Every security feature that kept an old version for compatibility left a door open: an attacker who can force a host back to PowerShell 2.0, SMBv1, NTLMv1, an old TLS version or an older boot manager gets the weaker behaviour without breaking anything that would raise an alarm. MITRE ATT&CK v20 tracks this as T1689 Downgrade Attack under the Defense Impairment tactic (TA0112), on Windows, Linux and macOS, formerly a sub-technique of Impair Defenses. This page maps the downgrade paths that matter in an enterprise, the cases ATT&CK records, the events that show a downgrade happening, the two v20 mitigations and the platform changes that now remove legacy versions for you, and how to test. It is written for detection engineers, Windows and Linux platform owners and network teams. Authentication downgrades such as forcing a user onto a weaker MFA method are a related identity problem covered in the MFA Fatigue and Bypass Guide; this page stays on the ATT&CK technique view.
Key takeaways
- Removal beats detection. ATT&CK's M1042 advises removing previous versions of tools that are not needed; a legacy component that is not installed cannot be downgraded to.
- PowerShell 2.0 is the classic case and is now being removed. Microsoft is removing it from Windows 11 version 24H2 (from August 2025) and Windows Server 2025 (September 2025); older estates still need to remove it themselves.
- Ransomware re-enables SMBv1. ATT&CK records BlackByte enabling SMBv1 during execution and The Gentlemen ransomware re-enabling it with a Windows optional feature command (Check Point, April 2026).
- Protocol downgrades are blocked by configuration, not alerts. HSTS (the v20 M1054 example), TLS 1.2 or later only, NTLMv2-only and SMB signing remove the weaker modes an attacker in the middle would need.
- Boot component rollback is real. SafeBreach's Windows Downdate research (August 2024) showed admin-level rollback of VBS and Secure Kernel files; Microsoft's KB5042562 describes the revocation policy that blocks it.
What T1689 covers
ATT&CK describes downgrade attacks as using a system's backward compatibility to force it into less secure modes, running outdated or vulnerable versions of features that do not support current security controls. It gives three examples: running an older PowerShell version without script block logging so malicious scripts escape detection; downgrading network traffic from HTTPS to HTTP so data is exposed in clear text, which enables Adversary-in-the-Middle (T1557) and Network Sniffing (T1040); and downgrading the Windows boot manager to a vulnerable version that bypasses Secure Boot. T1689 has no sub-techniques in v20. A related technique, T1600 Weaken Encryption, covers weakening cryptography on network devices and has its own page.
| Downgrade path | What the attacker gains | Prerequisite | Primary fix |
|---|---|---|---|
| PowerShell 5.1 to 2.0 engine | No script block logging and no AMSI scanning for the session | PowerShell 2.0 feature and .NET Framework 3.5 present | Remove the PowerShell 2.0 feature |
| SMBv2/3 to SMBv1 | Exposure to legacy SMBv1 flaws and the weaker protections of the original protocol, which helps spreading | Admin rights to re-enable the feature, or SMBv1 still installed | Remove SMBv1 and alert on its reinstallation |
| NTLMv2 or Kerberos to NTLMv1 | Challenge responses that are far easier to crack or relay | Hosts that still accept or send NTLMv1 | NTLMv2 only (refuse LM and NTLM), then reduce NTLM |
| TLS 1.2/1.3 to older TLS or plaintext HTTP | Readable or modifiable traffic for an adversary in the middle | Network position plus a server or client that still accepts the weaker mode | TLS 1.2 or later only; HSTS |
| Current to older boot manager or VBS files | Bypass of Secure Boot or VBS protections | Administrator rights on the host | Revocation policies and current Secure Boot revocations |
| Current to older device firmware | Loss of logging or security features in the device | Write access to the device | Signed firmware with anti-rollback where the vendor offers it |
Real cases
| Actor, software or source | What was recorded | Detection lesson |
|---|---|---|
| The Gentlemen Ransomware (S9051), Check Point Research, April 2026 | Re-enabled SMB1 with Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart | Any command enabling SMB1Protocol on a modern host is an incident |
| BlackByte Ransomware (S1180), Trustwave 2021 | Enables SMBv1 during execution | Ransomware wants the legacy protocol for spreading; see the BlackByte Ransomware Profile Guide |
| SILENTTRINITY (S0692) | Can downgrade NTLM to capture NTLM hashes | NTLMv1 in authentication logs is a red flag once it has been retired |
| FrostyGoop Incident (C0041), Dragos 2024 | The adversary downgraded firmware on victim devices to impair visibility into the process environment | Operational technology devices need firmware version monitoring too |
| ATT&CK technique description (citing CrowdStrike and Google Cloud research) | Adversaries running a previous PowerShell version that does not support script block logging, to run scripts that would otherwise be detected | Watch for the version 2 engine starting, not only for suspicious script content |
| Windows Downdate, SafeBreach Labs, August 2024 | Research showing Windows Update could be used to roll back Credential Guard's isolated process, the Secure Kernel and Hyper-V components; Microsoft issued CVE-2024-21302 and CVE-2024-38202 | A fully patched host can be made vulnerable again by an administrator; file version drift is a signal |
What to detect and where
ATT&CK v20 detection strategy DET0350 has three analytics: Windows (AN0995) watches processes launching downgraded PowerShell or other legacy binaries, correlating command lines and version fields, and registry changes to Defender or HVCI keys; Linux (AN0996) watches older interpreters, TLS or crypto configuration downgrades and boot or kernel module changes; macOS (AN0997) watches legacy scripting runtimes and writes to the EFI system partition.
