Detecting Downgrade Attacks

Technique Detected:  Downgrade Attack | T1562.010

ID: DET0350
Domains: Enterprise
Analytics: AN0995, AN0996, AN0997
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN0995

Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.

Log Sources
Data Component Name Channel
Process Creation (DC0032) WinEventLog:Sysmon EventCode=1
Windows Registry Key Modification (DC0063) WinEventLog:Security EventCode=4657
Mutable Elements
Field Description
AllowedInterpreterVersions Defines which versions of interpreters like PowerShell are permitted in the environment.
RegistryDefenderKeys Specific registry paths for monitoring Defender/HVCI configurations that may vary by Windows version.

AN0996

Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.

Log Sources
Data Component Name Channel
Command Execution (DC0064) auditd:SYSCALL execve: Execution of downgraded interpreters such as python2 or forced fallback commands
Process Metadata (DC0034) linux:syslog Kernel or daemon warnings of downgraded TLS or cryptographic settings
Mutable Elements
Field Description
AllowedCryptoProtocols List of TLS/SSL versions approved for use; alerts triggered if older protocols (e.g., TLS 1.0) are used.

AN0997

Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.

Log Sources
Data Component Name Channel
Process Creation (DC0032) macos:unifiedlog Execution of older or non-standard interpreters
Process Metadata (DC0034) macos:unifiedlog Modifications or writes to EFI system partition for downgraded bootloaders
Mutable Elements
Field Description
ApprovedInterpreterVersions Defines the minimal version of interpreters expected; older versions flagged as downgrade attempts.