Detection rules › Splunk
PowerShell Downgrade (Sysmon)
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected. This use case detects attempts to execute PowerShell commands using a version earlier than 7
MITRE ATT&CK coverage
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '15846.23697'
title: PowerShell Downgrade
description: 'Adversaries may downgrade or use a version of system features that may
be outdated, vulnerable, and/or does not support updated security controls such
as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL)
which can record executed script content. However, adversaries may attempt to execute
a previous version of PowerShell that does not support SBL with the intent to impair
defenses while running malicious scripts that may have otherwise been detected.
This use case detects attempts to execute PowerShell commands using a version earlier
than 7. -- Threat Actor Association: Earth Estries -- Atomics T1059.001 Test #12'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=4688) OR "<EventID>4688<"
OR Type=Process) TERM(-version) | regex process="(?i)powershell\.exe\s+-version\s+[123456]"
| table _time, host, user process, process_*, signature_id | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1059.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://kurtroggen.wordpress.com/2017/05/17/powershell-security-powershell-downgrade-attacks/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-12---powershell-downgrade-attack
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(-version)
Stage 2: regex
| regex process="(?i)powershell\.exe\s+-version\s+[123456]"
Stage 3: table
| table _time, host, user process, process_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "-version" |