| Downgrade | Signal | Source |
|---|---|---|
| PowerShell 2.0 | powershell.exe with -version 2 (or -v 2) on the command line; Windows PowerShell log event 400 showing EngineVersion 2.0 | Security 4688 or Sysmon 1; Windows PowerShell classic log |
| SMBv1 re-enabled | Enable-WindowsOptionalFeature or DISM enabling SMB1Protocol; registry or service changes for the SMB1 driver | 4688, PowerShell 4104, Sysmon 13 |
| SMBv1 in use | Client event 32002 (SMB1 negotiate response received) in Microsoft-Windows-SmbClient/Security | Windows client logs; network sensors seeing SMB1 dialects |
| NTLMv1 | Successful logons whose authentication package is NTLM V1; changes to LmCompatibilityLevel | Security 4624 on servers and domain controllers; Sysmon 13 or 4657 |
| TLS downgrade or HTTP fallback | Sessions negotiating TLS 1.0 or 1.1, or clear-text HTTP to services that should be HTTPS only | TLS-aware proxies, load balancers, Zeek ssl.log, server logs |
| Boot or VBS file rollback | File version of boot manager, Secure Kernel or VBS components lower than the patched baseline; changes to HVCI and Defender registry keys | EDR file inventory, Sysmon 13 or 4657, Device Health Attestation or equivalent |
| Legacy interpreters on Linux and macOS | python2 or other deprecated runtimes executing on hosts where they should be absent; writes to the EFI system partition | auditd execve; unified log |
NHI Mgmt Group recommendation: once a legacy component is removed, its use becomes high-confidence. Pair every removal project with a detection that fires if the component comes back or is used, because that is exactly what BlackByte and The Gentlemen did.
Mitigations and removal programme
| Mitigation | ATT&CK v20 guidance | Practical application |
|---|---|---|
| M1042 Disable or Remove Feature or Program | Consider removing previous versions of tools that are unnecessary to the environment | Remove PowerShell 2.0, SMBv1, legacy interpreters and old runtimes; block their reinstallation through configuration management |
| M1054 Software Configuration | Consider policies on internal web servers, such as HTTP Strict Transport Security, that enforce HTTPS and prevent insecure connections | HSTS on internal and external web services; TLS 1.2 or later only; NTLMv2 only; SMB signing |
Platform facts to plan around
- PowerShell 2.0: Microsoft states it was introduced with Windows 7, deprecated in 2017, and is being removed from Windows 11 version 24H2 (in a release starting August 2025) and Windows Server 2025 (September 2025). Scripts that request version 2 then start PowerShell 5.1 instead; a few older installers may fail. Older Windows versions still need the feature removed by policy. See the PowerShell Security Guide.
- SMBv1: Microsoft documents that SMBv1 is not installed by default from Windows 10 and Windows Server version 1709, and clean installs of Windows 11 and Windows Server 2019 or later have no SMBv1 client or server, but it can still be reinstalled on Windows 10 and Server 2016. See the SMB Protocol Security and Signing Guide.
- TLS: RFC 8996 (BCP 195, March 2021) states that TLS 1.0 and 1.1 must not be used and must not be negotiated. It also notes that TLS 1.3 detects downgrades with sentinel values in the ServerHello random field. See the TLS Server Configuration Baseline Guide and HSTS and HSTS Preload.
- NTLM: set NTLMv2-only behaviour and reduce NTLM use overall. See the NTLM Deprecation and Elimination Guide.
- VBS rollback: Microsoft's KB5042562 describes an opt-in revocation policy (SkuSiPolicy.p7b) that blocks un-updated VBS files and writes a UEFI lock. Microsoft warns that the lock survives uninstalling updates or reformatting, that recovery media, WinRE and PXE boot images must be updated first, and that BitLocker recovery keys should be backed up. Pilot it carefully. See the Secure Boot Certificate Expiry 2026 guide for the related Secure Boot changes.
Where identity fits
Several downgrade paths are really credential attacks. NTLM downgrade exists to capture hashes; SMB and TLS downgrades expose session tokens, API keys and service account credentials on the wire; and the Windows Downdate research targeted Credential Guard, which protects stored domain credentials. Legacy protocols often survive because a service account, a scheduled task or an old integration still uses them. NHI Mgmt Group recommendation: when you find NTLMv1, SMBv1 or old TLS in use, trace it to the account or application responsible, fix or replace that integration, and rotate its credentials, since they may have been exposed in a weaker form. See the NTLM Relay Guide.
How to roll it out
- Inventory use: enable SMB1 client auditing (event 32002), NTLM auditing, TLS version logging on proxies and load balancers, and collect PowerShell engine version events for 30 days.
