tfMITRE ATT&CK technique

Downgrade Attack T1689

Tactic: Defense Impairment
Platforms: macOS, Windows, Linux
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Arad Inbar, Fidelis Security; Daniel Feichter, @VirtualAllocEx, Infosec Tirol; Mayuresh Dani, Qualys

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Downgrade Attack MITRE reference T1689

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

FrostyGoop IncidentC0041 ↗

During FrostyGoop Incident, the adversary downgraded firmware on victim devices in order to impair visibility into the process environment.1

2024

All 1 campaigns for this technique

Offense vs defense T1689

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1

first rule: 2022 Q1 · 1 of 1 campaigns plotted

Downgrade Attack detection strategy DET0350

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Downgrade Attacks

Enterprise

3 platforms

AN0995 · Windows

Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedInterpreterVersions	Defines which versions of interpreters like PowerShell are permitted in the environment.
RegistryDefenderKeys	Specific registry paths for monitoring Defender/HVCI configurations that may vary by Windows version.

AN0996 · Linux

Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	linux:syslog	Kernel or daemon warnings of downgraded TLS or cryptographic settings
Command ExecutionDC0064	auditd:SYSCALL	execve: Execution of downgraded interpreters such as python2 or forced fallback commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedCryptoProtocols	List of TLS/SSL versions approved for use; alerts triggered if older protocols (e.g., TLS 1.0) are used.

AN0997 · macOS

Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of older or non-standard interpreters
Process MetadataDC0034	macos:unifiedlog	Modifications or writes to EFI system partition for downgraded bootloaders

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedInterpreterVersions	Defines the minimal version of interpreters expected; older versions flagged as downgrade attempts.

Tests3ExecutorsPowerShell 2 · cmd 1Need elevation1 of 3Have prerequisites3Have cleanup0Platformslinux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI

linux

PowerShell

Required

—

An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server

Attack command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
(Get-EsxCli -VMHost #{vm_host} -V2).software.acceptance.set.Invoke(@{level = "CommunitySupported"})
Disconnect-VIServer -Confirm:$false

Prerequisite

Check if VMWARE PowerCLI PowerShell Module is installed.

Check

$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}

Satisfy

Install-Module -Name VMware.PowerCLI -Confirm:$false

GUIDedbb9175-a783-4766-99a8-96ac7f7a4b55

ESXi - Change VIB acceptance level to CommunitySupported via ESXCLI

windows

cmd

—

An adversary will change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria via ESXCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server
cli_script	path	PathToAtomicsFolder\T1698\src\esx_community_supported.txt	Path to script with commands to change acceptance level
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to plink

Attack command

echo "" | "#{plink_file}" "#{vm_host}" -ssh  -l "#{vm_user}" -pw "#{vm_pass}" -m "#{cli_script}"

Prerequisite

Check if plink is available.

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID26ffe420-ab84-45f1-b755-dbe03b5fc565

PowerShell Version 2 Downgrade

windows

PowerShell

—

Executes outdated PowerShell Version 2 which does not support security features like AMSI. By default the atomic will attempt to execute the cmdlet Invoke-Mimikatz whether it exists or not, as this cmdlet will be blocked by AMSI when active.

Input arguments

Name	Type	Default	Description
v2_command	string	Invoke-Mimikatz	Specify the command to execute with Version 2

Attack command

PowerShell -version 2 -command '#{v2_command}'

Prerequisite

Check if Version 2 is installed.

Check

$v2_installed = PowerShell -version 2 -command '$PSVersionTable.PSVersion.Major'
if (-not $v2_installed) {exit 1} else {exit 0}

Satisfy

echo "Manually install PowerShell Version 2"

GUID892ee3d4-d550-41ba-90b2-117181c67377

Tests from Atomic Red Team (MIT licence) · technique definition

Downgrade Attack detections T1689

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs