Constrained Language Mode Bypass

PowerShell is signed, present on every modern Windows box, and hands whoever runs it a full .NET runtime for free. That combination is why it is the single most abused post-exploitation tool on the platform, and why Microsoft built Constrained Language Mode (CLM) to take that runtime away. When CLM is in force, an attacker can still start PowerShell, but the dangerous parts of .NET, COM, and the Win32 API are off the table.

The Sandworm group is a good example of why this control exists. MITRE documents them running a credential-harvesting tool in memory through PowerShell specifically to evade defenses (MITRE ATT&CK T1059.001 (opens in new tab)). That is exactly the kind of in-memory execution CLM is designed to break. Public reporting rarely ties a named actor to a specific CLM bypass, so treat Sandworm as the reason PowerShell hardening matters, not as an attribution for the techniques you are about to run.

This room is about the attacker's attempt to escape CLM and the trace each attempt leaves on the host. You'll regain a FullLanguage runspace three different ways, and after each one you'll look at what a defender watching the same host would see.

Learning Objectives

• Explain the four PowerShell language modes and identify what ConstrainedLanguage removes from an attacker's toolkit.
• Distinguish AppLocker heuristic enforcement from WDAC kernel enforcement, and predict which bypasses are plausible against each.
• Host a FullLanguage runspace through a trusted .NET binary to run code that CLM blocks.
• Beat a really enforced AppLocker deployment by abusing a writable trusted path, and explain why a kernel-enforced path (WDAC) shuts the same techniques down.
• Perform a reflection-based language-mode flip and an AMSI blind, and recognize the telemetry each step generates.
• Map each bypass to its host-based detection artifacts across Sysmon, PowerShell logging, and Microsoft Defender.

Prerequisites

• Comfort with PowerShell scripting and .NET basics such as types, reflection, and Add-Type.
• A working mental model of how Windows processes host and launch each other.
• Familiarity with reading Windows event logs through Event Viewer or Get-WinEvent.

You already have constrained PowerShell execution on the host when the room begins. How that access was obtained is out of scope, and so is anything you'd do after regaining FullLanguage. Regaining full PowerShell is the objective.

Start the machine by clicking the Start Machine button below. Give it about three minutes to boot, then connect over RDP or the browser console.