Question Is "constrained language mode" a security feature or not?

[Parkinsond]

Constrained language mode is not a security feature. The constraint is to match the capabilities that were in Windows S (ARM). It was designed for application developers to test their scripts on x86-64 from r compatibility with Windows S on ARM. Using it as a security feature, you are just hoping some vulnerability affects only the portable portion of the language, but there is no basis for this. Mostly you just make people suffer for no benefit. Windows S doesn't exist anymore and Windows 11 on ARM doesn't use constrained language mode (afaik, will test tomorrow).

Oh, also it's easy for someone to bypass it because it's not a security boundary.

Which types of command-related attacks could be prevented by CLM and which cannot?

 

[Andy Ful]

Here is what Microsoft thinks about this:

PowerShell Constrained Language Mode - PowerShell Team

PowerShell Constrained Language Mode Update (May 17, 2018) In addition to the constraints listed in this article, system wide Constrained Language mode now also disables the ScheduledJob module. The ScheduledJob feature uses Dot Net serialization that is vulnerable to deserialization attacks. So...

devblogs.microsoft.com

The comment in the OP is incorrect and was already discussed on Reddit.
Constrained Language Mode is not a security boundary. However, it considerably increases the security level when combined with Application Control features (SRP, AppLocker, or WDAC).
There are two implementations:

1. Registry tweak (intended probably for debugging/testing):
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\__PSLockdownPolicy
2. Applying SRP, AppLocker, or WDAC.

The first method can be easily bypassed. However, it can be hardened by applying another registry tweak to block PS1 files.
I think that the comment in the OP was related to point 1.

 

[Parkinsond]

Here is what Microsoft thinks about this:

PowerShell Constrained Language Mode - PowerShell Team

PowerShell Constrained Language Mode Update (May 17, 2018) In addition to the constraints listed in this article, system wide Constrained Language mode now also disables the ScheduledJob module. The ScheduledJob feature uses Dot Net serialization that is vulnerable to deserialization attacks. So...

devblogs.microsoft.com

Constrained Language Mode is not a security boundary. However, it considerably increases the security level when combined with Application Control features (SRP, AppLocker, or WDAC).
There are two implementations:

1. Registry tweak (intended probably for debugging/testing):
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\__PSLockdownPolicy
2. Applying SRP, AppLocker, or WDAC.

The first method can be easily bypassed. However, it can be hardened by applying another registry tweak to block PS1 files.
I think that the comment in the OP was related to point 1.

Thank you for thorough explanation.
Does CLM abort all malicious commands executed through PS or can the threat actor formulate the command to avoid CLM limitations?

 

[Andy Ful]

Thank you for thorough explanation.
Does CLM abort all malicious commands executed through PS or can the threat actor formulate the command to avoid CLM limitations?

There are no malicious commands in PowerShell.
CLM blocks some advanced PowerShell features that are mainly abused in attacks. Of course, the attackers can still use PowerShell, but the attack surface is considerably smaller.

 

[Parkinsond]

There are no malicious commands in PowerShell.
CLM blocks some advanced PowerShell features that are mainly abused in attacks. Of course, the attackers can still use PowerShell, but the attack surface is considerably smaller.

Can I say CLM will block all commands to download or decrypt a payload?
And if so, why should I use SRP? Even if a lnk file is going to execute a command to donwload a payload, it will be blocked by CLM.

 

[Sampei.Nihira]

Can I say CLM will block all commands to download or decrypt a payload?
And if so, why should I use SRP? Even if a lnk file is going to execute a command to donwload a payload, it will be blocked by CLM.

As usual, it’s a combination of multiple security measures that work together to strengthen the overall system.
In any case, CLM is very helpful.

Keep in mind that Windows PowerShell 5.x is the most commonly exploited, precisely because it’s always present in the system.
So if you don’t have any specific requirements, it would be best to restrict the use of Windows PowerShell as much as possible.

If you’re interested, I asked the AI a while back what the most practical yet restrictive settings are.
The answer was CLM + “RemoteSigned”.

You can also use “AllSigned” and “Restricted”.

If you want to know your policy applied to PW:

Get-ExecutionPolicy

 

[Parkinsond]

As usual, it’s a combination of multiple security measures that work together to strengthen the overall system.
In any case, CLM is very helpful.

Keep in mind that Windows PowerShell 5.x is the most commonly exploited, precisely because it’s always present in the system.
So if you don’t have any specific requirements, it would be best to restrict the use of Windows PowerShell as much as possible.

If you’re interested, I asked the AI a while back what the most practical yet restrictive settings are.
The answer was CLM + “RemoteSigned”.

