Constrained Language Mode Bypass When __PSLockDownPolicy Is Used
ID: 8c1b89a3-8222-5b55-9172-e912bb007f35
STIX ID: report--8c1b89a3-8222-5b55-9172-e912bb007f35
Feed Name: Black Hills Infosec Blog
This article shows that PowerShell Constrained Language Mode, when enabled via the __PSLockdownPolicy environment variable, can be bypassed by executing a script from any path that includes System32, which triggers FullLanguage mode. It advises defenders and testers to validate CLM configurations and rely on proper application control to prevent such bypasses.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.