Improvement detection on downgrade of powershell

rules/windows/powershell/powershell_downgrade_attack.yml

@@ -10,17 +10,44 @@ tags:
     - attack.t1086
 author: Florian Roth (rule), Lee Holmes (idea)
 date: 2017/03/22
+falsepositives:
+    - Penetration Test
+    - Unknown
+level: medium
+---
 logsource:
     product: windows
     service: powershell-classic
 detection:
     selection:
         EventID: 400
-        EngineVersion: '2.*'
+        EngineVersion: "2.*"
     filter:
-        HostVersion: '2.*'
+        HostVersion: "2.*"
     condition: selection and not filter
-falsepositives:
-    - Penetration Test
-    - Unknown
-level: medium
+---
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection:
+        EventID: 1
+        CommandLine:
+            - "*-v* 2"
+            - "*-V* 2"
+    filter:
+        Image|endswith: '\powershell.exe'
+    condition: selection and filter
+---
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID: 4688
+        CommandLine:
+            - "*-v* 2"
+            - "*-V* 2"
+    filter:
+        Image|endswith: '\powershell.exe'
+    condition: selection and filter