Option 11 — Disabled Enforcement#

flowchart TD
    subgraph UserSpace["User-Space Execution Layer"]
        direction TB
        PE([PE / EXE / DLL Execution\npowershell.exe, wscript.exe binaries])
        Script([Script Content Execution\n.ps1, .vbs, .js, .hta, .wsf files])
    end

    subgraph CILayer["Code Integrity Enforcement Layer"]
        direction TB
        PECheck{App Control\nPE enforcement}
        ScriptCheck{App Control\nScript enforcement}
        CLM{PowerShell\nConstrained Language Mode}
        AMSIHook{AMSI Integration\nScript scanning}
    end

    subgraph Option11["Option 11 Effect"]
        direction TB
        Bypass([Script enforcement\nBYPASSED])
        CLMBypass([PowerShell CLM\nNOT enforced by CI])
    end

    PE --> PECheck
    PECheck -->|"Always enforced\nregardless of Option 11"| PEResult([PE allowed / blocked])
    Script --> ScriptCheck
    ScriptCheck -->|Option 11 ABSENT\n default| CLM
    ScriptCheck -->|"Option 11 PRESENT\nscript check skipped"| Bypass
    CLM --> AMSIHook
    AMSIHook --> ScriptResult([Script allowed\nin Full Language Mode])
    Bypass --> CLMBypass
    CLMBypass --> FreeScript([Script executes\nwithout CI restriction])

    style PE fill:#162032,color:#58a6ff
    style Script fill:#162032,color:#58a6ff
    style PECheck fill:#1a1a0d,color:#fde68a
    style ScriptCheck fill:#1a1a0d,color:#fde68a
    style CLM fill:#162032,color:#58a6ff
    style AMSIHook fill:#162032,color:#58a6ff
    style PEResult fill:#0d1f12,color:#86efac
    style ScriptResult fill:#0d1f12,color:#86efac
    style Bypass fill:#1f0d0d,color:#fca5a5
    style CLMBypass fill:#1f0d0d,color:#fca5a5
    style FreeScript fill:#1f0d0d,color:#fca5a5
    style Option11 fill:#1f0d0d,color:#fca5a5

flowchart LR
    subgraph ScriptEnforcementScope["Script Enforcement Ecosystem"]
        O11([Option 11\nDisabled:Script Enforcement])
        PSExecution([PowerShell\nLanguage Mode])
        AMSI([AMSI\nAntimalware Scan Interface])
        CLM([Constrained Language Mode\nCLM])
        ASR([Attack Surface Reduction\nASR Rules])
    end

    O11 -->|"Disables CI-driven\nlanguage mode enforcement"| CLM
    O11 -->|"Does NOT disable\nAMSI scanning"| AMSI
    O11 -->|"Does NOT affect\nASR blocking"| ASR
    CLM -->|"Without Option 11:\nactivated by CI policy"| PSExecution
    AMSI -->|"Continues scanning\nscript content for malware"| PSExecution

    O3([Option 3\nAudit Mode]) -.->|"Script hosts may behave\ndifferently even in audit mode\nwhen Option 11 is absent"| O11

    style O11 fill:#1f0d0d,color:#fca5a5
    style PSExecution fill:#162032,color:#58a6ff
    style AMSI fill:#0d1f12,color:#86efac
    style CLM fill:#1a1a0d,color:#fde68a
    style ASR fill:#1c1c2e,color:#a5b4fc
    style O3 fill:#1a1a0d,color:#fde68a

flowchart TD
    Start([Configuring script policy]) --> Q1{Does your environment\nuse legacy unsigned\nVBScript or JScript?}
    Q1 -- Yes --> Q2{Can those scripts be\nsigned in reasonable\ntimeframe?}
    Q1 -- No --> Q3{Do you use mshta.exe\nHTA applications?}
    Q2 -- Yes --> Sign([Sign the scripts\nDo NOT set Option 11])
    Q2 -- No --> Transition([Set Option 11 temporarily\nPlan to sign or migrate scripts])
    Q3 -- Yes --> Q4{Can HTAs be\nreplaced with\nmodern alternatives?}
    Q3 -- No --> Q5{Is PowerShell CLM\nbreaking your automation?}
    Q4 -- Yes --> Migrate([Migrate away from HTA\nDo NOT set Option 11])
    Q4 -- No --> SetO11([Set Option 11\nDocument as exception])
    Q5 -- Yes --> Q6{Can scripts be\ncatalog-signed?}
    Q5 -- No --> Enforce([Do not set Option 11\nFull script enforcement])
    Q6 -- Yes --> CatalogSign([Use catalog signing\nDo NOT set Option 11])
    Q6 -- No --> SetO11_2([Set Option 11 temporarily\nDocument risk])

    style Start fill:#162032,color:#58a6ff
    style Q1 fill:#1a1a0d,color:#fde68a
    style Q2 fill:#1a1a0d,color:#fde68a
    style Q3 fill:#1a1a0d,color:#fde68a
    style Q4 fill:#1a1a0d,color:#fde68a
    style Q5 fill:#1a1a0d,color:#fde68a
    style Q6 fill:#1a1a0d,color:#fde68a
    style Sign fill:#0d1f12,color:#86efac
    style Transition fill:#1a1a0d,color:#fde68a
    style Migrate fill:#0d1f12,color:#86efac
    style SetO11 fill:#1f0d0d,color:#fca5a5
    style Enforce fill:#0d1f12,color:#86efac
    style CatalogSign fill:#0d1f12,color:#86efac
    style SetO11_2 fill:#1f0d0d,color:#fca5a5

sequenceDiagram
    actor Admin as IT Administrator
    actor SOC as SOC Analyst
    participant MDM as Intune / SCCM
    participant Server as Windows Server
    participant CI as Code Integrity
    participant PS as PowerShell Engine
    participant AMSI as AMSI / Defender
    participant Log as Event Log

    Admin->>MDM: Deploy App Control policy with Option 11 set
    MDM->>Server: Push policy binary (PE enforcement active, script enforcement OFF)

    Note over Server: Daily automation job runs
    Server->>CI: wscript.exe attempts to run legacy.vbs
    CI->>CI: Check if wscript.exe binary is allowed (PE check)
    CI-->>Server: wscript.exe allowed (matches Windows signer)
    CI->>CI: Option 11 set → skip script content check
    Server->>AMSI: AMSI scans legacy.vbs content
    AMSI-->>Server: Script content clean (no malware signatures)
    Server->>Server: legacy.vbs executes successfully

    Note over Server: Attacker tries PowerShell-based LOLBin attack
    Server->>CI: powershell.exe launches (PE check passes — it's a Windows binary)
    CI->>CI: Option 11 set → CLM NOT enforced
    Server->>PS: PowerShell runs in Full Language Mode
    PS->>AMSI: AMSI still scans malicious script block
    AMSI-->>PS: Malicious pattern detected → block execution
    AMSI->>Log: Write AMSI detection event
    Log->>SOC: Alert forwarded to SIEM
    SOC->>Admin: Recommend removing Option 11 once scripts are migrated

    Admin->>Admin: Begin script signing project
    Admin->>MDM: After signing complete: remove Option 11 from policy
    MDM->>Server: Updated policy deployed
    Note over Server: Full script enforcement now active