Detect Downgrade Attack in IBM QRadar
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system's backward compatibility to force it into less secure modes of operation. Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreters or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing. For example, PowerShell versions 5+ include Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL to evade detection. Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection. On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1689 Downgrade Attack
- Canonical reference
- https://attack.mitre.org/techniques/T1689/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
"QIDNAME"(qid) AS event_name,
LOGSOURCENAME(logsourceid) AS log_source,
CATEGORYNAME(category) AS category_name,
"UTF8"(payload) AS raw_payload,
CASE
WHEN LOWER("UTF8"(payload)) LIKE '%powershell%' AND LOWER("UTF8"(payload)) LIKE '%-version%' AND (LOWER("UTF8"(payload)) LIKE '%version 2%' OR LOWER("UTF8"(payload)) LIKE '%version 1%')
THEN 'PowerShell_Downgrade'
WHEN (LOWER("UTF8"(payload)) LIKE '%smb1protocol%' OR LOWER("UTF8"(payload)) LIKE '%mrxsmb10%')
AND (LOWER("UTF8"(payload)) LIKE '%enable-windowsoptionalfeature%' OR LOWER("UTF8"(payload)) LIKE '%set-smbserverconfiguration%' OR LOWER("UTF8"(payload)) LIKE '%sc config%')
THEN 'SMBv1_Enable'
WHEN LOWER("UTF8"(payload)) LIKE '%lanmanserver%parameters%' AND LOWER("UTF8"(payload)) LIKE '%smb1%'
THEN 'SMBv1_Registry'
WHEN LOWER("UTF8"(payload)) LIKE '%bcdedit%' AND (LOWER("UTF8"(payload)) LIKE '%testsigning%' OR LOWER("UTF8"(payload)) LIKE '%bootmgr%')
THEN 'SecureBoot_Downgrade'
ELSE 'Unknown_Downgrade'
END AS detection_type
FROM events
WHERE
LOGSOURCETYPEID IN (12, 13, 268) -- Windows Security, Sysmon, Defender
AND starttime > NOW() - 1 DAYS
AND (
(LOWER("UTF8"(payload)) LIKE '%powershell.exe%' AND LOWER("UTF8"(payload)) LIKE '%-version 2%')
OR (LOWER("UTF8"(payload)) LIKE '%powershell.exe%' AND LOWER("UTF8"(payload)) LIKE '%-version 1%')
OR (
(LOWER("UTF8"(payload)) LIKE '%smb1protocol%' OR LOWER("UTF8"(payload)) LIKE '%mrxsmb10%')
AND (LOWER("UTF8"(payload)) LIKE '%enable-windowsoptionalfeature%' OR LOWER("UTF8"(payload)) LIKE '%set-smbserverconfiguration%')
)
OR (LOWER("UTF8"(payload)) LIKE '%lanmanserver\\parameters%' AND LOWER("UTF8"(payload)) LIKE '%smb1%' AND LOWER("UTF8"(payload)) LIKE '%0x00000001%')
OR (LOWER("UTF8"(payload)) LIKE '%bcdedit.exe%' AND LOWER("UTF8"(payload)) LIKE '%testsigning%')
)
ORDER BY starttime DESCQRadar AQL query detecting downgrade attack patterns including PowerShell version downgrade execution, SMBv1 protocol re-enablement through command-line tools, SMBv1 registry key modification, and Secure Boot downgrade attempts via bcdedit. Parses Sysmon and Windows Security event sources.
Data Sources
Required Tables
False Positives & Tuning
- IT automation scripts that configure SMBv1 for backward compatibility in mixed-OS environments with legacy network equipment
- PowerShell compatibility testing scripts that invoke older engine versions as part of application regression testing
- Boot configuration changes made during Windows feature updates or recovery operations by system administrators
Other platforms for T1689
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 PowerShell Version 2 Downgrade
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-Version 2'. Note: Script Block Logging (Event ID 4104) will NOT capture the executed commands if the v2 engine loaded successfully. Security Event ID 4688 will still show the command line.
- Test 2 Enable SMBv1 Protocol via PowerShell
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Set-SmbServerConfiguration' and 'EnableSMB1Protocol'. Sysmon Event ID 13: Registry Value Set for HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 set to 1. SMBServer Operational Event ID 3000.
- Test 3 Enable SMBv1 via Windows Optional Feature
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Enable-WindowsOptionalFeature' and 'SMB1Protocol'. DISM operational events may also be generated. The feature state change persists across reboots.
References (8)
- https://attack.mitre.org/techniques/T1689/
- https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/
- https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique
- https://nsfocusglobal.com/attack-and-defense-around-powershell-event-logging/
- https://www.safebreach.com/blog/downgrade-attacks-using-windows-updates/
- https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/
- https://www.crowdstrike.com/cybersecurity-101/attack-types/downgrade-attacks/
- https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
Response Playbook
Triage
- Identify the specific downgrade type — is this a PowerShell version downgrade, SMBv1 enablement, protocol downgrade, or boot manager manipulation? Each has different risk profiles and response procedures.
- For PowerShell downgrade: check if PowerShell v2 runtime is even installed — if the .NET 2.0/3.5 framework is not present, the downgrade attempt will fail but still indicates adversary intent.
- Examine the parent process chain — was the downgrade command launched by a user interactively, by a script, or by an unknown binary? Check if the parent is a known LOLBin or a recently dropped executable.
- For SMBv1 enablement: determine if there are any legitimate business justifications (legacy devices) documented in your CMDB. Check with the endpoint owner before escalating.
- Review what happened AFTER the downgrade — did the downgraded PowerShell session execute additional suspicious commands? Look for subsequent process creation or network connections.
- Check if the downgrade occurred on a high-value target — domain controllers, Exchange servers, and admin workstations with PowerShell downgrade are significantly more concerning.
Containment
- For PowerShell downgrade: remove the PowerShell v2 engine from the endpoint if not needed: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root
- For SMBv1 enablement: immediately disable SMBv1 via Set-SmbServerConfiguration -EnableSMB1Protocol $false and Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
- If malicious activity followed the downgrade: isolate the endpoint and begin incident response — the downgrade was likely a precursor to a larger attack.
- Deploy GPO to prevent PowerShell v2 execution across the enterprise: remove the MicrosoftWindowsPowerShellV2 feature via DISM or Group Policy Preferences.
- For boot manager downgrade: restore Secure Boot to enforced mode and verify the boot chain integrity with bootverify or Measured Boot logs.
Evidence Collection
- PowerShell ScriptBlock Logging (Event ID 4104) — note: if the downgrade to v2 succeeded, SBL will NOT have captured the malicious script content. Check if any v5 ScriptBlock logs exist around the same time for related activity.
- PowerShell Module Logging (Event ID 4103) — may still capture some activity even in v2 sessions depending on configuration.
- Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 for the downgraded PowerShell invocation and all child processes.
- Windows Optional Feature state — run 'Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2' to check if PS v2 engine is enabled.
- SMB configuration state — run 'Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol' to document current state.
- Network traffic captures — if SMBv1 was enabled, check for SMBv1 negotiation packets on the network (Wireshark filter: smb.version == 1).
Escalation Criteria
- !PowerShell v2 invocation followed by network connections to external IPs — indicates the downgrade was used to evade logging while establishing C2.
- !SMBv1 enablement on a domain controller or file server — exposes the organization to EternalBlue (MS17-010) and similar SMBv1 exploits.
- !Multiple endpoints showing the same downgrade pattern in a short time window — indicates automated propagation or coordinated attack.
- !Boot manager downgrade detected — this is a sophisticated attack (BlackLotus-style) that requires immediate forensic analysis of the boot chain.
- !The downgrade was performed by a process that also attempted AMSI bypass or execution policy bypass — indicates a multi-layered defense evasion strategy.
Investigation Guide
Forensic Artifacts
- >
Registry: HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion — shows installed PS engine version. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 — 0x1 means SMBv1 is enabled. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\mrxsmb10 — Start value of 2 (Auto) or 3 (Manual) indicates SMBv1 client driver state. - >
Windows Feature State: DISM /Online /Get-Features /Format:Table | findstr SMB1 — shows if SMB1Protocol feature is enabled. - >
Event Log: Microsoft-Windows-SMBServer/Operational — Event ID 3000 for SMBv1 access attempts. - >
BCD Store: bcdedit /enum all — boot configuration including Secure Boot state and boot manager version. - >
Prefetch: C:\Windows\Prefetch\POWERSHELL.EXE-*.pf — execution timestamps, check for anomalous v2 invocations.
Tuning Guidance
For PowerShell downgrade detection, the most impactful tuning step is to remove the PowerShell v2 engine entirely from all endpoints via GPO: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root. This eliminates the attack surface and makes any attempt to invoke -version 2 a guaranteed failure (but still an indicator of adversary intent). For SMBv1, enforce the disable state via GPO and audit any exceptions in your CMDB — if legacy devices truly require SMBv1, isolate them on a dedicated VLAN and monitor all SMBv1 traffic. For protocol downgrade (HTTPS to HTTP), deploy HSTS preload lists and monitor for SSL stripping at the network level. The boot manager downgrade detection has very low false positive rates and should not need tuning — any hit is high-priority.
