huntrule

PowerShell Downgrade Indicators on Windows via EngineVersion and HostVersion

Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.

FreeUnreviewedSigmamediumv1
title: PowerShell Downgrade Indicators on Windows via EngineVersion and HostVersion
id: bdacf7d8-405e-4097-bff2-5e12d69f3c81
status: test
description: This rule flags PowerShell activity where the command data contains an engine version starting with 2., but the host version also indicates 2. is not present. Such mismatches can indicate a PowerShell downgrade attempt by forcing usage of a different engine/host version pairing than expected. It relies on Windows PowerShell classic start telemetry fields for EngineVersion and HostVersion contained within the logged Data.
references:
  - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml
author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements), Huntrule Team
date: 2017-03-22
modified: 2023-10-27
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains: EngineVersion=2.
  filter_main:
    Data|contains: HostVersion=2.
  condition: selection and not filter_main
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6331d09b-4785-4c13-980f-f96661356249
    type: derived

What it detects

This rule flags PowerShell activity where the command data contains an engine version starting with 2., but the host version also indicates 2. is not present. Such mismatches can indicate a PowerShell downgrade attempt by forcing usage of a different engine/host version pairing than expected. It relies on Windows PowerShell classic start telemetry fields for EngineVersion and HostVersion contained within the logged Data.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.