PowerShell Called from an Executable Version Mismatch
This rule detects instances where PowerShell is invoked, and there's a mismatch between the PowerShell engine version and the host version. Specifically, it looks for PowerShell classic start events where the 'Data' field contains an 'EngineVersion' of 2, 4, or 5, while simultaneously containing a 'HostVersion' of 3. This version mismatch can indicate attempts to evade detection or exploit vulnerabilities by using an older or specific PowerShell engine version within a newer host environment.
Sigma
