Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 992428" data-attributes="member: 32260">I noticed a discussion about Constrained Language Mode (CLM) on the Wilderssecurity forum and some questions.<ol>
<li data-xf-list-type="ol">There are several methods of applying CLM, some of them are PowerShell session dependent and some not.</li>
<li data-xf-list-type="ol">The method used by SRP, Applocker, and MDAC is independent of the PowerShell sessions and does not use the __PSLockDownPolicy. Of course, changing the Language Mode is prevented in the session already running with Constrained Language mode. This is also explained in the article mentioned on Wilderssecurity: 
[URL unfurl=&quot;true&quot;]https://4sysops.com/archives/mitigating-powershell-risks-with-constrained-language-mode/[/URL]</li>
<li data-xf-list-type="ol">When using SRP one can apply CLM to processes running with standard rights and also to high privileged ones. In the H_C Recommended_Settings the first method is used. If one wants H_C to apply CLM and other SRP restrictions also to high privileged processes then it can be done by running H_C with &quot;-p&quot; switch.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 992428, member: 32260"] I noticed a discussion about Constrained Language Mode (CLM) on the Wilderssecurity forum and some questions. [LIST=1] [*]There are several methods of applying CLM, some of them are PowerShell session dependent and some not. [*]The method used by SRP, Applocker, and MDAC is independent of the PowerShell sessions and does not use the [I]__PSLockDownPolicy[/I]. Of course, changing the Language Mode is prevented in the session already running with Constrained Language mode. This is also explained in the article mentioned on Wilderssecurity: [URL unfurl="true"]https://4sysops.com/archives/mitigating-powershell-risks-with-constrained-language-mode/[/URL] [*]When using SRP one can apply CLM to processes running with standard rights and also to high privileged ones. In the H_C Recommended_Settings the first method is used. If one wants H_C to apply CLM and other SRP restrictions also to high privileged processes then it can be done by running H_C with "-p" switch. [/LIST] [/QUOTE]

Verification