PowerShell Downgrade Attack - PowerShell

Title: PowerShell Downgrade Attack - PowerShell
Status: test
Description:Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
References:
  -http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
Author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)
Date: 2017-03-22
modified:2023-10-27
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_classic_start

Detection:
  selection:
    Data|contains: 'EngineVersion=2.'
  filter_main:
    Data|contains: 'HostVersion=2.'
  condition:selection and not filter_main
Falsepositives:
  -Unknown
Level: medium