PowerShell Downgrade Attack Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•34

This rule detects a PowerShell downgrade attack where an adversary attempts to force PowerShell to use an older, less secure engine version (2.0) while the host system is configured for a newer version. This technique is often used to bypass security features like Script Block Logging which are present in newer PowerShell versions.