AN0995
Analytic 0995
Windows
Detection of processes launching downgraded PowerShell versions (e.g., v2) or other legacy binaries that lack logging or security features. Correlates command-line arguments, process metadata, and version fields. Monitors registry changes to Defender or HVCI keys that could indicate intentional downgrades.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4657
[AllowedInterpreterVersions]
Defines which versions of interpreters like PowerShell are permitted in the environment.
[RegistryDefenderKeys]
Specific registry paths for monitoring Defender/HVCI configurations that may vary by Windows version.
AN0996
Analytic 0996
Linux
Monitors execution of older or legacy interpreters (e.g., python2, bash with restricted history logging), downgrade of TLS/SSL configurations, or forced fallback to unencrypted protocols. Detects suspicious reconfiguration of kernel modules or boot loaders to reduce integrity controls.
auditd:SYSCALL
execve: Execution of downgraded interpreters such as python2 or forced fallback commands
linux:syslog
Kernel or daemon warnings of downgraded TLS or cryptographic settings
[AllowedCryptoProtocols]
List of TLS/SSL versions approved for use; alerts triggered if older protocols (e.g., TLS 1.0) are used.
AN0997
Analytic 0997
macOS
Detection of execution of legacy scripting runtimes (e.g., older versions of Python, Bash, or PowerShell Core) lacking auditing. Monitoring for changes to EFI or system boot files indicative of downgrade-based persistence or bypass of integrity features.
macos:unifiedlog
Execution of older or non-standard interpreters
macos:unifiedlog
Modifications or writes to EFI system partition for downgraded bootloaders
[ApprovedInterpreterVersions]
Defines the minimal version of interpreters expected; older versions flagged as downgrade attempts.