How does PowerShell change when application control is enforced?
When application control is enforced, PowerShell acts as a safeguard to prevent the misuse of its features by potential adversaries. By proactively implementing application control measures, PowerShell ensures that its powerful scripting language cannot be easily abused by attackers to bypass imposed restrictions.
PowerShell can be restricted in several ways, including disabling the ability to run PowerShell scripts or only allowing signed PowerShell scripts to run.
In Chapter 5, PowerShell Is Powerful – System and API Access, we discussed how it is possible to use PowerShell to run arbitrary .NET code or even execute compiled code if the system is not restricted. This can make it very difficult to protect against malicious code. With application control enforced, it’s possible to eliminate unconstrained code execution methods such as Add-Type, arbitrary .NET scripting, and other options that are typically...
