PowerShell ConstrainedLanguage Mode Bypass

​Sensors have ingested tradecraft meant to bypass PowerShell ConstrainedLanguage Mode (a security feature) which prevents users from using PowerShell to circumvent or violate UMCI (user mode code integrity). Moreover, this bypass utilizes “System.Management.Automation” which means it will not start powershell.exe. Lastly, this bypass was created by a researcher that is part of the pwncat cluster, which we believe amplifies the social reach of this new bypass.
 
ConstrainedLanguage Bypass: calebstewart/bypass-clm: PowerShell Constrained Language Mode Bypass (github.com)
 
pwncat: calebstewart/pwncat: Fancy reverse and bind shell handler (github.com)
 
ConstrainedLanguage Mode: about_Language_Modes - PowerShell | Microsoft Docs
 
UMCI: Understand WDAC policy rules and file rules (Windows 10) - Windows security | Microsoft Docs
 
#cyberthreatintelligence #infosec #cybersecurity #informationsecurity #threatintelligence #networksecurity #sec #security #tools #offensivesecurity #pentesting #redteam #blueteam