Skip to content

T1562.010 Downgrade Attack

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.

Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreters or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing.10 For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to Impair Defenses while running malicious scripts that may have otherwise been detected.475

Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.32 On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.1

Item Value
ID T1562.010
Sub-techniques T1562.001, T1562.002, T1562.003, T1562.004, T1562.006, T1562.007, T1562.008, T1562.009, T1562.010, T1562.011, T1562.012, T1562.013
Tactics TA0005
Platforms Linux, Windows, macOS
Version 1.3
Created 08 October 2021
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1180 BlackByte Ransomware BlackByte Ransomware enables SMBv1 during execution.13
C0041 FrostyGoop Incident During FrostyGoop Incident, the adversary downgraded firmware on victim devices in order to impair visibility into the process environment.14
S0692 SILENTTRINITY SILENTTRINITY can downgrade NTLM to capture NTLM hashes.12

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Consider removing previous versions of tools that are unnecessary to the environment when possible.
M1054 Software Configuration Consider implementing policies on internal web servers, such HTTP Strict Transport Security, that enforce the use of HTTPS/network traffic encryption to prevent insecure connections.11

References

  1. Alon Leviev. (2024, August 7). Windows Downdate: Downgrade Attacks Using Windows Updates. Retrieved January 8, 2025. ↩

  2. Bart Lenaerts-Bergman. (2023, March 14). WHAT ARE DOWNGRADE ATTACKS?. Retrieved May 24, 2023. ↩

  3. Check Point. (n.d.). Targeted SSL Stripping Attacks Are Real. Retrieved May 24, 2023. ↩

  4. Falcon Complete Team. (2021, May 11). Response When Minutes Matter: Rising Up Against Ransomware. Retrieved October 8, 2021. ↩

  5. Hao, M. (2019, February 27). Attack and Defense Around PowerShell Event Logging. Retrieved November 24, 2021. ↩

  6. Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021. ↩

  7. Kirk, N. (2018, June 18). Bring Your Own Land (BYOL) – A Novel Red Teaming Technique. Retrieved October 8, 2021. ↩

  8. Martin Smolár. (2023, March 1). BlackLotus UEFI bootkit: Myth confirmed. Retrieved February 11, 2025. ↩

  9. Microsoft Incident Response. (2023, April 11). Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign. Retrieved February 12, 2025. ↩

  10. Praetorian. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved October 8, 2021. ↩

  11. Chromium. (n.d.). HTTP Strict Transport Security. Retrieved May 24, 2023. ↩

  12. byt3bl33d3r. (n.d.). SILENTTRINITY. Retrieved September 12, 2024. ↩

  13. Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024. ↩

  14. Mark Graham, Carolyn Ahlers, Kyle O’Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024. ↩