Potential PowerShell Downgrade Attack

calendar Jan 4, 2023 · attack.defense_evasion attack.execution attack.t1059.001  ·
Share on: linkedin copy

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Sigma rule (View on GitHub)

 1title: Potential PowerShell Downgrade Attack
 2id: b3512211-c67e-4707-bedc-66efc7848863
 3related:
 4    - id: 6331d09b-4785-4c13-980f-f96661356249
 5      type: derived
 6status: test
 7description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
 8references:
 9    - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
10    - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade-
11author: Harish Segar (rule)
12date: 2020/03/20
13modified: 2023/01/04
14tags:
15    - attack.defense_evasion
16    - attack.execution
17    - attack.t1059.001
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        Image|endswith: '\powershell.exe'
24        CommandLine|contains:
25            - ' -version 2 '
26            - ' -versio 2 '
27            - ' -versi 2 '
28            - ' -vers 2 '
29            - ' -ver 2 '
30            - ' -ve 2 '
31            - ' -v 2 '
32    condition: selection
33falsepositives:
34    - Unknown
35level: medium

References

Related rules

to-top