PowerShell Constrained Language Mode: Unclear handling of dynamic .NET object properties

Answer

CLM does not support a per‑property allow‑list; its list is static per .NET type.

Likely explanation

When a property is added at runtime (e.g., via Add-Member), CLM checks the property name against the static list for the object's base type. Because the name is not present, the check fails and the engine throws a generic security exception.

Confirmed facts

• CLM’s allow‑list is populated from the type’s public members at compile time; it cannot be extended with individual dynamic property names.
• Accessing a non‑listed property raises System.Management.Automation.MethodInvocationException (or AccessDenied) with a message that does not indicate whether the block came from the property, the type, or an AppLocker policy.
• AppLocker’s LanguageSessionMode only selects the overall language mode (ConstrainedLanguage, FullLanguage, NoLanguage); it does not provide a per‑property allow‑list, so it cannot be used to enable only certain dynamic properties.

Steps to verify the behavior

1. Open a PowerShell session and confirm the mode:

   $ExecutionContext.SessionState.LanguageMode

2. Create a .NET object and add a runtime property:

   $obj = [pscustomobject]@{}

   Add-Member -InputObject $obj -NotePropertyName DynamicProp -NotePropertyValue 42

3. Attempt to read the property:

   $obj.DynamicProp

4. Observe the exception; note that the message is generic and does not mention AppLocker.
5. To test AppLocker influence, apply a LanguageSessionMode rule that forces ConstrainedLanguage and repeat steps 2‑4; the exception remains identical.

Recommendation

If the script needs to access runtime‑generated properties while staying in CLM, expose those members through a wrapper object that has them defined at compile time, or relax the language mode to FullLanguage for the session (accepting the broader attack surface).