ADscan 9.2.0

Added

• Live Scan Console in the Enterprise web platform: a real-time terminal view of a running scan in its own tab, with follow-tail, search, and a downloadable transcript that replays in full whether you open it mid-scan or after it finishes. A log-level toggle (Off / Verbose / Debug) filters the stream.
• Attack-graph edge detail in the web platform. Clicking any step now opens a two-level brief: plain-language business risk and impact for executives, and technique description, prerequisites, evidence, and command-level remediation for engineers, plus a "fixing this breaks N of M paths" blast-radius figure. It works even for theoretical steps that have no finding yet.
• Live finding detail during a running scan: a rich slide-over (description, impact, remediation, references, observed vs recommended) and a standalone finding register, both available before the scan completes.
• Exposure blast-radius dashboard: a headline showing what share of domain users have a validated path to full domain compromise, broken down into domain compromise, Tier 0 foothold, and stepping-stone.
• Engagement-posture Settings in the web platform: independent Offline-mode and Send-telemetry toggles, applied per scan.
• MSSQL authorization mapping: the scan enumerates SQL access and sysadmin rights across reachable database servers and adds them to the attack graph as escalation paths.
• Deleted-object (AD Recycle Bin) attack surface: ADscan discovers restorable tombstoned objects, flags ones an attacker could write to or reanimate, and can chain a restore into a live escalation path.
• Offline credential extraction from virtual-machine artifacts left on shares: virtual disks, including snapshot and differencing chains, and memory images are parsed offline to recover credentials.
• Machine-password rotation auditing: ADscan recovers the real rotation interval from policy and reports computers whose machine passwords are not rotating, scored by how stale they are.
• New findings for duplicate computer DNS (several enabled computer names pointing at one IP) and stale or obsolete enabled computers.
• Structured remediation runbooks on every finding: each carries a primary fix plus a fallback for constrained environments, with concrete GPO / PowerShell / registry / certutil commands and a validation step.
• Affected-assets appendix: deliverables now bundle a complete CSV and JSON list of every affected host, account, or certificate template, with inline lists capped for readability in large environments.
• Credential provenance: every recovered credential is labelled with how it was obtained, shown across the report and the web platform. The scan's own starting credential is no longer counted as a compromised credential.
• NIS2 is now a distinct, selectable compliance framework, previously folded into ENS.

Changed

• Deliverables restructured into three documents: a concise Security Assessment Report (where, and how bad), an AD Hardening Playbook (deep remediation runbooks and a 30-day plan), and an AD Control Coverage Report (what was tested and what you are verified clear on). The MITRE coverage view is folded into the main report.
• Affected-assets lists now name the true affected entities: the vulnerable certificate template and issuing CA for ADCS findings, and the real hosts or accounts for posture findings, instead of the attack path's end target or a blanket "domain-wide".
• Multi-domain trust scope now defaults to the origin domain only; enumerating trusted domains is opt-in, since clients often do not authorize it. In the web platform the operator opts additional domains in through a domain-topology graph.
• Compliance frameworks are now opt-in, and the report and web view honor exactly the frameworks you selected for the scan (previously a fixed default set was shown regardless).
• After reaching Domain Admin, an audit now replicates the full credential database once, matching the CTF flow, so lateral-movement and offline-cracking impact is demonstrated rather than left implied.
• Spraying is redesigned into a coverage-driven, lockout-aware flow: it excludes already-locked and already-owned accounts, computes an effective bad-password count against the real lockout window, and covers username-as-password, blank-password, and pre-2000 computer variants.
• The web platform now presents a single workspace dashboard and lands you straight on your workspace when there is only one.
• Attack paths in domain scope return the shortest high-value route by default.
• The important-port scan streams results live into the scan dashboard with a top-open-ports ranking.

Fixed

• Share looting and bait-drop now run as the assessed user rather than the session's active credential, so credentials embedded on shares that only that user can reach are no longer missed.
• Writable-share detection no longer reports false write access on read-only shares; effective access is intersected with the share-level cap and confirmed before an edge is drawn.
• A permission change is only offered when the granted right actually allows it (force-change-password no longer surfaced on rights that cannot perform it).
• Guest and null SMB sessions use NTLM instead of Kerberos, fixing a regression that broke them against hardened hosts.
• Kerberos service tickets are resolved against each host's own name during authenticated share enumeration, and a stale DNS name is self-healed at the connection layer, fixing authentication failures against non-DC hosts.
• Clock synchronization for certificate-based Kerberos (PKINIT and shadow credentials) now steps the host clock to the domain controller when needed and self-heals on drift.
• Remediation now renders for ADCS ESC techniques that previously showed no fix, and remediation accuracy was corrected for LSA Secrets and ADCS ESC9 / ESC10 / ESC16.
• The report cover no longer shows an internal execution-workspace name in place of the client name.
• Several client-facing strings that had leaked Spanish in the web platform and the DORA report section are now in English.
• The web deliverable-kit request no longer hits a dead route, restoring the compliance-framework export.
• In non-interactive and CI runs, live progress panels no longer flood the log.

Removed

• The standalone MITRE Remediation Checklist and Coverage Matrix deliverables; their content is folded into the new three-document set.
• The web platform no longer offers unauthenticated scans or the CTF engagement type; both remain available from the command line.