t1562-010-downgrade-attack

name	T1562.010_downgrade-attack
description	Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1562.010","defense-evasion","windows","linux","macos","sub-technique"]
technique_id	T1562.010
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows","Linux","macOS"]
mitre_url	https://attack.mitre.org/techniques/T1562/010
tech_stack	["windows","linux","macos"]
cwe_ids	["CWE-693"]
chains_with	["T1562","T1562.001","T1562.002","T1562.003","T1562.004","T1562.006","T1562.007","T1562.008","T1562.009","T1562.011","T1562.012","T1562.013"]
prerequisites	["T1562"]
severity_boost	{"T1562":"Chain with T1562 for deeper attack path","T1562.001":"Chain with T1562.001 for deeper attack path","T1562.002":"Chain with T1562.002 for deeper attack path"}

T1562.010 Downgrade Attack

Sub-technique of: T1562

High-Level Description

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.

Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreters or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing. For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to Impair Defenses while running malicious scripts that may have otherwise been detected.

Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text. On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows, Linux, macOS

What to Check

• Identify if Downgrade Attack technique is applicable to target environment
• Check Windows systems for indicators of Downgrade Attack
• Check Linux systems for indicators of Downgrade Attack
• Check macOS systems for indicators of Downgrade Attack
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: ESXi - Change VIB acceptance level to CommunitySupported via PowerCLI

An adversary can change the VIB acceptance level to CommunitySupported to downgrade the acceptance criteria.This can be accomplished via PowerCLI. Afterwards an adversary may proceed to installing malicious VIBs on the host. Reference