PowerShell Downgrade to Version 2 Detected (AMSI Bypass Technique)
This detection identifies instances where PowerShell is executed using a legacy engine version (e.g., v2.0), which lacks support for AMSI and script block logging. Attackers often downgrade PowerShell to avoid modern security controls and to evade detection during payload execution. PowerShell version information is captured from the DeviceEvents table with ActionType `PowerShellEngineVersion`. Any engine version starting with "2." or "1." is treated as suspicious in this detection.
Microsoft Sentinel (KQL)