- Find the owners: map each remaining use to an application and account; agree a fix or a documented exception with an end date.
- Remove in rings: pilot removal of PowerShell 2.0 and SMBv1 on IT workstations, then wider user rings, then servers; disable TLS 1.0 and 1.1 on internal services after the logs show no use.
- Lock the configuration: enforce the removed state through Group Policy, Intune or configuration management so drift is corrected.
- Turn on the detections: alert on reinstallation or any use of the removed component.
- Roll back if needed: each change is reversible by policy for an exception group; record the exception and owner rather than reverting the whole estate.
How to test
- PowerShell: on a lab host that still has the feature, start the version 2 engine and confirm the 4688 command line and event 400 alerts fire; on a remediated host, confirm the request starts 5.1.
- SMBv1: in a lab, run the optional feature command to enable SMB1Protocol and confirm the alert, then remove it again.
- TLS: use an authorised scanner against internal services to confirm TLS 1.0 and 1.1 are refused and HSTS headers are present.
- NTLM: attempt an NTLMv1 authentication from a lab client configured for it and confirm the domain controller refuses it and logs the attempt.
- Boot components: compare boot manager and VBS file versions on a sample of hosts against the patched baseline each month.
Measuring coverage
- Legacy footprint: number of hosts with PowerShell 2.0 or SMBv1 installed (target: zero, with dated exceptions).
- Legacy use: NTLMv1 logons, SMB1 sessions and TLS 1.0 or 1.1 handshakes per week, trending to zero.
- HSTS coverage: percentage of internal web services sending HSTS.
- Reinstallation alerts: count and time to triage for any legacy component re-enabled.
- Baseline drift: hosts with boot or VBS component versions below the patched baseline.
Common failure patterns
- Disabling instead of removing: a disabled feature can be re-enabled by anyone with admin rights in one command.
- Removing without detecting: without an alert on reinstallation, ransomware that re-enables SMBv1 goes unnoticed.
- Script logging without engine control: script block logging is configured carefully but the version 2 engine remains available to bypass it.
- Exceptions without end dates: one old integration keeps NTLMv1 or TLS 1.0 alive for the whole domain or service for years.
- Deploying boot revocations without updating recovery media: Microsoft warns that devices may then fail to boot from older media.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1689 Downgrade Attack (TA0112 Defense Impairment); formerly a sub-technique of Impair Defenses; related T1557, T1040, T1059.001, T1600 | Technique, procedures and DET0350 |
| MITRE ATT&CK v20 mitigations | M1042 Disable or Remove Feature or Program; M1054 Software Configuration | Official mitigations |
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality; CM-6 Configuration Settings | Removing legacy components and enforcing secure settings |
| NIST SP 800-53 Rev 5 | SC-8 Transmission Confidentiality and Integrity; SC-13 Cryptographic Protection | TLS versions, HSTS and protocol hardening |
| NIST SP 800-53 Rev 5 | SI-7 Software, Firmware, and Information Integrity | Detecting rolled-back boot, VBS and firmware components |
| NIST CSF 2.0 | PR.PS-01; PR.PS-02; DE.CM-09 | Configuration management, software maintenance and monitoring |
| IETF | RFC 8996 (BCP 195); RFC 6797 (HSTS) | Protocol version and HTTPS enforcement |
For the tactic overview, see the ATT&CK Stealth and Defense Impairment Tactics Guide; for mitigations in depth, the ATT&CK Mitigations hub.
Related Defense Impairment techniques, each with its own page: MITRE ATT&CK T1688 Safe Mode Boot, MITRE ATT&CK T1686 Disable or Modify System Firewall.
Practitioner checklist
- Retag detection content from the former Impair Defenses sub-technique ID to T1689.
- Remove the PowerShell 2.0 feature on every Windows version that still has it.
- Remove SMBv1 and alert on any command or policy that re-enables it.
- Audit NTLM, then enforce NTLMv2 only and alert on NTLMv1 logons.
- Refuse TLS 1.0 and 1.1 on internal and external services and send HSTS.
- Alert on powershell.exe started with -version 2.
- Pilot Microsoft's VBS rollback revocation policy after updating recovery and PXE media.
- Track boot, VBS and device firmware versions against the patched baseline.
- Trace every legacy protocol use to an owner and account, and rotate its credentials.
- Give every exception an owner and end date.
Standards and references
- MITRE ATT&CK: T1689 Downgrade Attack
- MITRE ATT&CK: DET0350 Detecting Downgrade Attacks
- Microsoft Support: PowerShell 2.0 removal from Windows
- Microsoft Learn: SMBv1 is not installed by default in Windows
- Microsoft Support: KB5042562 Guidance for blocking rollback of VBS related security updates
- IETF: RFC 8996 Deprecating TLS 1.0 and TLS 1.1
- SafeBreach Labs: Windows Downdate, downgrade attacks using Windows Updates
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Historic TLS Attacks Guide · MITRE ATT&CK T1557 Adversary-in-the-Middle · T1059 Command and Scripting Interpreter Defensive Guide · Defence Evasion Techniques Guide · MFA Fatigue and Bypass Guide