{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1689","id":"T1689","name":"Downgrade Attack","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1689","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"9bd8b628e0b46e31f779540c803b77deb47915bc8d4aba460b10274ba58c09f2","description":"Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.\n\nAdversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike downgrade attack)(Citation: Google Cloud downgrade attack)(Citation: att_def_ps_logging)\n\nAdversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: CrowdStrike Downgrade attack 2) On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.(Citation: SafeBreach)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1689","external_id":"T1689"},{"source_name":"SafeBreach","description":"Alon Leviev. (2024, August 7). Windows Downdate: Downgrade Attacks Using Windows Updates. Retrieved January 8, 2025.","url":"https://www.safebreach.com/blog/downgrade-attacks-using-windows-updates/"},{"source_name":"CrowdStrike Downgrade attack 2","description":"Bart Lenaerts-Bergmans. (2023, March 13). What are Downgrade Attacks?. Retrieved April 15, 2026.","url":"https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/downgrade-attack/"},{"source_name":"Targeted SSL Stripping Attacks Are Real","description":"Check Point. (n.d.). Targeted SSL Stripping Attacks Are Real. Retrieved May 24, 2023.","url":"https://blog.checkpoint.com/research/targeted-ssl-stripping-attacks-are-real/amp/"},{"source_name":"CrowdStrike downgrade attack","description":"Falcon Complete Team. (2021, May 11). Response When Minutes Matter: Rising Up Against Ransomware. Retrieved April 15, 2026.","url":"https://www.crowdstrike.com/en-us/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/"},{"source_name":"att_def_ps_logging","description":"Hao, M. (2019, February 27). Attack and Defense Around PowerShell Event Logging. Retrieved November 24, 2021.","url":"https://nsfocusglobal.com/attack-and-defense-around-powershell-event-logging/"},{"source_name":"Google Cloud downgrade attack","description":"Nathan Kirk. (2018, June 18). Bring Your Own Land (BYOL) — A Novel Red Teaming Technique. Retrieved April 15, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/bring-your-own-land-novel-red-teaming-technique/"},{"source_name":"Praetorian TLS Downgrade Attack 2014","description":"Praetorian. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved October 8, 2021.","url":"https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/"}],"platforms":["macOS","Windows","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1689","id":"T1689","name":"Downgrade Attack","domain":"enterprise","platforms":["macOS","Windows","Linux"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1689","technique_page":"techniques/enterprise/T1689/","page":"detections/enterprise/T1689/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"8c0eca51-0f88-4db2-9183-fdfb10c703f9","title":"LSA PPL Protection Setting Modification via CommandLine","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8c0eca51-0f88-4db2-9183-fdfb10c703f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0350","name":"Detecting Downgrade Attacks","url":"https://attack.mitre.org/detectionstrategies/DET0350","stix_id":"x-mitre-detection-strategy--63d80d1b-ca5b-427d-b603-cf65e6e245b9","relationship_id":"relationship--bb75d442-a25f-4e60-a59a-5bf55cb9ff81","description":"","analytics":[{"id":"AN0995","name":"Analytic 0995","guidance":"Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.","url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0995","platforms":["Windows"],"tuning":[{"field":"AllowedInterpreterVersions","description":"Defines which versions of interpreters like PowerShell are permitted in the environment."},{"field":"RegistryDefenderKeys","description":"Specific registry paths for monitoring Defender/HVCI configurations that may vary by Windows version."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0995","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0995","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Security","channel":"EventCode=4657","platforms":["Windows"],"analytic_id":"AN0995","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0995","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN0996","name":"Analytic 0996","guidance":"Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.","url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0996","platforms":["Linux"],"tuning":[{"field":"AllowedCryptoProtocols","description":"List of TLS/SSL versions approved for use; alerts triggered if older protocols (e.g., TLS 1.0) are used."