{"version":1,"source":" https:\/\/1275.ru\/spiski\/mitre","tactics":"enterprise-attack","language":"Chinese","create":"18.02.2026 5:52:09 UTC","count":691,"techniques":[{"id":"T1001.001","name":"\u5783\u573E\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7528\u4E8E\u547D\u4EE4\u4E0E\u63A7\u5236\u7684\u534F\u8BAE\u4E2D\u6DFB\u52A0\u65E0\u6548\u6570\u636E\uFF0C\u4EE5\u589E\u52A0\u68C0\u6D4B\u96BE\u5EA6\u3002\u901A\u8FC7\u5728\u547D\u4EE4\u4E0E\u63A7\u5236\u534F\u8BAE\u4E2D\u6DF7\u5165\u968F\u673A\u6216\u65E0\u610F\u4E49\u7684\u6570\u636E\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u963B\u6B62\u901A\u8FC7\u7B80\u5355\u65B9\u6CD5\u5BF9\u6D41\u91CF\u8FDB\u884C\u89E3\u7801\u3001\u89E3\u5BC6\u6216\u5176\u4ED6\u5206\u6790\u3002\u4F8B\u5982\uFF0C\u53EF\u80FD\u5728\u6570\u636E\u524D\u540E\u9644\u52A0\u65E0\u6548\u5B57\u7B26\uFF0C\u6216\u5728\u5173\u952E\u5B57\u7B26\u4E4B\u95F4\u63D2\u5165\u65E0\u6548\u5B57\u7B26\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1001\/001\/"},{"id":"T1001.002","name":"\u9690\u5199\u672F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u9690\u5199\u6280\u672F\u9690\u85CF\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\uFF0C\u4EE5\u589E\u52A0\u68C0\u6D4B\u96BE\u5EA6\u3002\u9690\u5199\u6280\u672F\u53EF\u7528\u4E8E\u5728\u7CFB\u7EDF\u95F4\u4F20\u8F93\u7684\u6570\u5B57\u6D88\u606F\u4E2D\u9690\u85CF\u6570\u636E\uFF0C\u8FD9\u4E9B\u9690\u85CF\u4FE1\u606F\u53EF\u7528\u4E8E\u5BF9\u88AB\u5165\u4FB5\u7CFB\u7EDF\u8FDB\u884C\u547D\u4EE4\u4E0E\u63A7\u5236\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u901A\u8FC7\u4F20\u9012\u4F7F\u7528\u9690\u5199\u672F\u5D4C\u5165\u7684\u6587\u4EF6\uFF08\u5982\u56FE\u50CF\u6216\u6587\u6863\u6587\u4EF6\uFF09\uFF0C\u4E5F\u53EF\u5B9E\u73B0\u547D\u4EE4\u4E0E\u63A7\u5236\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1001\/002\/"},{"id":"T1001.003","name":"\u534F\u8BAE\u6216\u670D\u52A1\u4F2A\u88C5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6A21\u4EFF\u5408\u6CD5\u534F\u8BAE\u6216\u7F51\u7EDC\u670D\u52A1\u6D41\u91CF\u6765\u4F2A\u88C5\u5176\u547D\u4EE4\u4E0E\u63A7\u5236\u6D3B\u52A8\uFF0C\u4EE5\u963B\u788D\u5206\u6790\u5DE5\u4F5C\u3002\u901A\u8FC7\u5192\u5145\u5408\u6CD5\u534F\u8BAE\u6216\u7F51\u7EDC\u670D\u52A1\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u5176\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u6DF7\u5165\u6B63\u5E38\u7684\u7F51\u7EDC\u6D41\u91CF\u4E2D\uFF0C\u96BE\u4EE5\u88AB\u5BDF\u89C9\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1001\/003\/"},{"id":"T1001","name":"\u6570\u636E\u6DF7\u6DC6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6DF7\u6DC6\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u4EE5\u589E\u52A0\u68C0\u6D4B\u96BE\u5EA6\u3002\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u901A\u4FE1\u88AB\u9690\u85CF\uFF08\u4F46\u4E0D\u4E00\u5B9A\u52A0\u5BC6\uFF09\uFF0C\u65E8\u5728\u4F7F\u5185\u5BB9\u66F4\u96BE\u4EE5\u53D1\u73B0\u6216\u7834\u8BD1\uFF0C\u540C\u65F6\u964D\u4F4E\u901A\u4FE1\u7684\u663E\u773C\u7A0B\u5EA6\u5E76\u9690\u85CF\u547D\u4EE4\u4E0D\u88AB\u5BDF\u89C9\u3002\u8FD9\u5305\u62EC\u591A\u79CD\u65B9\u6CD5\uFF0C\u4F8B\u5982\u5728\u534F\u8BAE\u6D41\u91CF\u4E2D\u6DFB\u52A0\u5783\u573E\u6570\u636E\u3001\u4F7F\u7528\u9690\u5199\u672F\u6216\u4F2A\u88C5\u6210\u5408\u6CD5\u534F\u8BAE\u3002","sub-techniques":"T1001.001, T1001.002, T1001.003","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1001\/"},{"id":"T1003.001","name":"LSASS \u5185\u5B58","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u8BBF\u95EE\u5B58\u50A8\u5728\u672C\u5730\u5B89\u5168\u673A\u6784\u5B50\u7CFB\u7EDF\u670D\u52A1\uFF08LSASS\uFF09\u8FDB\u7A0B\u5185\u5B58\u4E2D\u7684\u51ED\u636E\u6750\u6599\u3002\u7528\u6237\u767B\u5F55\u540E\uFF0C\u7CFB\u7EDF\u4F1A\u5728LSASS\u8FDB\u7A0B\u5185\u5B58\u4E2D\u751F\u6210\u5E76\u5B58\u50A8\u591A\u79CD\u51ED\u636E\u6750\u6599\u3002\u8FD9\u4E9B\u51ED\u636E\u6750\u6599\u53EF\u88AB\u7BA1\u7406\u5458\u7528\u6237\u6216SYSTEM\u8D26\u6237\u83B7\u53D6\uFF0C\u5E76\u7528\u4E8E\u901A\u8FC7\u201C\u4F7F\u7528\u66FF\u4EE3\u8EAB\u4EFD\u9A8C\u8BC1\u6750\u6599\u201D\u6280\u672F\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/001\/"},{"id":"T1003.002","name":"\u5B89\u5168\u8D26\u6237\u7BA1\u7406\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u5185\u5B58\u6280\u672F\u6216\u901A\u8FC7\u5B58\u50A8SAM\u6570\u636E\u5E93\u7684Windows\u6CE8\u518C\u8868\u6765\u63D0\u53D6\u5B89\u5168\u8D26\u6237\u7BA1\u7406\u5668\uFF08SAM\uFF09\u6570\u636E\u5E93\u4E2D\u7684\u51ED\u636E\u6750\u6599\u3002SAM\u662F\u4E00\u4E2A\u5305\u542B\u4E3B\u673A\u672C\u5730\u8D26\u6237\u7684\u6570\u636E\u5E93\u6587\u4EF6\uFF0C\u901A\u5E38\u53EF\u901A\u8FC7net user\u547D\u4EE4\u67E5\u770B\u3002\u679A\u4E3ESAM\u6570\u636E\u5E93\u9700\u8981SYSTEM\u7EA7\u522B\u7684\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/002\/"},{"id":"T1003.003","name":"NTDS","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u8BBF\u95EE\u6216\u521B\u5EFAActive Directory\u57DF\u6570\u636E\u5E93\u7684\u526F\u672C\uFF0C\u4EE5\u7A83\u53D6\u51ED\u8BC1\u4FE1\u606F\uFF0C\u5E76\u83B7\u53D6\u6709\u5173\u57DF\u6210\u5458\uFF08\u5982\u8BBE\u5907\u3001\u7528\u6237\u548C\u8BBF\u95EE\u6743\u9650\uFF09\u7684\u5176\u4ED6\u4FE1\u606F\u3002\u9ED8\u8BA4\u60C5\u51B5\u4E0B\uFF0CNTDS\u6587\u4EF6\uFF08NTDS.dit\uFF09\u4F4D\u4E8E\u57DF\u63A7\u5236\u5668\u7684%SystemRoot%\\NTDS\\Ntds.dit\u8DEF\u5F84\u4E0B\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/003\/"},{"id":"T1003.004","name":"LSA\u673A\u5BC6","description":"\u62E5\u6709\u4E3B\u673ASYSTEM\u8BBF\u95EE\u6743\u9650\u7684\u5BF9\u624B\u53EF\u80FD\u8BD5\u56FE\u8BBF\u95EE\u672C\u5730\u5B89\u5168\u673A\u6784\uFF08LSA\uFF09\u673A\u5BC6\uFF0C\u8FD9\u4E9B\u673A\u5BC6\u53EF\u80FD\u5305\u542B\u591A\u79CD\u4E0D\u540C\u7684\u51ED\u8BC1\u6750\u6599\uFF0C\u4F8B\u5982\u670D\u52A1\u8D26\u6237\u7684\u51ED\u8BC1\u3002LSA\u673A\u5BC6\u5B58\u50A8\u5728\u6CE8\u518C\u8868\u7684HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets\u8DEF\u5F84\u4E0B\u3002\u6B64\u5916\uFF0CLSA\u673A\u5BC6\u4E5F\u53EF\u4EE5\u4ECE\u5185\u5B58\u4E2D\u63D0\u53D6\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/004\/"},{"id":"T1003.005","name":"\u7F13\u5B58\u7684\u57DF\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u8BBF\u95EE\u7F13\u5B58\u7684\u57DF\u51ED\u636E\uFF0C\u8FD9\u4E9B\u51ED\u636E\u7528\u4E8E\u5728\u57DF\u63A7\u5236\u5668\u4E0D\u53EF\u7528\u65F6\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/005\/"},{"id":"T1003.006","name":"DCSync\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u6EE5\u7528Windows\u57DF\u63A7\u5236\u5668\u7684\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\uFF0C\u5229\u7528\u4E00\u79CD\u79F0\u4E3ADCSync\u7684\u6280\u672F\uFF0C\u6A21\u62DF\u4ECE\u8FDC\u7A0B\u57DF\u63A7\u5236\u5668\u8FDB\u884C\u7684\u590D\u5236\u8FC7\u7A0B\uFF0C\u4EE5\u83B7\u53D6\u51ED\u8BC1\u548C\u5176\u4ED6\u654F\u611F\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/006\/"},{"id":"T1003.007","name":"Proc \u6587\u4EF6\u7CFB\u7EDF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u8FDB\u7A0B\u6587\u4EF6\u7CFB\u7EDF\uFF08proc filesystem\uFF09\u6216\/proc\u76EE\u5F55\u4E2D\u6536\u96C6\u51ED\u636E\u3002\u8FDB\u7A0B\u6587\u4EF6\u7CFB\u7EDF\u662F\u4E00\u79CD\u4F2A\u6587\u4EF6\u7CFB\u7EDF\uFF0C\u4F5C\u4E3A\u57FA\u4E8ELinux\u7CFB\u7EDF\u7684\u5185\u6838\u6570\u636E\u7ED3\u6784\u63A5\u53E3\uFF0C\u7528\u4E8E\u7BA1\u7406\u865A\u62DF\u5185\u5B58\u3002\u5BF9\u4E8E\u6BCF\u4E2A\u8FDB\u7A0B\uFF0C\/proc\/<PID>\/maps\u6587\u4EF6\u5C55\u793A\u4E86\u5185\u5B58\u5982\u4F55\u6620\u5C04\u5230\u8FDB\u7A0B\u7684\u865A\u62DF\u5730\u5740\u7A7A\u95F4\u4E2D\u3002\u800C\/proc\/<PID>\/mem\u6587\u4EF6\u5219\u51FA\u4E8E\u8C03\u8BD5\u76EE\u7684\u66B4\u9732\uFF0C\u63D0\u4F9B\u4E86\u5BF9\u8FDB\u7A0B\u865A\u62DF\u5730\u5740\u7A7A\u95F4\u7684\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/007\/"},{"id":"T1003.008","name":"\/etc\/passwd \u548C \/etc\/shadow","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u8F6C\u50A8\/etc\/passwd\u548C\/etc\/shadow\u6587\u4EF6\u5185\u5BB9\uFF0C\u4EE5\u8FDB\u884C\u79BB\u7EBF\u5BC6\u7801\u7834\u89E3\u3002\u5927\u591A\u6570\u73B0\u4EE3Linux\u64CD\u4F5C\u7CFB\u7EDF\u7ED3\u5408\u4F7F\u7528\/etc\/passwd\u548C\/etc\/shadow\u5B58\u50A8\u7528\u6237\u8D26\u6237\u4FE1\u606F\uFF0C\u5176\u4E2D\u5BC6\u7801\u54C8\u5E0C\u503C\u4FDD\u5B58\u5728\/etc\/shadow\u6587\u4EF6\u4E2D\u3002\u9ED8\u8BA4\u60C5\u51B5\u4E0B\uFF0C\/etc\/shadow\u6587\u4EF6\u4EC5\u5BF9root\u7528\u6237\u53EF\u8BFB\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/008\/"},{"id":"T1003","name":"\u64CD\u4F5C\u7CFB\u7EDF\u51ED\u636E\u8F6C\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u8F6C\u50A8\u51ED\u636E\u6765\u83B7\u53D6\u8D26\u6237\u767B\u5F55\u4FE1\u606F\u548C\u51ED\u8BC1\u6750\u6599\uFF0C\u901A\u5E38\u4EE5\u54C8\u5E0C\u503C\u6216\u660E\u6587\u5BC6\u7801\u5F62\u5F0F\u5B58\u5728\u3002\u8FD9\u4E9B\u51ED\u8BC1\u53EF\u4ECE\u64CD\u4F5C\u7CFB\u7EDF\u7F13\u5B58\u3001\u5185\u5B58\u6216\u7CFB\u7EDF\u7ED3\u6784\u4E2D\u83B7\u53D6\u3002\u4E00\u65E6\u83B7\u5F97\u51ED\u8BC1\uFF0C\u653B\u51FB\u8005\u4FBF\u53EF\u5229\u7528\u5176\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\uFF0C\u5E76\u8BBF\u95EE\u53D7\u9650\u4FE1\u606F\u3002","sub-techniques":"T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1003.007, T1003.008","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1003\/"},{"id":"T1005","name":"\u672C\u5730\u7CFB\u7EDF\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6570\u636E\u5916\u6CC4\u524D\uFF0C\u641C\u7D22\u672C\u5730\u7CFB\u7EDF\u8D44\u6E90\uFF0C\u5982\u6587\u4EF6\u7CFB\u7EDF\u3001\u914D\u7F6E\u6587\u4EF6\u3001\u672C\u5730\u6570\u636E\u5E93\u3001\u865A\u62DF\u673A\u6587\u4EF6\u6216\u8FDB\u7A0B\u5185\u5B58\uFF0C\u4EE5\u5BFB\u627E\u611F\u5174\u8DA3\u7684\u6587\u4EF6\u548C\u654F\u611F\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1005\/"},{"id":"T1006","name":"\u76F4\u63A5\u5377\u8BBF\u95EE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u76F4\u63A5\u8BBF\u95EE\u5377\u4EE5\u7ED5\u8FC7\u6587\u4EF6\u8BBF\u95EE\u63A7\u5236\u548C\u6587\u4EF6\u7CFB\u7EDF\u76D1\u63A7\u3002Windows\u5141\u8BB8\u7A0B\u5E8F\u76F4\u63A5\u8BBF\u95EE\u903B\u8F91\u5377\u3002\u901A\u8FC7\u5206\u6790\u6587\u4EF6\u7CFB\u7EDF\u6570\u636E\u7ED3\u6784\uFF0C\u5177\u6709\u76F4\u63A5\u8BBF\u95EE\u6743\u9650\u7684\u7A0B\u5E8F\u53EF\u4EE5\u76F4\u63A5\u4ECE\u9A71\u52A8\u5668\u8BFB\u53D6\u548C\u5199\u5165\u6587\u4EF6\u3002\u8FD9\u79CD\u6280\u672F\u53EF\u80FD\u7ED5\u8FC7Windows\u7684\u6587\u4EF6\u8BBF\u95EE\u63A7\u5236\u4EE5\u53CA\u6587\u4EF6\u7CFB\u7EDF\u76D1\u63A7\u5DE5\u5177\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1006\/"},{"id":"T1007","name":"\u7CFB\u7EDF\u670D\u52A1\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u6536\u96C6\u6709\u5173\u5DF2\u6CE8\u518C\u672C\u5730\u7CFB\u7EDF\u670D\u52A1\u7684\u4FE1\u606F\u3002\u4ED6\u4EEC\u53EF\u80FD\u5229\u7528\u5DE5\u5177\u6216\u64CD\u4F5C\u7CFB\u7EDF\u5B9E\u7528\u547D\u4EE4\uFF08\u5982sc query\u3001tasklist \/svc\u3001systemctl --type=service\u548Cnet start\uFF09\u6765\u83B7\u53D6\u670D\u52A1\u4FE1\u606F\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u901A\u8FC7\u8BF8\u5982Windows\u4E0A\u7684schtasks\u547D\u4EE4\u6216Linux\u53CAmacOS\u4E0A\u7684crontab -l\u547D\u4EE4\u6765\u6536\u96C6\u8BA1\u5212\u4EFB\u52A1\u7684\u76F8\u5173\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1007\/"},{"id":"T1008","name":"\u5907\u7528\u9891\u9053","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5728\u4E3B\u8981\u901A\u4FE1\u6E20\u9053\u88AB\u653B\u7834\u6216\u65E0\u6CD5\u8BBF\u95EE\u65F6\uFF0C\u4F7F\u7528\u5907\u7528\u6216\u66FF\u4EE3\u901A\u4FE1\u6E20\u9053\uFF0C\u4EE5\u7EF4\u6301\u53EF\u9760\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\uFF0C\u5E76\u89C4\u907F\u6570\u636E\u4F20\u8F93\u9608\u503C\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1008\/"},{"id":"T1010","name":"\u5E94\u7528\u7A0B\u5E8F\u7A97\u53E3\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u83B7\u53D6\u5DF2\u6253\u5F00\u5E94\u7528\u7A0B\u5E8F\u7A97\u53E3\u7684\u5217\u8868\u3002\u7A97\u53E3\u5217\u8868\u53EF\u80FD\u6CC4\u9732\u7CFB\u7EDF\u4F7F\u7528\u65B9\u5F0F\u7684\u4FE1\u606F\u3002\u4F8B\u5982\uFF0C\u5E94\u7528\u7A0B\u5E8F\u7A97\u53E3\u4FE1\u606F\u53EF\u7528\u4E8E\u8BC6\u522B\u6F5C\u5728\u5F85\u6536\u96C6\u6570\u636E\uFF0C\u4EE5\u53CA\u53D1\u73B0\u5B89\u5168\u5DE5\u5177\uFF08\u5B89\u5168\u8F6F\u4EF6\u53D1\u73B0\uFF09\u4EE5\u89C4\u907F\u68C0\u6D4B\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1010\/"},{"id":"T1011.001","name":"\u84DD\u7259\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u84DD\u7259\u800C\u975E\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u3002\u5982\u679C\u547D\u4EE4\u4E0E\u63A7\u5236\u7F51\u7EDC\u662F\u6709\u7EBF\u4E92\u8054\u7F51\u8FDE\u63A5\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u9009\u62E9\u5229\u7528\u84DD\u7259\u901A\u4FE1\u6E20\u9053\u6765\u7A83\u53D6\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1011\/001\/"},{"id":"T1011","name":"\u901A\u8FC7\u5176\u4ED6\u7F51\u7EDC\u5A92\u4ECB\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u4E0D\u540C\u4E8E\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u7684\u7F51\u7EDC\u5A92\u4ECB\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u3002\u82E5\u547D\u4EE4\u4E0E\u63A7\u5236\u7F51\u7EDC\u4E3A\u6709\u7EBF\u4E92\u8054\u7F51\u8FDE\u63A5\uFF0C\u6570\u636E\u5916\u6CC4\u5219\u53EF\u80FD\u901A\u8FC7WiFi\u8FDE\u63A5\u3001\u8C03\u5236\u89E3\u8C03\u5668\u3001\u8702\u7A9D\u6570\u636E\u8FDE\u63A5\u3001\u84DD\u7259\u6216\u5176\u4ED6\u5C04\u9891\uFF08RF\uFF09\u4FE1\u9053\u7B49\u9014\u5F84\u53D1\u751F\u3002","sub-techniques":"T1011.001","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1011\/"},{"id":"T1012","name":"\u67E5\u8BE2\u6CE8\u518C\u8868","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4E0EWindows\u6CE8\u518C\u8868\u8FDB\u884C\u4EA4\u4E92\uFF0C\u4EE5\u6536\u96C6\u6709\u5173\u7CFB\u7EDF\u3001\u914D\u7F6E\u548C\u5DF2\u5B89\u88C5\u8F6F\u4EF6\u7684\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1012\/"},{"id":"T1014","name":"Rootkit\uFF08\u6839\u5957\u4EF6\uFF09","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Rootkit\u6765\u9690\u85CF\u7A0B\u5E8F\u3001\u6587\u4EF6\u3001\u7F51\u7EDC\u8FDE\u63A5\u3001\u670D\u52A1\u3001\u9A71\u52A8\u7A0B\u5E8F\u53CA\u5176\u4ED6\u7CFB\u7EDF\u7EC4\u4EF6\u7684\u5B58\u5728\u3002Rootkit\u662F\u4E00\u79CD\u901A\u8FC7\u62E6\u622A\/\u6302\u94A9\u5E76\u4FEE\u6539\u63D0\u4F9B\u7CFB\u7EDF\u4FE1\u606F\u7684\u64CD\u4F5C\u7CFB\u7EDFAPI\u8C03\u7528\u6765\u63A9\u76D6\u6076\u610F\u8F6F\u4EF6\u5B58\u5728\u7684\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1014\/"},{"id":"T1016.001","name":"\u7F51\u7EDC\u8FDE\u63A5\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u68C0\u67E5\u53D7\u611F\u67D3\u7CFB\u7EDF\u7684\u4E92\u8054\u7F51\u8FDE\u63A5\u60C5\u51B5\u3002\u8FD9\u4E00\u64CD\u4F5C\u901A\u5E38\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u8FDB\u884C\uFF0C\u53EF\u901A\u8FC7\u591A\u79CD\u65B9\u5F0F\u5B9E\u73B0\uFF0C\u4F8B\u5982\u4F7F\u7528Ping\u3001tracert\u547D\u4EE4\u548C\u5411\u7F51\u7AD9\u53D1\u9001GET\u8BF7\u6C42\uFF0C\u6216\u8FDB\u884C\u521D\u59CB\u901F\u5EA6\u6D4B\u8BD5\u4EE5\u786E\u8BA4\u5E26\u5BBD\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1016\/001\/"},{"id":"T1016.002","name":"Wi-Fi \u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4E2D\u641C\u7D22Wi-Fi\u7F51\u7EDC\u76F8\u5173\u4FE1\u606F\uFF0C\u5982\u7F51\u7EDC\u540D\u79F0\u548C\u5BC6\u7801\u3002\u4ED6\u4EEC\u53EF\u80FD\u5C06Wi-Fi\u4FE1\u606F\u7528\u4E8E\u8D26\u6237\u53D1\u73B0\u3001\u8FDC\u7A0B\u7CFB\u7EDF\u53D1\u73B0\u4EE5\u53CA\u5176\u4ED6\u53D1\u73B0\u6216\u51ED\u8BC1\u8BBF\u95EE\u6D3B\u52A8\uFF0C\u4EE5\u652F\u6301\u5F53\u524D\u53CA\u672A\u6765\u7684\u653B\u51FB\u884C\u52A8\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1016\/002\/"},{"id":"T1016","name":"\u7CFB\u7EDF\u7F51\u7EDC\u914D\u7F6E\u53D1\u73B0","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u901A\u8FC7\u8BBF\u95EE\u7CFB\u7EDF\u6216\u8FDC\u7A0B\u4FE1\u606F\u53D1\u73B0\uFF0C\u5BFB\u627E\u6709\u5173\u7F51\u7EDC\u914D\u7F6E\u548C\u8BBE\u7F6E\u7684\u8BE6\u7EC6\u4FE1\u606F\uFF0C\u4F8B\u5982\u7CFB\u7EDF\u7684IP\u548C\/\u6216MAC\u5730\u5740\u3002\u5B58\u5728\u591A\u79CD\u64CD\u4F5C\u7CFB\u7EDF\u7BA1\u7406\u5DE5\u5177\u53EF\u7528\u4E8E\u6536\u96C6\u6B64\u7C7B\u4FE1\u606F\uFF0C\u4F8B\u5982Arp\u3001ipconfig\/ifconfig\u3001nbtstat\u548Croute\u3002","sub-techniques":"T1016.001, T1016.002","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1016\/"},{"id":"T1018","name":"\u8FDC\u7A0B\u7CFB\u7EDF\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7IP\u5730\u5740\u3001\u4E3B\u673A\u540D\u6216\u5176\u4ED6\u903B\u8F91\u6807\u8BC6\u7B26\uFF0C\u83B7\u53D6\u7F51\u7EDC\u4E0A\u5176\u4ED6\u7CFB\u7EDF\u7684\u5217\u8868\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u80FD\u7528\u4E8E\u4ECE\u5F53\u524D\u7CFB\u7EDF\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\u3002\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u4E2D\u53EF\u80FD\u5305\u542B\u5B9E\u73B0\u6B64\u529F\u80FD\u7684\u529F\u80FD\uFF0C\u4F46\u64CD\u4F5C\u7CFB\u7EDF\u81EA\u5E26\u7684\u5B9E\u7528\u7A0B\u5E8F\u4E5F\u53EF\u7528\u4E8E\u6B64\u76EE\u7684\uFF0C\u4F8B\u5982\u4F7F\u7528Ping\u547D\u4EE4\u3001\u901A\u8FC7Net\u547D\u4EE4\u6267\u884Cnet view\uFF0C\u6216\u5728ESXi\u670D\u52A1\u5668\u4E0A\u4F7F\u7528esxcli network diag