You can also use “AllSigned” and “Restricted”.

If you want to know your policy applied to PW:

Get-ExecutionPolicy

So can I rely on CLM and not to use SRP?

 

[Sampei.Nihira]

So can I rely on CLM and not to use SRP?

That's up to you.
Try running a simulation with the free version of ChatGPT based on your needs, so the AI can show you all the possible scenarios.

Of course, make sure to tell it that you've already blocked Windows PW executables (firewall outbound rules) and are using LOLbins in your firewall rules.
Otherwise, there could be some bypass...........

 

[Sampei.Nihira]

P.S.

I don't know if you realized that the example @Andy Ful gave with the Microsoft link,changing from FullLanguage to CLM,is temporary, not permanent.

 

[Parkinsond]

make sure to tell it that you've already blocked Windows PW executables (firewall outbound rules) and are using LOLbins in your firewall rules

I already have all of them blocked by firewall, and this raises another inquiry; does blocking lolbins at the level of firewall is a replacement to CLM?

 

[Parkinsond]

P.S.

I don't know if you realized that the example @Andy Ful gave with the Microsoft link,changing from FullLanguage to CLM,is temporary, not permanent.

Yes, I know; it is established the two methods to apply CLM with being bypassable are AppLocker and WDAC and I tried both manually before.

 

[Sampei.Nihira]

I already have all of them blocked by firewall, and this raises another inquiry; does blocking lolbins at the level of firewall is a replacement to CLM?

It’s always the same answer it helps, but it’s the combination of all these measures that makes life harder for malware.

Think of your PC as a medieval castle with defenses designed to withstand attacks.

The higher the castle is perched, the deeper the moat, and the thicker the walls… the more impenetrable it was.
A single defense or even just a few can be bypassed.

 

[Parkinsond]

It’s always the same answer it helps, but it’s the combination of all these measures that makes life harder for malware.

Think of your PC as a medieval castle with defenses designed to withstand attacks.

The higher the castle is perched, the deeper the moat, and the thicker the walls… the more impenetrable it was.
A single defense or even just a few can be bypassed.

I agree with you regarding the layered pattern of protection; just trying to avoid using two layers if they are providing the exact same protection (redundancy-free layering).

 

[Victor M]

So can I rely on CLM and not to use SRP?

SRP gives you non-executable directories ( \users, \programData ) SRP also allows you to ban executables via rules. CLM gives you limitations of the Powershell language. Two separate things.

avoid using two layers if they are providing the exact same protection (redundancy-free layering).

So, no the two things SRP and CLM arre not the same protection.

Hard_Configurator is a mixture of separate things, it includes SRP, some registry mods that have equivalence in group policy, ConfigureDefender, firewallHardening, It's a mixed bag. Not every feature inside H_C is SRP based.

 

[Parkinsond]

So, no the two things SRP and CLM arre not the same protection.

I know they are not the same; what I am asking about if CLM can abort the attack without SRP even if at a later stage, then I can use CLM alone.

 

[Andy Ful]

Can I say CLM will block all commands to download or decrypt a payload?

Not all, but most of those used in the wild.

And if so, why should I use SRP? Even if a lnk file is going to execute a command to donwload a payload, it will be blocked by CLM.

Look at the first comment.
Furthermore, without using SRP, WDAC, or AppLocker, you must use the __PSLockdownPolicy tweak, which was not intended as a security feature (easily bypassed). However, it can be a part of reasonable security when you also block PS1 files and use SAC. It is not perfect, but it can be efficient at home.

 

[Sampei.Nihira]

I know they are not the same; what I am asking about if CLM can abort the attack without SRP even if at a later stage, then I can use CLM alone.

Logically speaking, I don't think so, but it's best if you ask the AI, as I mentioned in post #9,only you know the exact configuration of your PC.
The AI will present you with possible workarounds, and you can decide what's best for your PC.

Or ask @Bot in this thread.

 

[Andy Ful]

I already have all of them blocked by firewall, and this raises another inquiry; does blocking lolbins at the level of firewall is a replacement to CLM?

It is not.

 

[Parkinsond]

Furthermore, without using SRP, WDAC, or AppLocker, you must use the __PSLockdownPolicy tweak, which was not intended as a security feature (easily bypassed). However, it can be a part of reasonable security when you also block PS1 files and use SAC.

That is what I mean; to use WDAC only without SRP; WDAC will enforce CLM and abort most attacks without the need to SRP.
So I am appealing to add the option to apply CLM by WDAC in WHHL

 

[Parkinsond]

it's best if you ask the AI

The best to ask a human with previous real-life experience; AI is my last resort.