Lost in Translation: the many language modes of PowerShell
summary
Explains that PowerShell enforces four modes — Full Language Mode, Constrained Language Mode, Restricted and No mode — and shows concrete failures: Cannot invoke method from blocked non‑core .NET types, Add‑Type and PSCustomObject cast failures, and dot‑sourcing being rejected. Describes enforcement via Application Control/WDAC/AppLocker, practical fixes (use Expand‑Archive, Invoke‑RestMethod, rename PS1→PSM1, sign code), tooling (PSRule/agents.md for LLMs, PSScriptAnalyzer constrained‑language rule v1.25+, Pester runspaces) and Azure Artifact Signing.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:47PowerShell language modes
- 3:12Language modes and security
- 5:42Full vs constrained language mode
- 7:48Enforcing constrained language mode
- 11:15Checking constrained language mode
- 12:22Errors in constrained language mode
- 13:04Cannot invoke method errors
- 15:33Dotsourcing and module loading
- 19:11Loading non-core types
- 21:19Add-type restrictions
- 22:41Custom object type issues
- 25:07Type conversion restrictions
- 27:13AI tools for constrained mode
- 31:05AI agent for code compliance
- 35:20Linting with PSScriptAnalyzer
- 37:30Testing in constrained mode
- 40:05Pester tests for constrained mode
- 42:10Signing PowerShell code
- 45:03Best practices for modules
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
49mPowerShell obfuskation Techniques & How To Detect Them
48mStop Writing Insecure PowerShell... Seriously.
57mSecuring PowerShell: Hands-On Lab
27mUsing PowerShell as a Reverse Engineering Tool
20mThe Power of Words: Generating PowerShell Attacks from Natural Language
41mHow Secure Can You Be?
43mMalicious Payloads vs Deep Visibility: A PowerShell Story