Hunting Queries
Hunt for PowerShell version downgrade attempts over a 30-day window, grouped by the parent process that launched them. Identifies which tools or scripts are consistently invoking legacy PowerShell versions and whether this pattern is widespread or targeted. A high count from an unexpected parent process warrants investigation.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "-version"
| extend RequestedVersion = extract(@"-[Vv]ersion\s+(\d+)", 1, ProcessCommandLine)
| where RequestedVersion in ("1", "2")
| summarize Count=count(), Devices=dcount(DeviceName), Users=make_set(AccountName), Earliest=min(Timestamp), Latest=max(Timestamp) by InitiatingProcessFileName
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*-version 2*" OR CommandLine="*-version 1*" OR CommandLine="*-Version 2*" OR CommandLine="*-Version 1*")
| rex field=CommandLine "-[Vv]ersion\s+(?<RequestedVersion>\d+)"
| stats count as Count, dc(host) as Devices, values(User) as Users, earliest(_time) as Earliest, latest(_time) as Latest by ParentImage
| sort - CountHunt for direct registry modifications to the SMBv1 server configuration parameter. Monitors the LanmanServer\Parameters\SMB1 value which controls whether SMBv1 is enabled at the server level. Any modification from 0 to 1 indicates SMBv1 was re-enabled.
DeviceRegistryEvents
| where Timestamp > ago(30d)
| where RegistryKey has "LanmanServer\\Parameters" and RegistryValueName == "SMB1"
| project Timestamp, DeviceName, AccountName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 TargetObject="*LanmanServer\\Parameters*SMB1*"
| table _time, host, User, Image, TargetObject, Details
| sort - _timeHunt for PowerShell v2 downgrade sessions that also make outbound network connections to public IPs. This combination strongly indicates an adversary downgraded to v2 to evade Script Block Logging while establishing C2 or downloading additional payloads — the exact pattern used by sophisticated threat actors described in CrowdStrike and Mandiant reporting.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "-version 2"
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemoteIPType == "Public"
) on DeviceName, InitiatingProcessId
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*-version 2*")
| rename ProcessId as target_pid, host as target_host
| join target_pid, target_host [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| rename ProcessId as target_pid, host as target_host
]
| table _time, target_host, User, CommandLine, DestinationIp, DestinationPort
| sort - _timeAtomic Red Team Tests
Invokes PowerShell with the -Version 2 flag to force execution under the legacy v2 engine, which lacks Script Block Logging and AMSI integration. This is a widely-used defense evasion technique documented by CrowdStrike and Mandiant. Requires .NET Framework 2.0/3.5 to be installed for v2 to actually load.
Command
powershell.exe -Version 2 -Command "$PSVersionTable.PSVersion; Write-Host 'PowerShell v2 downgrade test - df00tech'"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-Version 2'. Note: Script Block Logging (Event ID 4104) will NOT capture the executed commands if the v2 engine loaded successfully. Security Event ID 4688 will still show the command line.
Expected Detection
KQL: DeviceProcessEvents matches on FileName=powershell.exe with ProcessCommandLine containing '-version' and DowngradedVersion='2'. SPL: PSDowngrade=1, DetectionType=PowerShell_Downgrade.
Uses the Set-SmbServerConfiguration cmdlet to enable the SMBv1 protocol on the server side. This mirrors the behavior of BlackByte ransomware which enables SMBv1 during execution to leverage legacy SMB vulnerabilities for lateral movement.
Command
powershell.exe -Command "Set-SmbServerConfiguration -EnableSMB1Protocol $true -Force"Cleanup
powershell.exe -Command "Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force"Expected Telemetry
Sysmon Event ID 1: Process Create with CommandLine containing 'Set-SmbServerConfiguration' and 'EnableSMB1Protocol'. Sysmon Event ID 13: Registry Value Set for HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 set to 1. SMBServer Operational Event ID 3000.
Expected Detection
KQL: DeviceProcessEvents matches on ProcessCommandLine containing 'SMB1Protocol' and 'Set-SmbServerConfiguration'. Also triggers DeviceRegistryEvents on LanmanServer\Parameters SMB1 value. SPL: SMBv1Enable=1.
Uses Enable-WindowsOptionalFeature to install and enable the SMBv1 protocol feature at the OS level. This is a more persistent enablement method compared to Set-SmbServerConfiguration, as it installs the SMB1 protocol support feature.
Command
powershell.exe -Command "Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart"Cleanup
powershell.exe -Command "Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart"Expected Telemetry
Sysmon Event ID 1: Process Create with CommandLine containing 'Enable-WindowsOptionalFeature' and 'SMB1Protocol'. DISM operational events may also be generated. The feature state change persists across reboots.
Expected Detection
KQL: DeviceProcessEvents matches on ProcessCommandLine containing 'Enable-WindowsOptionalFeature' and 'SMB1Protocol'. SPL: SMBv1Enable=1, DetectionType=SMBv1_Enable.