PowerShell launched pinned to the version 2 engine

Siemphony@siemphonyhighT1689unverified

AN0995 names PowerShell version downgrade as its own example, and the version-2 engine is the cleanest single-event observable the strategy offers: it exists specifically to run without Script Block Logging, transcription or AMSI, so a process-creation command line that requests it is unambiguous rather than merely suspicious. PowerShell resolves partial parameter names, so the selection covers every abbreviation of `-Version 2` down to `-ve 2`, alongside `powershell_ise.exe` since the ISE takes the same switch. The single-letter form `-v 2` is deliberately excluded: `-v` is a near-universal short flag for other tools' verbose output, and `-v 2>&1` — verbose plus the extremely common stderr-to-stdout redirect — contains the same substring, so keeping it would have turned this into a rule that fires on redirected verbose output inside almost any `-Command` invocation rather than on a version pin. The registry leg of the same analytic (Defender/HVCI keys via Security 4657) is not authored here: 4657 splits a key and its value across `ObjectName`/`ObjectValueName` rather than the single `TargetObject` the `registry_set` category expects, so it needs a field-mapping decision this rule does not make. The Linux (AN0996) and macOS (AN0997) legs of DET0350 cover a different technique's shape entirely — legacy interpreters and TLS fallback — and are out of scope for a single Windows-only rule. Requires Sysmon to be installed, since process creation is not logged at all without it. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0350, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\powershell_ise.exe") and (ProcessCommandLine contains "-version 2" or ProcessCommandLine contains "-versio 2" or ProcessCommandLine contains "-versi 2" or ProcessCommandLine contains "-vers 2" or ProcessCommandLine contains "-ver 2" or ProcessCommandLine contains "-ve 2"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\powershell_ise.exe") AND (CommandLine="*-version 2*" OR CommandLine="*-versio 2*" OR CommandLine="*-versi 2*" OR CommandLine="*-vers 2*" OR CommandLine="*-ver 2*" OR CommandLine="*-ve 2*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell_ise.exe") AND (TO_LOWER(process.command_line) LIKE "*-version 2*" OR TO_LOWER(process.command_line) LIKE "*-versio 2*" OR TO_LOWER(process.command_line) LIKE "*-versi 2*" OR TO_LOWER(process.command_line) LIKE "*-vers 2*" OR TO_LOWER(process.command_line) LIKE "*-ver 2*" OR TO_LOWER(process.command_line) LIKE "*-ve 2*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\powershell_ise\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-version 2|-versio 2|-versi 2|-vers 2|-ver 2|-ve 2)</field>    <description>PowerShell launched pinned to the version 2 engine</description>    <mitre>      <id>T1689</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: suspicious_powershell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 062c1eb8-13f5-4875-aa2d-9f6f97ebb0e5

ATT&CKT1689

T1689Downgrade Attack

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsuspicious powershell

suspicious powershellAI draft — unreviewed

01 · What this rule detects

powershell.exe or powershell_ise.exe launched with a command line that pins the engine to version 2 — -Version 2 and every partial abbreviation PowerShell's parameter resolver accepts down to -ve 2. AN0995 names this downgrade as its own example: the version-2 engine runs without Script Block Logging, transcription or AMSI, so requesting it is unambiguous rather than merely suspicious, unlike most defense-evasion behaviour.

02 · Telemetry you need

category: process_creation, product: windows, from Sysmon EventID 1 — the description states plainly that this rule needs Sysmon installed, since process creation isn't logged at all without it. The registry leg of the same analytic (Defender/HVCI keys via Security 4657) is not authored here: 4657 splits a key and its value across ObjectName/ObjectValueName rather than the single TargetObject the registry_set category expects, so it needs a field-mapping decision this rule doesn't make. AN0995's Linux and macOS legs (legacy interpreters, TLS fallback) are a different shape entirely and out of scope for a Windows-only rule.

03 · How the logic works

Two selections, ANDed:

The flag list exists because PowerShell resolves partial parameter names, so an adversary (or a stale script) can write any prefix of -Version and still hit the switch. The single-letter form -v 2 was deliberately left out, and this is the rule's most consequential decision. During this review, -v 2 was tested and found to match ... -v 2>&1 — -v is a near-universal short verbose flag, and 2>&1, redirecting stderr to stdout, is one of the most common constructs inside a -Command string. Keeping it would have made this a high-confidence rule that actually fires on ordinary verbose-plus-redirect usage. It was removed and the reasoning folded into the description; the -ve 2 floor was kept because six characters is long enough not to collide with other tools' flags.

04 · Common false positives

Three sources, each named in the falsepositives block: legacy install and configuration scripts written against PowerShell 2.0 behaviour years ago and never updated, still run on hosts that kept the optional PowerShell-2.0 engine feature installed for exactly that reason; detection- engineering and security-tooling validation runs that deliberately invoke the downgrade to confirm rules like this one fire, indistinguishable at the command-line level from a real attempt; and analysts or trainees copy- pasting the -Version 2 example straight out of CrowdStrike's or Google Cloud's own write-ups of this technique while reproducing it in a lab.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0350, never run against a log line. The -v 2>&1 false positive that review caught and removed is proof the rule can misfire in ways that pass a syntax check; nothing here has been checked against real command-line volume.
tier_2: needs that volume check, plus a decision on the colon/equals evasion gap before this leaves scaffold status.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

A remaining gap the reviewer flagged as low severity: every surviving flag entry assumes exactly one space between the switch and 2. Colon or equals-sign syntax (-version:2) or double spacing evades all six. If the target backend renders re acceptably, replace the literal list with a regex allowing flexible whitespace and the colon/equals variants. Beyond that, check whether the legacy PowerShell-2.0 engine feature is even installed fleet-wide — where it isn't, selection_flag matching at all is itself a signal, since the switch fails outright without the feature. Suppress by host for known legacy-script servers rather than lowering level; the description's own reasoning is why high is defensible once -v 2 is out of the picture.

Declared by the author

In-house or ISV install and configuration scripts written years ago against PowerShell 2.0 cmdlet behaviour and never updated, still invoked with an explicit -Version 2 pin on hosts that kept the legacy engine feature installed for exactly that reason.
Security-tooling validation and detection-engineering exercises that deliberately invoke the downgrade to confirm this class of rule fires, indistinguishable at the command-line level from the real technique.
Documentation and training material copy-pasted verbatim, including the -Version 2 example CrowdStrike's and Google Cloud's own write-ups of this exact technique use, run once by an analyst reproducing it in a lab.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1689, evaluated against their process_creation events.

Share this rule

/u/siemphony/062c1eb8-13f5-4875-aa2d-9f6f97ebb0e5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@priya-raman
20 Aug 2026
Excluding the single-letter `-v 2` form is the right call, and it is the kind of thing you only learn by running the rule. We carried the naive version on Splunk for about a year and the top match by volume was `-v 2>&1` inside a monitoring script — verbose plus a stderr redirect, nothing to do with a downgrade. Good that the reasoning is written down rather than left as an unexplained gap in the list.
- @hana-kobayashi
  20 Aug 2026
  One thing worth checking before you treat a hit as high: whether the host still has the v2 engine feature installed at all. On anything built from a modern Server image it usually is not, so the command line is a request that fails and nothing actually runs downgraded. Still a fine intent signal — nobody types it by accident — but the triage note should say so, or an analyst will go looking for a session that never existed.

PowerShell launched pinned to the version 2 engine

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread