Potential PowerShell Downgrade Attack

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects attempts to downgrade PowerShell to version 2.0 by checking for specific command-line arguments. This technique is often used by adversaries to bypass security features like Script Block Logging and AMSI, which are present in newer versions of PowerShell.