ping\u547D\u4EE4\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1018\/"},{"id":"T1020.001","name":"\u6D41\u91CF\u590D\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6D41\u91CF\u955C\u50CF\u529F\u80FD\uFF0C\u901A\u8FC7\u53D7\u63A7\u57FA\u7840\u8BBE\u65BD\u81EA\u52A8\u5316\u5B9E\u65BD\u6570\u636E\u7A83\u53D6\u3002\u6D41\u91CF\u955C\u50CF\u4F5C\u4E3A\u67D0\u4E9B\u8BBE\u5907\u7684\u539F\u751F\u529F\u80FD\uFF0C\u901A\u5E38\u7528\u4E8E\u7F51\u7EDC\u5206\u6790\u573A\u666F\u3002\u4F8B\u5982\uFF0C\u8BBE\u5907\u53EF\u88AB\u914D\u7F6E\u4E3A\u5C06\u7F51\u7EDC\u6D41\u91CF\u8F6C\u53D1\u81F3\u4E00\u4E2A\u6216\u591A\u4E2A\u76EE\u6807\u5730\u5740\uFF0C\u4EE5\u4F9B\u7F51\u7EDC\u5206\u6790\u4EEA\u6216\u5176\u4ED6\u76D1\u63A7\u8BBE\u5907\u8FDB\u884C\u68C0\u6D4B\u5206\u6790\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1020\/001\/"},{"id":"T1020","name":"\u81EA\u52A8\u5316\u6570\u636E\u7A83\u53D6","description":"\u5BF9\u624B\u53EF\u80FD\u5728\u6536\u96C6\u654F\u611F\u6587\u4EF6\u7B49\u6570\u636E\u540E\uFF0C\u901A\u8FC7\u81EA\u52A8\u5316\u5904\u7406\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u3002","sub-techniques":"T1020.001","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1020\/"},{"id":"T1021.001","name":"\u8FDC\u7A0B\u684C\u9762\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\u901A\u8FC7\u8FDC\u7A0B\u684C\u9762\u534F\u8BAE\uFF08RDP\uFF09\u767B\u5F55\u8BA1\u7B97\u673A\uFF0C\u968F\u540E\u4EE5\u5DF2\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/001\/"},{"id":"T1021.002","name":"SMB\/Windows \u7BA1\u7406\u5458\u5171\u4EAB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\uFF0C\u901A\u8FC7\u670D\u52A1\u5668\u6D88\u606F\u5757\uFF08SMB\uFF09\u534F\u8BAE\u4E0E\u8FDC\u7A0B\u7F51\u7EDC\u5171\u4EAB\u8FDB\u884C\u4EA4\u4E92\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u4EE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/002\/"},{"id":"T1021.003","name":"\u5206\u5E03\u5F0F\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5206\u5E03\u5F0F\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08DCOM\uFF09\uFF0C\u901A\u8FC7\u6709\u6548\u8D26\u6237\u4E0E\u8FDC\u7A0B\u673A\u5668\u8FDB\u884C\u4EA4\u4E92\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u4EE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/003\/"},{"id":"T1021.004","name":"SSH","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\u901A\u8FC7\u5B89\u5168\u5916\u58F3\uFF08SSH\uFF09\u767B\u5F55\u8FDC\u7A0B\u673A\u5668\uFF0C\u968F\u540E\u4EE5\u8BE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"ESXi,Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/004\/"},{"id":"T1021.005","name":"\u865A\u62DF\u7F51\u7EDC\u8BA1\u7B97","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\uFF0C\u901A\u8FC7\u865A\u62DF\u7F51\u7EDC\u8BA1\u7B97\uFF08VNC\uFF09\u8FDC\u7A0B\u63A7\u5236\u673A\u5668\u3002VNC\u662F\u4E00\u79CD\u8DE8\u5E73\u53F0\u7684\u684C\u9762\u5171\u4EAB\u7CFB\u7EDF\uFF0C\u5B83\u4F7F\u7528RFB\uFF08\u8FDC\u7A0B\u5E27\u7F13\u51B2\uFF09\u534F\u8BAE\uFF0C\u901A\u8FC7\u7F51\u7EDC\u4F20\u8F93\u5C4F\u5E55\u3001\u9F20\u6807\u548C\u952E\u76D8\u8F93\u5165\uFF0C\u4ECE\u800C\u4F7F\u7528\u6237\u80FD\u591F\u8FDC\u7A0B\u63A7\u5236\u53E6\u4E00\u53F0\u8BA1\u7B97\u673A\u7684\u663E\u793A\u754C\u9762\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/005\/"},{"id":"T1021.006","name":"Windows \u8FDC\u7A0B\u7BA1\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\u901A\u8FC7Windows\u8FDC\u7A0B\u7BA1\u7406\uFF08WinRM\uFF09\u4E0E\u8FDC\u7A0B\u7CFB\u7EDF\u4EA4\u4E92\uFF0C\u968F\u540E\u4EE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/006\/"},{"id":"T1021.007","name":"\u4E91\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u4E0E\u672C\u5730\u7528\u6237\u8EAB\u4EFD\u540C\u6B65\u6216\u8054\u5408\u7684\u6709\u6548\u8D26\u6237\uFF0C\u767B\u5F55\u5230\u53D7\u653B\u51FB\u73AF\u5883\u4E2D\u53EF\u8BBF\u95EE\u7684\u4E91\u670D\u52A1\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u4EE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u7BA1\u7406\u64CD\u4F5C\u6216\u8BBF\u95EE\u4E91\u6258\u7BA1\u8D44\u6E90\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/007\/"},{"id":"T1021.008","name":"\u76F4\u63A5\u4E91\u865A\u62DF\u673A\u8FDE\u63A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\uFF0C\u901A\u8FC7\u4E91\u539F\u751F\u65B9\u6CD5\u76F4\u63A5\u767B\u5F55\u5230\u53EF\u8BBF\u95EE\u7684\u4E91\u6258\u7BA1\u8BA1\u7B97\u57FA\u7840\u8BBE\u65BD\u3002\u8BB8\u591A\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u63D0\u4F9B\u4E0E\u865A\u62DF\u57FA\u7840\u8BBE\u65BD\u7684\u4EA4\u4E92\u5F0F\u8FDE\u63A5\uFF0C\u8FD9\u4E9B\u8FDE\u63A5\u53EF\u4EE5\u901A\u8FC7\u4E91API\u8BBF\u95EE\uFF0C\u4F8B\u5982Azure\u4E32\u884C\u63A7\u5236\u53F0\u3001AWS EC2\u5B9E\u4F8B\u8FDE\u63A5\u548CAWS\u7CFB\u7EDF\u7BA1\u7406\u5668\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/008\/"},{"id":"T1021","name":"\u8FDC\u7A0B\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6709\u6548\u8D26\u6237\u767B\u5F55\u63A5\u53D7\u8FDC\u7A0B\u8FDE\u63A5\u7684\u670D\u52A1\uFF0C\u5982telnet\u3001SSH\u548CVNC\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u4EE5\u767B\u5F55\u7528\u6237\u7684\u8EAB\u4EFD\u6267\u884C\u64CD\u4F5C\u3002","sub-techniques":"T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006, T1021.007, T1021.008","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1021\/"},{"id":"T1025","name":"\u53EF\u79FB\u52A8\u5A92\u4F53\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u5DF2\u653B\u9677\u8BA1\u7B97\u673A\u4E0A\u8FDE\u63A5\u7684\u53EF\u79FB\u52A8\u4ECB\u8D28\uFF0C\u4EE5\u5BFB\u627E\u611F\u5174\u8DA3\u7684\u6587\u4EF6\u3002\u5728\u6570\u636E\u5916\u6CC4\u4E4B\u524D\uFF0C\u654F\u611F\u6570\u636E\u53EF\u4ECE\u4EFB\u4F55\u8FDE\u63A5\u5230\u53D7\u611F\u67D3\u7CFB\u7EDF\u7684\u53EF\u79FB\u52A8\u4ECB\u8D28\uFF08\u5982\u5149\u76D8\u9A71\u52A8\u5668\u3001USB\u5B58\u50A8\u5668\u7B49\uFF09\u4E2D\u6536\u96C6\u3002\u653B\u51FB\u8FC7\u7A0B\u4E2D\u53EF\u80FD\u4F7F\u7528\u4EA4\u4E92\u5F0F\u547D\u4EE4\u5916\u58F3\uFF0C\u5E76\u5229\u7528cmd\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\u6765\u6536\u96C6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1025\/"},{"id":"T1027.001","name":"\u4E8C\u8FDB\u5236\u586B\u5145","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4E8C\u8FDB\u5236\u586B\u5145\u6280\u672F\u6DFB\u52A0\u65E0\u7528\u6570\u636E\uFF0C\u4ECE\u800C\u6539