author: Yusuke Matsui, Yamato Security
date: 2020/11/08
modified: 2021/11/22

title: Powershell 2.0 Downgrade Attack
title_jp: Powershell 2.0へのダウングレード攻撃
output: 'Powershell 2.0 downgrade attack detected!'
output_jp: 'Powershell 2.0へのダウングレード攻撃が検知されました！'
description: An attacker may have started Powershell 2.0 to evade detection.
description_jp: 攻撃者は検知されないようにPowershell 2.0を起動したリスクがある。

id: bc082394-73e6-4d00-a9af-e7b524ef5085
level: medium
status: test
detection:
    selection:
        Channel: Microsoft-Windows-PowerShell/Operational
        EventID: 400
        EventData|re: '[\s\S]*EngineVersion=2\.0[\s\S]*'
falsepositives:
    - legacy application
tags:
    - attack.defense_evasion
    - attack.t1562.010
    - lolbas
references:
    - https://attack.mitre.org/techniques/T1562/010/
    - https://kurtroggen.wordpress.com/2017/05/17/powershell-security-powershell-downgrade-attacks/
ruletype: hayabusa
