PowerShell Called from an Executable Version Mismatch

Title: PowerShell Called from an Executable Version Mismatch
Status: test
Description:Detects PowerShell called from an executable by the version mismatch method
References:
  -https://adsecurity.org/?p=2921
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Date: 2017-03-05
modified:2023-10-27
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_classic_start

Detection:
  selection_engine:
    Data|contains:
      -'EngineVersion=2.'
      -'EngineVersion=4.'
      -'EngineVersion=5.'

  selection_host:
    Data|contains: 'HostVersion=3.'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high