\u53D8\u6076\u610F\u8F6F\u4EF6\u5728\u78C1\u76D8\u4E0A\u7684\u8868\u73B0\u5F62\u5F0F\u3002\u8FD9\u79CD\u505A\u6CD5\u4E0D\u4F1A\u5F71\u54CD\u4E8C\u8FDB\u5236\u6587\u4EF6\u7684\u529F\u80FD\u6216\u884C\u4E3A\uFF0C\u4F46\u4F1A\u589E\u52A0\u6587\u4EF6\u4F53\u79EF\uFF0C\u53EF\u80FD\u8D85\u51FA\u67D0\u4E9B\u5B89\u5168\u5DE5\u5177\u56E0\u6587\u4EF6\u5927\u5C0F\u9650\u5236\u6240\u80FD\u5904\u7406\u7684\u8303\u56F4\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/001\/"},{"id":"T1027.002","name":"\u8F6F\u4EF6\u6253\u5305","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u8F6F\u4EF6\u52A0\u58F3\u6216\u865A\u62DF\u673A\u8F6F\u4EF6\u4FDD\u62A4\u6280\u672F\u6765\u9690\u85CF\u5176\u4EE3\u7801\u3002\u8F6F\u4EF6\u52A0\u58F3\u662F\u4E00\u79CD\u538B\u7F29\u6216\u52A0\u5BC6\u53EF\u6267\u884C\u6587\u4EF6\u7684\u65B9\u6CD5\u3002\u5BF9\u53EF\u6267\u884C\u6587\u4EF6\u8FDB\u884C\u52A0\u58F3\u4F1A\u6539\u53D8\u5176\u6587\u4EF6\u7279\u5F81\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u7279\u5F81\u7684\u68C0\u6D4B\u3002\u5927\u591A\u6570\u89E3\u538B\u6280\u672F\u4F1A\u5728\u5185\u5B58\u4E2D\u89E3\u538B\u53EF\u6267\u884C\u4EE3\u7801\u3002\u865A\u62DF\u673A\u8F6F\u4EF6\u4FDD\u62A4\u5219\u5C06\u53EF\u6267\u884C\u6587\u4EF6\u7684\u539F\u59CB\u4EE3\u7801\u8F6C\u6362\u4E3A\u7279\u6B8A\u683C\u5F0F\uFF0C\u53EA\u6709\u7279\u5B9A\u7684\u865A\u62DF\u673A\u624D\u80FD\u8FD0\u884C\u3002\u968F\u540E\uFF0C\u7CFB\u7EDF\u4F1A\u8C03\u7528\u865A\u62DF\u673A\u6765\u6267\u884C\u8FD9\u6BB5\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/002\/"},{"id":"T1027.003","name":"\u9690\u5199\u672F","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u9690\u5199\u672F\u6280\u672F\u6765\u9632\u6B62\u9690\u85CF\u4FE1\u606F\u88AB\u68C0\u6D4B\u3002\u9690\u5199\u6280\u672F\u53EF\u7528\u4E8E\u5C06\u6570\u636E\u9690\u85CF\u5728\u6570\u5B57\u5A92\u4F53\u4E2D\uFF0C\u5982\u56FE\u50CF\u3001\u97F3\u9891\u8F68\u9053\u3001\u89C6\u9891\u526A\u8F91\u6216\u6587\u672C\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/003\/"},{"id":"T1027.004","name":"\u4EA4\u4ED8\u540E\u7F16\u8BD1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u5411\u53D7\u5BB3\u8005\u4F20\u9001\u672A\u7F16\u8BD1\u7684\u4EE3\u7801\u6587\u4EF6\uFF0C\u4F7F\u6709\u6548\u8F7D\u8377\u96BE\u4EE5\u88AB\u53D1\u73B0\u548C\u5206\u6790\u3002\u57FA\u4E8E\u6587\u672C\u7684\u6E90\u4EE3\u7801\u6587\u4EF6\u53EF\u80FD\u89C4\u907F\u9488\u5BF9\u53EF\u6267\u884C\u6587\u4EF6\/\u4E8C\u8FDB\u5236\u6587\u4EF6\u7684\u4FDD\u62A4\u63AA\u65BD\u7684\u5206\u6790\u548C\u5BA1\u67E5\u3002\u8FD9\u4E9B\u6709\u6548\u8F7D\u8377\u5728\u6267\u884C\u524D\u9700\u8981\u88AB\u7F16\u8BD1\uFF1B\u901A\u5E38\u901A\u8FC7\u672C\u5730\u5DE5\u5177\u5982ilasm.exe\u3001csc.exe\u6216GCC\/MinGW\u6765\u5B8C\u6210\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/004\/"},{"id":"T1027.005","name":"\u5DE5\u5177\u4E2D\u7684\u6307\u793A\u5668\u79FB\u9664","description":"\u5BF9\u624B\u82E5\u8BA4\u4E3A\u5176\u6076\u610F\u5DE5\u5177\u5DF2\u88AB\u68C0\u6D4B\u3001\u9694\u79BB\u6216\u53D7\u5230\u5176\u4ED6\u9650\u5236\uFF0C\u53EF\u80FD\u4F1A\u79FB\u9664\u5DE5\u5177\u4E2D\u7684\u7279\u5F81\u6807\u8BC6\u3002\u4ED6\u4EEC\u53EF\u4EE5\u901A\u8FC7\u5220\u9664\u8FD9\u4E9B\u6807\u8BC6\u6765\u4FEE\u6539\u5DE5\u5177\uFF0C\u4F7F\u7528\u66F4\u65B0\u540E\u7684\u7248\u672C\uFF0C\u4ECE\u800C\u907F\u514D\u88AB\u76EE\u6807\u9632\u5FA1\u7CFB\u7EDF\u6216\u540E\u7EED\u53EF\u80FD\u91C7\u7528\u7C7B\u4F3C\u7CFB\u7EDF\u7684\u76EE\u6807\u6240\u68C0\u6D4B\u5230\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/005\/"},{"id":"T1027.006","name":"HTML\u8D70\u79C1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u6076\u610F\u8D1F\u8F7D\u9690\u85CF\u5728\u770B\u4F3C\u65E0\u5BB3\u7684HTML\u6587\u4EF6\u4E2D\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u5185\u5BB9\u8FC7\u6EE4\u5668\u8D70\u79C1\u6570\u636E\u548C\u6587\u4EF6\u3002HTML\u6587\u6863\u53EF\u4EE5\u5B58\u50A8\u88AB\u79F0\u4E3AJavaScript Blob\uFF08\u8868\u793A\u539F\u59CB\u5B57\u8282\u7684\u4E0D\u53EF\u53D8\u6570\u636E\uFF09\u7684\u5927\u578B\u4E8C\u8FDB\u5236\u5BF9\u8C61\uFF0C\u8FD9\u4E9B\u5BF9\u8C61\u968F\u540E\u53EF\u88AB\u6784\u9020\u6210\u7C7B\u4F3C\u6587\u4EF6\u7684\u5BF9\u8C61\u3002\u6570\u636E\u4E5F\u53EF\u80FD\u5B58\u50A8\u5728Data URL\u4E2D\uFF0C\u8FD9\u4F7F\u5F97\u5A92\u4F53\u7C7B\u578B\u6216MIME\u6587\u4EF6\u80FD\u591F\u5185\u5D4C\u5728HTML\u6587\u6863\u4E2D\u3002HTML5\u8FD8\u5F15\u5165\u4E86\u4E00\u4E2A\u4E0B\u8F7D\u5C5E\u6027\uFF0C\u53EF\u7528\u4E8E\u542F\u52A8\u6587\u4EF6\u4E0B\u8F7D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/006\/"},{"id":"T1027.007","name":"\u52A8\u6001API\u89E3\u6790","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5BF9\u6076\u610F\u8F6F\u4EF6\u8C03\u7528\u7684API\u51FD\u6570\u8FDB\u884C\u6DF7\u6DC6\u5904\u7406\uFF0C\u968F\u540E\u52A8\u6001\u89E3\u6790\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u529F\u80FD\u5E76\u963B\u788D\u9632\u5FA1\u6027\u5206\u6790\u3002\u6076\u610F\u8F6F\u4EF6\u901A\u5E38\u5229\u7528\u64CD\u4F5C\u7CFB\u7EDF\u63D0\u4F9B\u7684\u5404\u79CD\u539F\u751FAPI\u51FD\u6570\u6765\u6267\u884C\u6D89\u53CA\u8FDB\u7A0B\u3001\u6587\u4EF6\u53CA\u5176\u4ED6\u7CFB\u7EDF\u7EC4\u4EF6\u7684\u591A\u79CD\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/007\/"},{"id":"T1027.008","name":"\u5265\u79BB\u8F7D\u8377","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8BD5\u56FE\u901A\u8FC7\u79FB\u9664\u7B26\u53F7\u3001\u5B57\u7B26\u4E32\u53CA\u5176\u4ED6\u4EBA\u7C7B\u53EF\u8BFB\u4FE1\u606F\uFF0C\u4F7F\u8F7D\u8377\u96BE\u4EE5\u5206\u6790\u3002\u811A\u672C\u548C\u53EF\u6267\u884C\u6587\u4EF6\u4E2D\u53EF\u80FD\u5305\u542B\u53D8\u91CF\u540D\u548C\u5176\u4ED6\u5B57\u7B26\u4E32\uFF0C\u8FD9\u4E9B\u6709\u52A9\u4E8E\u5F00\u53D1\u8005\u8BB0\u5F55\u4EE3\u7801\u529F\u80FD\u3002\u5F53\u53EF\u6267\u884C\u8F7D\u8377\u88AB\u7F16\u8BD1\u65F6\uFF0C\u64CD\u4F5C\u7CFB\u7EDF\u94FE\u63A5\u5668\u901A\u5E38\u4F1A\u751F\u6210\u7B26\u53F7\u3002\u9006\u5411\u5DE5\u7A0B\u5E08