T1689 — Downgrade Attack

Tactic: Defense Impairment · Platforms: macOS, Windows, Linux

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. Adversaries may…

Sigma detection rules (3)

T1689 Downgrade Attack

title: T1689 Downgrade Attack
id: c1351785-a9bc-47fe-b506-7558a0f20f2f
description: 'Detecting Downgrade Attacks (T1689): flags PowerShell invoked with the legacy -Version 2 engine switch (or equivalent /version:2), the primary real-world downgrade technique used to bypass AMSI, Script Block Logging, and other PSv3+ security controls by forcing execution under the deprecated PowerShell v2 engine. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AllowedInterpreterVersions, RegistryDefenderKeys.'
references:
  - https://attack.mitre.org/techniques/T1689
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1689

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
    CommandLine|contains:
      - '-version 2'
      - '-Version 2'
      - '/version:2'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legacy scripts or third-party tools explicitly requiring the PSv2 engine for compatibility; System and service accounts performing the same action are excluded via filter_system_account; tune AllowedInterpreterVersions for known-legitimate legacy usage.

level: medium

T1689 Downgrade Attack

title: T1689 Downgrade Attack
id: 8c99beef-baea-4e70-aaa3-c304381aa871
description: 'Detecting Downgrade Attacks against SSH/TLS configuration. Editing sshd_config/ssl.conf/openssl.cnf alone cannot distinguish weakening from strengthening changes, so the rule now requires the edit (or a direct openssl invocation) to reference a known-weak cipher/protocol value (e.g. 3DES, RC4/ARCFOUR, MD5, SSLv3, TLSv1.0, NULL/EXPORT ciphers), giving direction-of-change evidence rather than alerting on any config touch. Tune using: AllowedCryptoProtocols.'
references:
  - https://attack.mitre.org/techniques/T1689
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1689

logsource:
  category: process_creation
  product: linux

detection:
  selection_config_edit:
    type: EXECVE
    exe|endswith:
      - '/sed'
      - '/vi'
      - '/vim'
  selection_target_config:
    a1|contains:
      - 'sshd_config'
      - 'ssl.conf'
      - 'openssl.cnf'
  selection_weak_value:
    a2|contains:
      - '3des'
      - 'arcfour'
      - 'rc4'
      - 'md5'
      - 'ssl3'
      - 'sslv3'
      - 'tlsv1'
      - 'null'
      - 'export'
  selection_openssl_weak_flags:
    type: EXECVE
    exe|endswith: '/openssl'
    a1|contains:
      - '-ssl3'
      - '-tls1'
      - '-cipher'

  condition: (selection_config_edit and selection_target_config and selection_weak_value) or selection_openssl_weak_flags

falsepositives:
  - Authorized cryptographic hardening changes that happen to mention a weak-cipher name only to explicitly disable/remove it (e.g. removing RC4 from an allow-list); verify direction of change during triage against AllowedCryptoProtocols.

level: high

T1689 Downgrade Attack

title: T1689 Downgrade Attack
id: e9a431c0-037f-4594-a60a-08b09f1747e5
description: 'Detecting Downgrade Attacks. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApprovedInterpreterVersions.'
references:
  - https://attack.mitre.org/techniques/T1689
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1689

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|contains:
      - '/python2.7'
      - '/ruby1.8'

  condition: selection

falsepositives:
  - Legacy internal tooling or build scripts still pinned to an older interpreter version for compatibility reasons, unrelated to any exploitation attempt.

level: medium

Explore