Detect PowerShell v2 Downgrade

id: 70c41ff4-b95a-43a3-8fb5-794ed69be100
name: Detect PowerShell v2 Downgrade
description: |
  This query looks for processes that load an older version of the system.management.automation libraries. While not inherently malicious, downgrading to PowerShell version 2
  can enable an attacker to bypass some of the protections afforded by modern PowerShell. It is worth noting that some tools and scripts perform this to enable
  backwards compatibility, so the technique is not inherently malicious. You will likely need to filter the processes within your environment that legitimately use this
  capability for this to be effective.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceImageLoadEvents
tactics:
- Execution
query: |
  DeviceImageLoadEvents
  | where InitiatingProcessFileName =~ 'powershell.exe'
      and FileName in~ ('system.management.automation.ni.dll','System.Management.Automation.dll')
      and FolderPath matches regex @"[12]\.(\d)+\.(\d)+\.(\d)+"