1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T1689 Downgrade Attack — Attack Simulation

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be…

Technique description

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Connected ecosystem references

Linked tags

enterprisecloud-hosted-endpointonpremmacOSWindowsLinuxdefense-impairmentisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requiredsome_candidates_require_elevationpotential_disruption_requires_individual_review
can_simulatetechniquesource_mapped

Detection and collection

T1689 detection workspace

Attack tools

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.