T1689: Downgrade Attack
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing.[1] For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.[2][3][4]
Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.[5][6] On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.[7]
Analyst context for executives and security teams
Downgrade Attack matters because it turns backward compatibility into a defense-impairment path. Instead of defeating a modern control directly, an adversary may force or use an older interpreter, protocol, boot component, or feature version where logging, encryption, or platform protections are weaker or absent. For leaders, the key question is whether the organization can prove that critical systems are not silently falling back to less secure modes.
Executive priority
Prioritize this as a control-assurance and resilience issue: legacy compatibility can undermine logging evidence, encrypted communications, Secure Boot assumptions, and incident response visibility across Windows, Linux, and macOS environments. Budget and risk decisions should focus on where older versions, insecure protocol fallback, or unnecessary features remain enabled, especially for high-value endpoints, administrative tooling, externally exposed services, and operational environments where cyber-physical disruption would be material. The ATT&CK relationship to the FrostyGoop Incident makes it relevant to organizations assessing cyber-physical risk, but local exposure must be validated.
Technical view
T1689 sits under defense-impairment and covers use of outdated or less secure system features, including older command/scripting interpreters, downgraded network protocols, and vulnerable boot components. SOC and IR teams should validate whether detections can identify execution of legacy PowerShell or other interpreters, loss of expected script logging, HTTP fallback from HTTPS, weak TLS/SSL negotiation patterns, and changes to boot or security-control-related components. ATT&CK provides no official detection text for this technique, but the related DET0350 detection strategy indicates downgrade-specific detection should be considered. Relationships to SILENTTRINITY and BlackByte Ransomware show this behavior is mapped to software in ATT&CK, not that those tools are present in any given environment.
Likely telemetry
- Endpoint process creation and command-line telemetry, especially interpreter version selection such as PowerShell version usage
- PowerShell and script logging evidence, including confirmation that Script Block Logging is enabled and producing events where expected
- Endpoint configuration, software inventory, and version baselines for legacy features, services, and interpreters
- Network proxy, TLS/SSL inspection, web gateway, and flow logs showing protocol negotiation or HTTPS-to-HTTP fallback
- Operating system update, boot manager, Secure Boot, and security control configuration/change logs
Detection direction
- Validate that detections look for unexpected use of older interpreter versions or feature modes, not only known malicious commands.
- Compare expected logging policy to actual telemetry; a sudden absence of Script Block Logging or comparable script content visibility can be as important as a positive alert.
- Monitor protocol downgrade conditions such as encrypted sessions falling back to cleartext or weak legacy protocol behavior, while tuning for approved legacy applications to reduce false positives.
- Baseline boot and update-related components so unauthorized or vulnerable-version reintroduction can be investigated.
- Use relationship context carefully: DET0350 supports a downgrade-focused detection strategy, while software and campaign mappings provide threat context but do not prove local compromise.
Mitigation priorities
- Inventory and remove or disable unnecessary legacy software, features, services, and insecure backward-compatibility modes in line with M1042.
- Harden software configuration per M1054 so supported secure versions, logging, encryption, and security controls are required rather than optional.
- Set and audit configuration baselines for interpreters, network protocols, boot components, and security logging policies.
- Where legacy compatibility is unavoidable, document the exception, restrict exposure, monitor compensating telemetry, and review it as a risk acceptance item.
- Include downgrade scenarios in IR and compliance readiness testing: teams should prove they can detect both malicious use of weaker versions and the disappearance of expected security evidence.
Analyst notes and limits
This technique is newly represented as T1689 in ATT&CK v19.1 and is the successor for the revoked T1562.010 Downgrade Attack object. The strongest defensive value is not a single signature, but assurance that systems cannot silently revert to versions or modes where controls no longer apply.
MITRE did not provide official detection text for this object. Telemetry and control recommendations are derived from the official description, external references, platforms, tactics, and ATT&CK relationships only; each organization must validate relevance against its own software versions, protocol dependencies, logging architecture, and approved legacy exceptions.
Downgrade Attack
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
Adversaries may downgrade and use various less-secure versions of features of a system, such as Command and Scripting Interpreter or even network protocols that can be abused to enable Adversary-in-the-Middle or Network Sniffing.[1] For example, PowerShell versions 5+ includes Script Block Logging (SBL), which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to impair defenses while running malicious scripts that may have otherwise been detected.[2][3][4]
Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.[5][6] On Windows systems, adversaries may downgrade the boot manager to a vulnerable version that bypasses Secure Boot, granting the ability to disable various operating system security mechanisms.[7]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1562.010 | Downgrade Attack Sub-technique | Downgrade Attack revoked by this object. |
Groups, software, and campaigns
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
S1180: BlackByte Ransomware
BlackByte Ransomware is uniquely associated with BlackByte operations. BlackByte Ransomware used a common key for infections, allowing for the creation of a universal decryptor.[1][2] BlackByte Ransomware was replaced in BlackByte operations by BlackByte 2.0 Ransomware by 2023.[3][4]
C0041: FrostyGoop Incident
FrostyGoop Incident took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, FrostyGoop was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | fe08fa21518f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Praetorian TLS Downgrade Attack 2014
Praetorian. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved October 8, 2021.
Open source URL -
[2]
CrowdStrike downgrade attack
Falcon Complete Team. (2021, May 11). Response When Minutes Matter: Rising Up Against Ransomware. Retrieved April 15, 2026.
Open source URL -
[3]
Google Cloud downgrade attack
Nathan Kirk. (2018, June 18). Bring Your Own Land (BYOL) — A Novel Red Teaming Technique. Retrieved April 15, 2026.
Open source URL -
[4]
att_def_ps_logging
Hao, M. (2019, February 27). Attack and Defense Around PowerShell Event Logging. Retrieved November 24, 2021.
Open source URL -
[5]
Targeted SSL Stripping Attacks Are Real
Check Point. (n.d.). Targeted SSL Stripping Attacks Are Real. Retrieved May 24, 2023.
Open source URL -
[6]
CrowdStrike Downgrade attack 2
Bart Lenaerts-Bergmans. (2023, March 13). What are Downgrade Attacks?. Retrieved April 15, 2026.
Open source URL -
[7]
SafeBreach
Alon Leviev. (2024, August 7). Windows Downdate: Downgrade Attacks Using Windows Updates. Retrieved January 8, 2025.
Open source URL -
[8]
mitre-attack T1689Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.