Suspicious PowerShell Downgrade Attack - PowerShell (via ps_classic_start)

title: Suspicious PowerShell Downgrade Attack - PowerShell (via ps_classic_start)
id: 8e657097-7f7f-568c-8a7c-2631e95fa4fe
status: stable
description: This rule detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
author: Huntrule Team
date: 2026-03-16
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains: 'EngineVersion=2.'
    filter_main:
        Data|contains: 'HostVersion=2.'
    condition: selection and not filter_main
falsepositives:
    - Unknown
level: medium