\u5229\u7528\u8FD9\u4E9B\u7B26\u53F7\u548C\u5B57\u7B26\u4E32\u6765\u5206\u6790\u4EE3\u7801\uFF0C\u5E76\u8BC6\u522B\u8F7D\u8377\u4E2D\u7684\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/008\/"},{"id":"T1027.009","name":"\u5D4C\u5165\u5F0F\u8F7D\u8377","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6076\u610F\u8F7D\u8377\u5D4C\u5165\u5176\u4ED6\u6587\u4EF6\u4E2D\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u5185\u5BB9\uFF0C\u89C4\u907F\u9632\u5FA1\u673A\u5236\u3002\u8868\u9762\u4E0A\u770B\u4F3C\u65E0\u5BB3\u7684\u6587\u4EF6\uFF08\u5982\u811A\u672C\u548C\u53EF\u6267\u884C\u6587\u4EF6\uFF09\u53EF\u80FD\u88AB\u6EE5\u7528\u6765\u643A\u5E26\u548C\u6DF7\u6DC6\u6076\u610F\u8F7D\u8377\u4E0E\u5185\u5BB9\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u5D4C\u5165\u7684\u8F7D\u8377\u8FD8\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u89C4\u907F\u4FE1\u4EFB\u63A7\u5236\u673A\u5236\uFF0C\u4F8B\u5982\u4E0D\u5F71\u54CD\u6570\u5B57\u7B7E\u540D\u548C\u516C\u8BC1\u7968\u636E\u7B49\u6267\u884C\u63A7\u5236\u63AA\u65BD\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/009\/"},{"id":"T1027.010","name":"\u547D\u4EE4\u6DF7\u6DC6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6267\u884C\u547D\u4EE4\u65F6\u5BF9\u5185\u5BB9\u8FDB\u884C\u6DF7\u6DC6\uFF0C\u4EE5\u963B\u788D\u68C0\u6D4B\u3002\u547D\u4EE4\u884C\u6DF7\u6DC6\u662F\u4E00\u79CD\u4F7F\u547D\u4EE4\u548C\u811A\u672C\u4E2D\u7684\u5B57\u7B26\u4E32\u4E0E\u6A21\u5F0F\u66F4\u96BE\u4EE5\u88AB\u7279\u5F81\u8BC6\u522B\u548C\u5206\u6790\u7684\u65B9\u6CD5\u3002\u6B64\u7C7B\u6DF7\u6DC6\u53EF\u5305\u542B\u5728\u901A\u8FC7\u6295\u9012\u7684\u6709\u6548\u8F7D\u8377\uFF08\u4F8B\u5982\u9493\u9C7C\u653B\u51FB\u548C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\uFF09\u6267\u884C\u7684\u547D\u4EE4\u4E2D\uFF0C\u6216\u901A\u8FC7\u547D\u4EE4\u884C\u4E0E\u811A\u672C\u89E3\u91CA\u5668\u4EA4\u4E92\u5F0F\u6267\u884C\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/010\/"},{"id":"T1027.011","name":"\u65E0\u6587\u4EF6\u5B58\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6570\u636E\u5B58\u50A8\u5728\u201C\u65E0\u6587\u4EF6\u201D\u683C\u5F0F\u4E2D\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u6D3B\u52A8\uFF0C\u89C4\u907F\u9632\u5FA1\u7CFB\u7EDF\u7684\u68C0\u6D4B\u3002\u65E0\u6587\u4EF6\u5B58\u50A8\u53EF\u5E7F\u4E49\u5B9A\u4E49\u4E3A\u9664\u6587\u4EF6\u4E4B\u5916\u7684\u4EFB\u4F55\u5B58\u50A8\u683C\u5F0F\u3002\u5728Windows\u7CFB\u7EDF\u4E2D\uFF0C\u5E38\u89C1\u7684\u975E\u6613\u5931\u6027\u65E0\u6587\u4EF6\u5B58\u50A8\u793A\u4F8B\u5305\u62ECWindows\u6CE8\u518C\u8868\u3001\u4E8B\u4EF6\u65E5\u5FD7\u6216WMI\u5B58\u50A8\u5E93\u3002Linux\u7CFB\u7EDF\u4E0A\u7684\u5171\u4EAB\u5185\u5B58\u76EE\u5F55\uFF08\u5982\/dev\/shm\u3001\/run\/shm\u3001\/var\/run\u548C\/var\/lock\uFF09\u4EE5\u53CA\u7F51\u7EDC\u8BBE\u5907\u4E0A\u7684\u6613\u5931\u6027\u76EE\u5F55\uFF08\u5982\/tmp\u548C\/volatile\uFF09\u4E5F\u53EF\u88AB\u89C6\u4E3A\u65E0\u6587\u4EF6\u5B58\u50A8\uFF0C\u56E0\u4E3A\u5199\u5165\u8FD9\u4E9B\u76EE\u5F55\u7684\u6587\u4EF6\u4F1A\u76F4\u63A5\u6620\u5C04\u5230\u5185\u5B58\u4E2D\uFF0C\u800C\u975E\u5B58\u50A8\u5728\u78C1\u76D8\u4E0A\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/011\/"},{"id":"T1027.012","name":"LNK\u56FE\u6807\u8D70\u79C1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u6076\u610F\u547D\u4EE4\u9690\u85CF\u5728\u770B\u4F3C\u65E0\u5BB3\u7684Windows\u5FEB\u6377\u65B9\u5F0F\u6587\u4EF6\u4E2D\uFF0C\u4EE5\u7ED5\u8FC7\u5185\u5BB9\u8FC7\u6EE4\u5668\u4E0B\u8F7D\u6076\u610F\u8F7D\u8377\u3002Windows\u5FEB\u6377\u65B9\u5F0F\u6587\u4EF6\uFF08.LNK\uFF09\u5305\u542B\u591A\u4E2A\u5143\u6570\u636E\u5B57\u6BB5\uFF0C\u5176\u4E2D\u5305\u62EC\u4E00\u4E2A\u56FE\u6807\u4F4D\u7F6E\u5B57\u6BB5\uFF08\u4E5F\u79F0\u4E3AIconEnvironmentDataBlock\uFF09\uFF0C\u8BE5\u5B57\u6BB5\u7528\u4E8E\u6307\u5B9A\u5728\u4E3B\u673A\u76EE\u5F55\u4E2D\u4E3ALNK\u6587\u4EF6\u663E\u793A\u7684\u56FE\u6807\u6587\u4EF6\u8DEF\u5F84\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/012\/"},{"id":"T1027.013","name":"\u52A0\u5BC6\/\u7F16\u7801\u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52A0\u5BC6\u6216\u7F16\u7801\u6587\u4EF6\u6765\u6DF7\u6DC6\u5B57\u7B26\u4E32\u3001\u5B57\u8282\u53CA\u5176\u4ED6\u7279\u5B9A\u6A21\u5F0F\uFF0C\u4EE5\u963B\u788D\u68C0\u6D4B\u3002\u5BF9\u6587\u4EF6\u5185\u5BB9\u8FDB\u884C\u52A0\u5BC6\u548C\/\u6216\u7F16\u7801\u7684\u76EE\u7684\u5728\u4E8E\u9690\u85CF\u5165\u4FB5\u6240\u7528\u6587\u4EF6\u4E2D\u7684\u6076\u610F\u75D5\u8FF9\u3002\u8BB8\u591A\u5176\u4ED6\u6280\u672F\uFF0C\u5982\u8F6F\u4EF6\u52A0\u58F3\u3001\u9690\u5199\u672F\u548C\u5D4C\u5165\u5F0F\u8F7D\u8377\uFF0C\u90FD\u5171\u4EAB\u8FD9\u4E00\u5E7F\u6CDB\u76EE\u6807\u3002\u5BF9\u6587\u4EF6\u8FDB\u884C\u52A0\u5BC6\u548C\/\u6216\u7F16\u7801\u53EF\u80FD\u5BFC\u81F4\u9759\u6001\u7B7E\u540D\u68C0\u6D4B\u7684\u5931\u6548\uFF0C\u53EA\u6709\u5728\u6267\u884C\/\u4F7F\u7528\u65F6\uFF0C\u8FD9\u4E9B\u6076\u610F\u5185\u5BB9\u624D\u4F1A\u88AB\u63ED\u793A\uFF08\u5373\u53BB\u6DF7\u6DC6\/\u89E3\u7801\u6587\u4EF6\u6216\u4FE1\u606F\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/013\/"},{"id":"T1027.014","name":"\u591A\u6001\u4EE3\u7801","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u591A\u6001\u4EE3\u7801\uFF08\u4E5F\u79F0\u4E3A\u53D8\u5F62\u6216\u53D8\u5F02\u4EE3\u7801\uFF09\u6765\u89C4\u907F\u68C0\u6D4B\u3002\u591A\u6001\u4EE3\u7801\u662F\u4E00\u79CD\u80FD\u591F\u5728\u4EE3\u7801\u6267\u884C\u8FC7\u7A0B\u4E2D\u6539\u53D8\u5176\u8FD0\u884C\u65F6\u7279\u5F81\u7684\u8F6F\u4EF6\u7C7B\u578B\u3002\u6BCF\u6B21\u6267\u884C\u8BE5\u8F6F\u4EF6\u65F6\uFF0C\u4EE3\u7801\u90FD\u4F1A\u53D8\u5F02\u6210\u81EA\u8EAB\u7684\u4E00\u4E2A\u4E0D\u540C\u7248\u672C\uFF0C\u4F46\u5B9E\u73B0\u4E0E\u539F\u59CB\u7248\u672C\u76F8\u540C\u7684\u76EE\u7684\u6216\u76EE\u6807\u3002\u8FD9\u79CD\u529F\u80FD\u4F7F\u6076\u610F\u8F6F\u4EF6\u80FD\u591F\u89C4\u907F\u4F20\u7EDF\u7684\u57FA\u4E8E\u7B7E\u540D\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