劫机NET为PowerShell辩护
Hijacking .NET to Defend PowerShell
摘要：
随着近几个月来使用PowerShell的攻击的增加，还没有一个全面的监控或预防解决方案。微软最近发布了PowerShell v5的AMSI解决方案，但这也可以被绕过。本文的重点是重新利用各种针对PowerShell攻击实施的隐形运行时.NET劫持技术，以实现对PowerShell的防御性监控。它首先简要介绍了.NET和PowerShell，然后深入解释了各种攻击者技术，从防御者的角度进行了解释，包括汇编修改，类和方法注入，编译器分析和基于C的函数挂钩。在四种攻击者技术中，中间语言二进制修改、JIT挂钩和机器码操作为PowerShell脚本分析的隐形运行时接口提供了最佳结果。
英文摘要：
With the rise of attacks using PowerShell in the recent months, there has not been a comprehensive solution for monitoring or prevention. Microsoft recently released the AMSI solution for PowerShell v5, however this can also be bypassed. This paper focuses on repurposing various stealthy runtime .NET hijacking techniques implemented for PowerShell attacks for defensive monitoring of PowerShell. It begins with a brief introduction to .NET and PowerShell, followed by a deeper explanation of various attacker techniques, which is explained from the perspective of the defender, including assembly modification, class and method injection, compiler profiling, and C based function hooking. Of the four attacker techniques that are repurposed for defensive real-time monitoring of PowerShell execution, intermediate language binary modification, JIT hooking, and machine code manipulation provide the best results for stealthy run-time interfaces for PowerShell scripting analysis.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
