Techniques › T1689
T1689 Downgrade Attack
defense impairment — macOS, Windows, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1689
0
KEV CVEs mapped here
<p>Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.</p><p>Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing. For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.</p><p>Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text. On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0350 Detecting Downgrade Attacks v1.0
AN0995 WindowsDetection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.Tunable:
AllowedInterpreterVersionsRegistryDefenderKeysAN0996 LinuxMonitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.auditd:SYSCALLexecve: Execution of downgraded interpreters such as python2 or forced fallback commands→ DC0064 Command Executionlinux:syslogKernel or daemon warnings of downgraded TLS or cryptographic settings→ DC0034 Process MetadataTunable:AllowedCryptoProtocolsAN0997 macOSDetection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.macos:unifiedlogModifications or writes to EFI system partition for downgraded bootloaders→ DC0034 Process MetadataTunable:ApprovedInterpreterVersions
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1689
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2022-03-22 (modified 2026-03-13) · logsource: product=windows category=process_creation · 8c0eca51-0f88-4db2-9183-fdfb10c703f9
Detects modification of LSA PPL protection settings via CommandLine.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.