{"id":"6331d09b-4785-4c13-980f-f96661356249","title":"PowerShell Downgrade Attack - PowerShell","description":"Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0","author":"Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)","status":"test","level":"medium","date":"2017-03-22","modified":"2023-10-27","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_classic_start"},"falsepositives":["Unknown"],"references":["http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml","source_sha256":"43c17de0d8acb54fa812238b22be8ffde481e75ed512ef4904eee0bdcf762708","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Downgrade Attack - PowerShell\nid: 6331d09b-4785-4c13-980f-f96661356249\nstatus: test\ndescription: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0\nreferences:\n    - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/\nauthor: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)\ndate: 2017-03-22\nmodified: 2023-10-27\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_classic_start\ndetection:\n    selection:\n        Data|contains: 'EngineVersion=2.'\n    filter_main:\n        Data|contains: 'HostVersion=2.'\n    condition: selection and not filter_main\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/6331d09b-4785-4c13-980f-f96661356249.json","kind":"sigma"}