Detection rules › Sigma

PowerShell Downgrade Attack - PowerShell

Severity
medium
Author
Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)
Source
upstream

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
PowerShell400

Stages and Predicates

Stage 1: selection

Data|contains: 'EngineVersion=2.'

Stage 2: not filter_main

Data|contains: 'HostVersion=2.'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Datamatch
  • EngineVersion=2. corpus 2 (sigma 2)
  • HostVersion=2.