5982\u9632\u75C5\u6BD2\u548C\u53CD\u6076\u610F\u8F6F\u4EF6\u5DE5\u5177\u3002\u5176\u4ED6\u6DF7\u6DC6\u6280\u672F\u53EF\u4EE5\u4E0E\u591A\u6001\u4EE3\u7801\u7ED3\u5408\u4F7F\u7528\uFF0C\u4EE5\u5B9E\u73B0\u9884\u671F\u6548\u679C\uFF0C\u5305\u62EC\u4F7F\u7528\u53D8\u5F02\u5F15\u64CE\u6267\u884C\u8F6F\u4EF6\u6253\u5305\u3001\u547D\u4EE4\u6DF7\u6DC6\u6216\u52A0\u5BC6\/\u7F16\u7801\u6587\u4EF6\u7B49\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/014\/"},{"id":"T1027.015","name":"\u538B\u7F29","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u538B\u7F29\u6280\u672F\u6765\u6DF7\u6DC6\u5176\u6709\u6548\u8F7D\u8377\u6216\u6587\u4EF6\u3002\u8BF8\u5982ZIP\u3001gzip\u30017z\u548CRAR\u7B49\u538B\u7F29\u6587\u4EF6\u683C\u5F0F\u80FD\u591F\u5C06\u591A\u4E2A\u6587\u4EF6\u538B\u7F29\u5E76\u6253\u5305\u5728\u4E00\u8D77\uFF0C\u4EE5\u4FBF\u66F4\u4FBF\u6377\u3001\u5FEB\u901F\u5730\u4F20\u8F93\u6587\u4EF6\u3002\u9664\u4E86\u538B\u7F29\u6587\u4EF6\u5916\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u76F4\u63A5\u538B\u7F29shellcode\u2014\u2014\u4F8B\u5982\uFF0C\u4E3A\u4E86\u5C06\u5176\u5B58\u50A8\u5728Windows\u6CE8\u518C\u8868\u952E\u4E2D\uFF08\u5373\u65E0\u6587\u4EF6\u5B58\u50A8\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/015\/"},{"id":"T1027.016","name":"\u5783\u573E\u4EE3\u7801\u63D2\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u5783\u573E\u4EE3\u7801\u6216\u6B7B\u4EE3\u7801\u6765\u6DF7\u6DC6\u6076\u610F\u8F6F\u4EF6\u7684\u529F\u80FD\u3002\u5783\u573E\u4EE3\u7801\u662F\u6307\u90A3\u4E9B\u4E0D\u6267\u884C\uFF0C\u6216\u8005\u5373\u4F7F\u6267\u884C\u4E5F\u4E0D\u4F1A\u6539\u53D8\u4EE3\u7801\u529F\u80FD\u7684\u4EE3\u7801\u3002\u5783\u573E\u4EE3\u7801\u4F7F\u5F97\u5206\u6790\u5DE5\u4F5C\u53D8\u5F97\u66F4\u52A0\u56F0\u96BE\u548C\u8017\u65F6\uFF0C\u56E0\u4E3A\u5206\u6790\u4EBA\u5458\u9700\u8981\u9010\u6B65\u6392\u67E5\u975E\u529F\u80FD\u6027\u4EE3\u7801\uFF0C\u800C\u4E0D\u662F\u76F4\u63A5\u5206\u6790\u4E3B\u8981\u4EE3\u7801\u3002\u6B64\u5916\uFF0C\u7531\u4E8E\u4F7F\u7528\u4E86\u826F\u6027\u529F\u80FD\uFF0C\u5C24\u5176\u662F\u5728\u7ED3\u5408\u538B\u7F29\u6216\u8F6F\u4EF6\u6253\u5305\u6280\u672F\u65F6\uFF0C\u5783\u573E\u4EE3\u7801\u8FD8\u53EF\u80FD\u963B\u788D\u4F9D\u8D56\u9759\u6001\u4EE3\u7801\u5206\u6790\u7684\u68C0\u6D4B\u624B\u6BB5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/016\/"},{"id":"T1027.017","name":"SVG\u8D70\u79C1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5728\u770B\u4F3C\u65E0\u5BB3\u7684SVG\u6587\u4EF6\u4E2D\u9690\u85CF\u6076\u610F\u8F7D\u8377\uFF0C\u6765\u7ED5\u8FC7\u5185\u5BB9\u8FC7\u6EE4\u5668\u8D70\u79C1\u6570\u636E\u548C\u6587\u4EF6\u3002SVG\uFF0C\u5373\u53EF\u7F29\u653E\u77E2\u91CF\u56FE\u5F62\uFF0C\u662F\u57FA\u4E8E\u77E2\u91CF\u5E76\u4F7F\u7528XML\u6784\u5EFA\u7684\u56FE\u50CF\u6587\u4EF6\u3002\u56E0\u6B64\uFF0C\u5B83\u4EEC\u53EF\u4EE5\u5408\u6CD5\u5730\u5305\u542B&lt;script&gt;\u6807\u7B7E\uFF0C\u8FD9\u4F7F\u5F97\u653B\u51FB\u8005\u80FD\u591F\u5D4C\u5165\u6076\u610F\u7684JavaScript\u8F7D\u8377\u3002\u7136\u800C\uFF0C\u7531\u4E8ESVG\u901A\u5E38\u88AB\u89C6\u4E3A\u56FE\u50CF\u6587\u4EF6\uFF0C\u5B83\u4EEC\u53EF\u80FD\u6BD4\u5176\u4ED6\u7C7B\u578B\u7684\u53EF\u6267\u884C\u6587\u4EF6\u66F4\u4E0D\u6613\u5F15\u8D77\u7528\u6237\u7684\u6000\u7591\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/017\/"},{"id":"T1027","name":"\u6DF7\u6DC6\u6587\u4EF6\u6216\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52A0\u5BC6\u3001\u7F16\u7801\u6216\u5176\u4ED6\u65B9\u5F0F\u6DF7\u6DC6\u53EF\u6267\u884C\u6587\u4EF6\u6216\u6587\u4EF6\u7684\u5185\u5BB9\uFF0C\u4F7F\u5176\u5728\u7CFB\u7EDF\u4E0A\u6216\u4F20\u8F93\u8FC7\u7A0B\u4E2D\u96BE\u4EE5\u88AB\u53D1\u73B0\u6216\u5206\u6790\u3002\u8FD9\u662F\u4E00\u79CD\u5E38\u89C1\u884C\u4E3A\uFF0C\u53EF\u5728\u4E0D\u540C\u5E73\u53F0\u548C\u7F51\u7EDC\u4E0A\u4F7F\u7528\uFF0C\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002","sub-techniques":"T1027.001, T1027.002, T1027.003, T1027.004, T1027.005, T1027.006, T1027.007, T1027.008, T1027.009, T1027.010, T1027.011, T1027.012, T1027.013, T1027.014, T1027.015, T1027.016, T1027.017","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1027\/"},{"id":"T1029","name":"\u9884\u5B9A\u8F6C\u8D26","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5B89\u6392\u6570\u636E\u5916\u6CC4\u4EC5\u5728\u4E00\u5929\u4E2D\u7684\u7279\u5B9A\u65F6\u95F4\u6216\u7279\u5B9A\u95F4\u9694\u8FDB\u884C\u3002\u8FD9\u6837\u505A\u53EF\u80FD\u662F\u4E3A\u4E86\u5C06\u6D41\u91CF\u6A21\u5F0F\u4E0E\u6B63\u5E38\u6D3B\u52A8\u6216\u53EF\u7528\u6027\u76F8\u878D\u5408\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1029\/"},{"id":"T1030","name":"\u6570\u636E\u4F20\u8F93\u5927\u5C0F\u9650\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4EE5\u56FA\u5B9A\u5927\u5C0F\u7684\u6570\u636E\u5757\u800C\u975E\u6574\u4E2A\u6587\u4EF6\u7684\u5F62\u5F0F\u7A83\u53D6\u6570\u636E\uFF0C\u6216\u9650\u5236\u6570\u636E\u5305\u5927\u5C0F\u4F4E\u4E8E\u7279\u5B9A\u9608\u503C\u3002\u8FD9\u79CD\u65B9\u6CD5\u53EF\u7528\u4E8E\u89C4\u907F\u89E6\u53D1\u7F51\u7EDC\u6570\u636E\u4F20\u8F93\u9608\u503C\u8B66\u62A5\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1030\/"},{"id":"T1033","name":"\u7CFB\u7EDF\u6240\u6709\u8005\/\u7528\u6237\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u8BC6\u522B\u4E3B\u8981\u7528\u6237\u3001\u5F53\u524D\u767B\u5F55\u7528\u6237\u3001\u7CFB\u7EDF\u5E38\u7528\u7528\u6237\u7EC4\u6216\u7528\u6237\u662F\u5426\u6B63\u5728\u6D3B\u8DC3\u4F7F\u7528\u7CFB\u7EDF\u3002\u4F8B\u5982\uFF0C\u4ED6\u4EEC\u53EF\u80FD\u901A\u8FC7\u68C0\u7D22\u8D26\u6237\u7528\u6237\u540D\u6216\u5229\u7528\u64CD\u4F5C\u7CFB\u7EDF\u51ED\u8BC1\u8F6C\u50A8\u6765\u5B9E\u73B0\u8FD9\u4E00\u76EE\u7684\u3002\u7531\u4E8E\u7528\u6237\u548C\u7528\u6237\u540D\u4FE1\u606F\u904D\u5E03\u7CFB\u7EDF\u5404\u5904\uFF0C\u5305\u62EC\u8FD0\u884C\u8FDB\u7A0B\u6240\u6709\u6743\u3001\u6587\u4EF6\/\u76EE\u5F55\u6240\u6709\u6743\u3001\u4F1A\u8BDD\u4FE1\u606