Cross-source coverage
T1689 / ATT&CK
Downgrade Attack
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing. For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.
Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text. On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.
- Tactics
- Defense Impairment
- Platforms
- macOS · Windows · Linux
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLlinux:syslogmacos:unifiedlog
How MITRE says to detect it DET0350
Detecting Downgrade Attacks
Windows Analytic 0995
Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.
WinEventLog:SysmonEventCode=1WinEventLog:SecurityEventCode=4657
Linux Analytic 0996
Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.
auditd:SYSCALLexecve: Execution of downgraded interpreters such as python2 or forced fallback commandslinux:syslogKernel or daemon warnings of downgraded TLS or cryptographic settings
macOS Analytic 0997
Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.
macos:unifiedlogExecution of older or non-standard interpretersmacos:unifiedlogModifications or writes to EFI system partition for downgraded bootloaders
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| LSA PPL Protection Setting Modification via CommandLine | Medium | Sigma |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Downdate Registry Activity | Undefined | SPL |