Detectionmediumtest
PowerShell Downgrade Attack - PowerShell
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems), Lee Holmes, Harish Segar (improvements)Created Wed Mar 22Updated Fri Oct 276331d09b-4785-4c13-980f-f96661356249windows
Log Source
WindowsPowerShell Classic
ProductWindows← raw: windows
CategoryPowerShell Classic← raw: ps_classic_start
Detection Logic
Detection Logic2 selectors
detection:
selection:
Data|contains: 'EngineVersion=2.'
filter_main:
Data|contains: 'HostVersion=2.'
condition: selection and not filter_mainFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
6331d09b-4785-4c13-980f-f96661356249
Status
test
Level
medium
Type
Detection
Created
Wed Mar 22
Modified
Fri Oct 27
Path
rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml
Raw Tags
attack.defense-evasionattack.executionattack.t1059.001