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"execve: Execution of downgraded interpreters such as python2 or forced fallback commands","platforms":["Linux"],"analytic_id":"AN0996","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0996","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0034","component":"Process Metadata","name":"linux:syslog","channel":"Kernel or daemon warnings of downgraded TLS or cryptographic settings","platforms":["Linux"],"analytic_id":"AN0996","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0996","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]},{"id":"AN0997","name":"Analytic 0997","guidance":"Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.","url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0997","platforms":["macOS"],"tuning":[{"field":"ApprovedInterpreterVersions","description":"Defines the minimal version of interpreters expected; older versions flagged as downgrade attempts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Execution of older or non-standard interpreters","platforms":["macOS"],"analytic_id":"AN0997","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0997","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0034","component":"Process Metadata","name":"macos:unifiedlog","channel":"Modifications or writes to EFI system partition for downgraded bootloaders","platforms":["macOS"],"analytic_id":"AN0997","source_url":"https://attack.mitre.org/detectionstrategies/DET0350#AN0997","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can downgrade NTLM to capture NTLM hashes.(Citation: Github_SILENTTRINITY) ","relationship_id":"relationship--7a68af11-adbf-46a7-909c-f2c0ab2d16e5","references":[{"source_name":"Github_SILENTTRINITY","description":"byt3bl33d3r. (n.d.). SILENTTRINITY. Retrieved September 12, 2024.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) enables SMBv1 during execution.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--8bbe6522-5c0f-4783-802b-bb428430e4a8","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has used the following command to re-enable SMB1: `Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart`.(Citation: CheckPointResearch_TheGentlemen_April2026)","relationship_id":"relationship--5a7cc322-c3b7-48ee-9e5f-6a5f210692ea","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}]}],"actors":[],"mitigations":[{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider removing previous versions of tools that are unnecessary to the environment when possible.","relationship_id":"relationship--e23ef770-4ade-44f2-a1ac-b524e77ce9cd","references":[]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.(Citation: Chromium HSTS)","relationship_id":"relationship--8940b29f-23b8-4b13-b529-5bc56b1f7552","references":[{"source_name":"Chromium HSTS","description":"Chromium. (n.d.). HTTP Strict Transport Security. Retrieved May 24, 2023.","url":"https://www.chromium.org/hsts/"}]}],"candidates":[{"id":"062f92c9-28b1-4391-a5f8-9d8ca6852091","name":"ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI","platforms":["linux"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1689/T1689.yaml","description":"An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.\n[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"}},"dependencies":[{"description":"Check if VMWARE PowerCLI PowerShell Module is installed.\n"}],"source_definition_sha256":"d031debec0d517f6a7414eb86004ee34008d262c35f7d6265613f1a9d748a274"},{"id":"14d55b96-b2f5-428d-8fed-49dc4d9dd616","name":"ESXi - Change VIB acceptance level to CommunitySupported via ESXCLI","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1689/T1689.yaml","description":"An adversary will change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria via ESXCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host.\n[Reference](https://www.mandiant.com/resources/blog/esxi-hypervisors-detection-hardening)\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to script with commands to change acceptance level","type":"path","default":"PathToAtomicsFolder\\T1698\\src\\esx_community_supported.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"1c5514d5f2cc8cc5e2374c66b8f4459dfce535f4bab16fd4272132e42d8725e6"},{"id":"47c96489-2f55-4774-a6df-39faff428f6f","name":"PowerShell Version 2 Downgrade","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1689/T1689.yaml","description":"Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active.","inputs":{"v2_command":{"description":"Specify the command to execute with Version 2","type":"string","default":"Invoke-Mimikatz"}},"dependencies":[{"description":"Check if Version 2 is installed."}],"source_definition_sha256":"401d0ae4ccf4ff485c53eb94fae62374a397c5038361de8dea7cd13703b528a9"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059":"/ttp-simulation/techniques/enterprise/T1059/","T1557":"/ttp-simulation/techniques/enterprise/T1557/","T1040":"/ttp-simulation/techniques/enterprise/T1040/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1689":"/ttp-simulation/techniques/enterprise/T1689/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1689","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}