CVE-2018–8212: Device Guard/CLM bypass using MSFT_ScriptResource

This report demonstrates a Constrained Language Mode (CLM) bypass for Device Guard by abusing the Microsoft-signed PowerShell module MSFT_ScriptResource.psm1: its exported Get-TargetResource function creates and invokes a ScriptBlock from the -GetScript parameter, enabling execution of unsigned code in FullLanguage mode; the issue was addressed in CVE-2018-8212.