powershell-version-2.0-execution

Hunt Hypothesis

The detection of PowerShell Version 2.0 execution may indicate the presence of legacy scripts or adversarial activity aimed at evading script logging and AMSI. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromises and mitigate the risk of stealthy malware execution.

KQL Query

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has "-v 2"
   or ProcessCommandLine has "-v 2.0"
   or ProcessCommandLine has "-version 2"
   or ProcessCommandLine has "-version 2.0"

Analytic Rule Definition

id: 76e64c0d-b640-4724-8096-4c4cda0ec6e0
name: powershell-version-2.0-execution
description: |
  Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where FileName in~ ("powershell.exe", "powershell_ise.exe")
  | where ProcessCommandLine has "-v 2"
     or ProcessCommandLine has "-v 2.0"
     or ProcessCommandLine has "-version 2"
     or ProcessCommandLine has "-version 2.0"

Required Data Sources

MITRE ATT&CK Context

• Tactic: Execution

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/powershell-version-2.0-execution.yaml)

False Positive Guidance

• Scenario: Scheduled job using PowerShell 2.0 for legacy script compatibility
  Filter/Exclusion: ProcessName != "schtasks.exe" or CommandLine NOT LIKE '*powershell.exe -Command*'

• Scenario: System update or patching task using PowerShell 2.0
  Filter/Exclusion: ProcessName != "wuauclt.exe" or CommandLine NOT LIKE '*powershell.exe -Command*'

• Scenario: Admin task to migrate from PowerShell 2.0 to a newer version
  Filter/Exclusion: User != "Administrator" or CommandLine NOT LIKE '*powershell.exe -Command*'

• Scenario: Legacy script execution via Task Scheduler using PowerShell 2.0
  Filter/Exclusion: ProcessName != "schtasks.exe" or CommandLine NOT LIKE '*powershell.exe -Command*'

• Scenario: PowerShell 2.0 used for compatibility with older software or tools (e.g., legacy reporting tools)
  Filter/Exclusion: ProcessName != "some_legacy_tool.exe" or CommandLine NOT LIKE '*powershell.exe -Command*'