PowerShell CLM Bypass

PowerShell Constrained Language Mode restricts language features, commands, and access to .NET and COM APIs. Under AppLocker or App Control for Business, handling of untrusted scripts depends on the policy and PowerShell version: they may run in ConstrainedLanguage or be blocked. System Lockdown with App Control is required to ensure CLM cannot be bypassed. The three examples currently stored here are separate generic download, script-evaluation, and assembly-loading actions. Only the Invoke-WebRequest step uses a Windows-module cmdlet that still works in ConstrainedLanguage; the other two actions are themselves blocked by CLM, because Invoke-Expression runs its supplied script block in ConstrainedLanguage and Reflection.Assembly is not a permitted type. None of the three demonstrates a CLM or application-control bypass.