Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. 

Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike BGH Ransomware 2021)(Citation: Mandiant BYOL 2018)(Citation: att_def_ps_logging)

Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade)
Downgrade Attack
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1562/010  external_id: T1562.010     source_name: Crowdstrike Downgrade  description: Bart Lenaerts-Bergman. (2023, March 14). WHAT ARE DOWNGRADE ATTACKS?. Retrieved May 24, 2023.  url: https://www.crowdstrike.com/cybersecurity-101/attack-types/downgrade-attacks/     source_name: Targeted SSL Stripping Attacks Are Real  description: Check Point. (n.d.). Targeted SSL Stripping Attacks Are Real. Retrieved May 24, 2023.  url: https://blog.checkpoint.com/research/targeted-ssl-stripping-attacks-are-real/amp/     source_name: CrowdStrike BGH Ransomware 2021  description: Falcon Complete Team. (2021, May 11). Response When Minutes Matter: Rising Up Against Ransomware. Retrieved October 8, 2021.  url: https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/     source_name: att_def_ps_logging  description: Hao, M. (2019, February 27). Attack and Defense Around PowerShell Event Logging. Retrieved November 24, 2021.  url: https://nsfocusglobal.com/attack-and-defense-around-powershell-event-logging/     source_name: inv_ps_attacks  description: Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021.  url: https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/     source_name: Mandiant BYOL 2018  description: Kirk, N. (2018, June 18). Bring Your Own Land (BYOL) – A Novel Red Teaming Technique. Retrieved October 8, 2021.  url: https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique     source_name: Praetorian TLS Downgrade Attack 2014  description: Praetorian. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved October 8, 2021.  url: https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/     