Interesting.
Nope I doubt it
All known by me methods to apply NoLanguage mode, can be easily bypassed by the malware in the wild.
You will be protected if AppGuard is set to block PowerShell. If not, then PowerShell can for example, run filelessly the script malware.
This setting may be useful to restrict normal users in the business networks.
Because it is normally introduced via PowerShell profile, and can be bypassed by -noprofile switch in PowerShell command. I did not find another way to set this language mode.
That is true in theory and may be the fact in the future.
Bypassing it is not a rocket science because I can do it.
But so far, Constrained Language mode is the most effective security against almost all dangerous PowerShell attacks, including targetted attacks based on pentester tools like Metasploit.
I did not have in mind that I disagree with you.Hey, I'm on your side, but I'm not convinced of the effectiveness of CLM by what I have seen in messing with it. So instead I choose the nuclear option. I know you have that PoC. If you have a PoC - and there are other PoCs - I wonder what some criminal has done. So the probability is that there is already nasty stuff somewhere in the works or out there in the wild. We just ain't heard of or seen it yet.
The only effective way to protect a system against PowerShell attacks - right from Microsoft Security itself - is to disable the shell and system.management.automation.dll at the same time. All paths *powershell*, *powershell_ise* and *system.management.automation*.
Even then, I don't fully trust what Microsoft advises will provide absolute security !!!
MetaSploit, PowerSploit, and such pen-test tools make for really disingenuous videos where the user had to allow something - like macros - in an Office Word document. Plus the video creator does not explain that such attacks are targeted and instead leaves the Average Joe who doesn't know nor understand anything that is happening in the video, to view and arrive all by themselves at all the wrong face-value conclusions and go crazy in their mind. Now some would argue that the video creator is lying by omission to the viewer as well as creating fear, uncertainty and doubt.
It's basically in the same vein as the IT security news that reports things without fully explaining things - the exceptions and caveats - to the general public.
I did not have in mind that I disagree with you.
We totally agree about the potential strength/weakness of CLM.
The best, but also the most radical method is blocking all instances of system.management.automation.dll . Some people do not like such radical methods, and then CLM is for them.
CLM is very effective (more effective than Antivirus), only because of malc0ders' habits and tons of malicious scripts that are still very effective when applying functions that are blocked by CLM.
Additionally, CLM works natively on Windows 8+, so one has to update the PowerShell to the version 3.0 on Windows 7 (most users still use PowerShell 2.0).
I analyzed many PowerShell scripts embedded in malicious documents from Malware Vault (Samples) + many scripts scattered on several websites, and 99% of them uses advanced PowerShell functions blocked by CLM. Some de-obfuscated examples are here:
How-to Guide - How to de-obfuscate PowerShell script commands (Examples).
They are very effective because almost nobody uses CLM. It is possible that malc0ders do not bother to fight CLM (so far), because the users who use CLM are probably experienced and this would shorten the malware life.
That is why I wrote in my previous post that in theory, your statement is true:
Malc0ders do not need the stuff that Constrained Language Mode disables to completely smash a system.
If the malc0ders will change their habits or when the scripts will not be so effective, then your statement will be true in the wild. That will probably happen in the future if Microsoft will abandon this feature.
