Downgrade Attack T1689
Tactic: Defense Impairment
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
Events covered
6 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| SMBClient | Event ID 31018 | Guidance: An administrator has enabled AllowInsecureGuestAuth. |
Authoring guide
These 8 rules share fields, values, and exclusions.
Fields filtered most (16 distinct)
These fields appear most often in rule filters.
Top indicator values (166 distinct)
These values appear most often in rule predicates.
Exclusions (1 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- LSA PPL Protection Setting Modification via CommandLine
- NTLM downgrade attack (Reg via SYSMON)
- SMB insecure guest authentication activated (native)
Elastic 3 rules
- Network-Level Authentication (NLA) Disabled
- Potential HTTP Downgrade Attack
- Potential NetNTLMv1 Downgrade Attack