\/li>\n<\/ul>\n<h2 data-id=\"other-items-of-interest\"><strong>Other items of interest<\/strong><\/h2>\n<h3 data-id=\"threat-highlight-reports-november\"><strong>Threat Highlight Reports: November<\/strong><\/h3>\n<h4 data-id=\"threat-advisory-citrix-virtual-apps-desktops-cve-2024-8068-cve-2024-8069\"><strong>Threat Advisory: Citrix Virtual Apps &amp; Desktops (CVE-2024-8068 \/ CVE-2024-8069)<\/strong><\/h4>\n<p>Citrix released a security advisory on November 12th 2024 regarding a vulnerability affecting their product \u201cVirtual Apps &amp; Desktops\u201d.<\/p>\n<p>The \u201cCitrix session recording\u201d feature of the product has a vulnerable implementation of the networking messaging ability (MSMQ HTTP messaging) used to connect the virtual desktop and Citrix session recording server.<\/p>\n<p>Exploiting the vulnerability allows for privilege escalation to a SYSTEM-level user (as well as impersonating existing users).<\/p>\n<p>Citrix advisory notes that the vulnerability requires certain conditions to be met (namely an authenticated user on the same active directory domain). <strong>However, the researchers who disclosed the vulnerability noted that having a session recording server reachable via the internet might allow for successful remote exploitation of the vulnerability<\/strong>.<\/p>\n<p>A proof of concept was released on the same date as the advisory and soon afterwards attempts to exploit the vulnerability have been observed online.<\/p>\n<h4 data-id=\"threat-advisory-command-scripting-interpreter\"><strong>Threat Advisory: Command &amp; Scripting Interpreter<\/strong><\/h4>\n<p>In October 2024 Splunk compiled multiple recent security reports. From this compilation, a technique stands out: Command and Scripting Interpreter (<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fattack.mitre.org%2Ftechniques%2FT1059%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">T1059<\/a>)<\/p>\n<p>This technique leverages the fact that most Operating Systems come with some built-in command-line interface and scripting capabilities.<\/p>\n<p>Adversaries can abuse these technologies in various ways as a mean of executing arbitrary commands.<\/p>\n<p>You can <a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fexpertise%2Fresearch-and-innovation%2Fresearch%2Fmonthly-threat-highlights-report\" rel=\"nofollow noopener ugc\" target=\"_blank\">sign up<\/a> to receive the monthly Threat Reports, with full details of these threats.<\/p>\n<h2 data-id=\"further-information\"><strong>Further information<\/strong><\/h2>\n<p>Changelogs and Release Notes for all parts of WithSecure\u2122 Elements can be found at the\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fuserguides%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Help Center<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Editor\u2019s Highlights Extended Detection and Response Endpoint Protection Elements Agent for Windows: version 24.6 A new version of the endpoint clients is available. This release makes the Elements Agent version&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7093","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"d9f885585551ad4086aef7af540723c91b2eb943","vanilla_article_id":31533,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/31533-whats-new-in-elements-november-2024","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7093\/revisions"}],"predecessor-version":[{"id":8513,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7093\/revisions\/8513"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7093"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=7093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}