Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Hijacking .NET to Defend PowerShell   With the rise of attacks using PowerShell in the recent months, there has not
been a comprehensive solution for monitoring or prevention. Microsoft recently
released the AMSI solution for PowerShell v5, however this can also be
bypassed. This paper focuses on repurposing various stealthy runtime .NET
hijacking techniques implemented for PowerShell attacks for defensive
monitoring of PowerShell. It begins with a brief introduction to .NET and
PowerShell, followed by a deeper explanation of various attacker techniques,
which is explained from the perspective of the defender, including assembly
modification, class and method injection, compiler profiling, and C based
function hooking. Of the four attacker techniques that are repurposed for
defensive real-time monitoring of PowerShell execution, intermediate language
binary modification, JIT hooking, and machine code manipulation provide the
best results for stealthy run-time interfaces for PowerShell scripting
analysis.

25
The categories of this paper are: patt-sol
17
The categories of this paper are: q-fin
19
The categories of this paper are: eess
14
The categories of this paper are: math-ph
5
The categories of this paper are: gr-qc
13
The categories of this paper are: quant-ph
22
The categories of this paper are: chao-dyn
31
The categories of this paper are: ao-sci
26
The categories of this paper are: bayes-an
20
The categories of this paper are: acc-phys
37
The categories of this paper are: supr-con
2
The categories of this paper are: math
7
The categories of this paper are: hep-th
23
The categories of this paper are: solv-int
33
The categories of this paper are: plasm-ph
30
The categories of this paper are: q-alg