F\u548C\u7CFB\u7EDF\u65E5\u5FD7\u7B49\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u901A\u8FC7\u591A\u79CD\u5176\u4ED6\u4FA6\u5BDF\u6280\u672F\u8FDB\u884C\u6536\u96C6\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5728\u81EA\u52A8\u5316\u4FA6\u5BDF\u8FC7\u7A0B\u4E2D\u5229\u7528\u7CFB\u7EDF\u6240\u6709\u8005\/\u7528\u6237\u53D1\u73B0\u6240\u83B7\u4FE1\u606F\uFF0C\u4EE5\u8C03\u6574\u540E\u7EED\u884C\u52A8\u7B56\u7565\uFF0C\u5305\u62EC\u51B3\u5B9A\u662F\u5426\u5168\u9762\u611F\u67D3\u76EE\u6807\u53CA\/\u6216\u5C1D\u8BD5\u6267\u884C\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1033\/"},{"id":"T1036.001","name":"\u65E0\u6548\u7684\u4EE3\u7801\u7B7E\u540D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u6A21\u4EFF\u6709\u6548\u4EE3\u7801\u7B7E\u540D\u7684\u7279\u5F81\uFF0C\u4EE5\u589E\u52A0\u6B3A\u9A97\u7528\u6237\u3001\u5206\u6790\u5E08\u6216\u5DE5\u5177\u7684\u673A\u4F1A\u3002\u4EE3\u7801\u7B7E\u540D\u63D0\u4F9B\u4E86\u6765\u81EA\u5F00\u53D1\u8005\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E00\u5B9A\u7A0B\u5EA6\u7684\u771F\u5B9E\u6027\u4FDD\u8BC1\uFF0C\u5E76\u786E\u4FDD\u8BE5\u6587\u4EF6\u672A\u88AB\u7BE1\u6539\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u4ECE\u5DF2\u7B7E\u540D\u7684\u7A0B\u5E8F\u4E2D\u590D\u5236\u5143\u6570\u636E\u548C\u7B7E\u540D\u4FE1\u606F\uFF0C\u7136\u540E\u5C06\u5176\u7528\u4F5C\u672A\u7B7E\u540D\u7A0B\u5E8F\u7684\u6A21\u677F\u3002\u5177\u6709\u65E0\u6548\u4EE3\u7801\u7B7E\u540D\u7684\u6587\u4EF6\u5C06\u65E0\u6CD5\u901A\u8FC7\u6570\u5B57\u7B7E\u540D\u9A8C\u8BC1\u68C0\u67E5\uFF0C\u4F46\u5B83\u4EEC\u53EF\u80FD\u5BF9\u7528\u6237\u663E\u5F97\u66F4\u4E3A\u53EF\u4FE1\uFF0C\u4E14\u5B89\u5168\u5DE5\u5177\u53EF\u80FD\u4F1A\u4E0D\u5F53\u5904\u7406\u8FD9\u4E9B\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/001\/"},{"id":"T1036.002","name":"\u4ECE\u53F3\u5230\u5DE6\u8986\u76D6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u4ECE\u53F3\u81F3\u5DE6\u8986\u76D6\uFF08RTLO\u6216RLO\uFF09\u5B57\u7B26\uFF08U+202E\uFF09\u6765\u4F2A\u88C5\u5B57\u7B26\u4E32\u548C\/\u6216\u6587\u4EF6\u540D\uFF0C\u4F7F\u5176\u770B\u8D77\u6765\u65E0\u5BB3\u3002RTLO\u662F\u4E00\u4E2A\u975E\u6253\u5370\u7684Unicode\u5B57\u7B26\uFF0C\u4F1A\u5BFC\u81F4\u5176\u540E\u7684\u6587\u672C\u4EE5\u53CD\u5411\u663E\u793A\u3002\u4F8B\u5982\uFF0C\u4E00\u4E2A\u540D\u4E3AMarch 25 \\u202Excod.scr\u7684Windows\u5C4F\u5E55\u4FDD\u62A4\u7A0B\u5E8F\u53EF\u6267\u884C\u6587\u4EF6\u5C06\u663E\u793A\u4E3AMarch 25 rcs.docx\u3002\u4E00\u4E2A\u540D\u4E3Aphoto_high_re\\u202Egnp.js\u7684JavaScript\u6587\u4EF6\u5C06\u663E\u793A\u4E3Aphoto_high_resj.png\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/002\/"},{"id":"T1036.003","name":"\u91CD\u547D\u540D\u5408\u6CD5\u5B9E\u7528\u5DE5\u5177","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u91CD\u547D\u540D\u5408\u6CD5\u7684\u7CFB\u7EDF\u5DE5\u5177\uFF0C\u4EE5\u8BD5\u56FE\u89C4\u907F\u4E0E\u8FD9\u4E9B\u5DE5\u5177\u4F7F\u7528\u76F8\u5173\u7684\u5B89\u5168\u673A\u5236\u3002\u5BF9\u4E8E\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7684\u5408\u6CD5\u5DE5\u5177\uFF0C\u5305\u62EC\u5185\u7F6E\u4E8C\u8FDB\u5236\u6587\u4EF6\u4EE5\u53CA\u5982PSExec\u3001AutoHotKey\u548CIronPython\u7B49\u5DE5\u5177\uFF0C\u901A\u5E38\u8BBE\u6709\u5B89\u5168\u76D1\u63A7\u548C\u63A7\u5236\u673A\u5236\u3002\u901A\u8FC7\u5728\u4F7F\u7528\u524D\u91CD\u547D\u540D\u8FD9\u4E9B\u5DE5\u5177\uFF08\u4F8B\u5982\uFF1A\u91CD\u547D\u540Drundll32.exe\uFF09\uFF0C\u6709\u53EF\u80FD\u7ED5\u8FC7\u8FD9\u4E9B\u5B89\u5168\u673A\u5236\u3002\u53E6\u4E00\u79CD\u60C5\u51B5\u662F\uFF0C\u653B\u51FB\u8005\u5C06\u5408\u6CD5\u5DE5\u5177\u590D\u5236\u6216\u79FB\u52A8\u5230\u4E0D\u540C\u76EE\u5F55\u5E76\u91CD\u547D\u540D\uFF0C\u4EE5\u907F\u514D\u57FA\u4E8E\u8FD9\u4E9B\u5DE5\u5177\u4ECE\u975E\u6807\u51C6\u8DEF\u5F84\u6267\u884C\u7684\u68C0\u6D4B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/003\/"},{"id":"T1036.004","name":"\u4F2A\u88C5\u4EFB\u52A1\u6216\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u64CD\u7EB5\u4EFB\u52A1\u6216\u670D\u52A1\u7684\u540D\u79F0\uFF0C\u4F7F\u5176\u770B\u8D77\u6765\u5408\u6CD5\u6216\u65E0\u5BB3\u3002\u7531\u4EFB\u52A1\u8BA1\u5212\u7A0B\u5E8F\u6216systemd\u6267\u884C\u7684\u4EFB\u52A1\/\u670D\u52A1\u901A\u5E38\u4F1A\u88AB\u8D4B\u4E88\u540D\u79F0\u548C\/\u6216\u63CF\u8FF0\u3002Windows\u670D\u52A1\u5C06\u540C\u65F6\u5177\u6709\u670D\u52A1\u540D\u79F0\u548C\u663E\u793A\u540D\u79F0\u3002\u5B58\u5728\u8BB8\u591A\u5177\u6709\u5E38\u89C1\u5173\u8054\u540D\u79F0\u7684\u826F\u6027\u4EFB\u52A1\u548C\u670D\u52A1\u3002\u653B\u51FB\u8005\u53EF\u80FD\u7ED9\u4EFB\u52A1\u6216\u670D\u52A1\u8D77\u4E0E\u5408\u6CD5\u4EFB\u52A1\u6216\u670D\u52A1\u76F8\u4F3C\u6216\u76F8\u540C\u7684\u540D\u79F0\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/004\/"},{"id":"T1036.005","name":"\u5339\u914D\u5408\u6CD5\u8D44\u6E90\u540D\u79F0\u6216\u4F4D\u7F6E","description":"\u5BF9\u624B\u5728\u547D\u540D\u6216\u653E\u7F6E\u6587\u4EF6\u3001\u6CE8\u518C\u8868\u9879\u6216\u5176\u4ED6\u8D44\u6E90\u65F6\uFF0C\u53EF\u80FD\u4F1A\u6A21\u4EFF\u6216\u8FD1\u4F3C\u5408\u6CD5\u8D44\u6E90\u7684\u540D\u79F0\u6216\u4F4D\u7F6E\u3002\u6B64\u4E3E\u65E8\u5728\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u548C\u76D1\u63A7\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/005\/"},{"id":"T1036.006","name":"\u6587\u4EF6\u540D\u540E\u52A0\u7A7A\u683C","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u901A\u8FC7\u66F4\u6539\u6587\u4EF6\u6269\u5C55\u540D\u6765\u9690\u85CF\u7A0B\u5E8F\u7684\u771F\u5B9E\u6587\u4EF6\u7C7B\u578B\u3002\u5BF9\u4E8E\u67D0\u4E9B\u6587\u4EF6\u7C7B\u578B\uFF08\u7279\u522B\u662F\u5BF9.app\u6269\u5C55\u540D\u65E0\u6548\uFF09\uFF0C\u5728\u6587\u4EF6\u540D\u672B\u5C3E\u6DFB\u52A0\u7A7A\u683C\u4F1A\u6539\u53D8\u64CD\u4F5C\u7CFB\u7EDF\u5904\u7406\u8BE5\u6587\u4EF6\u7684\u65B9\u5F0F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/006\/"},{"id":"T1036.007","name":"\u53CC\u6587\u4EF6\u6269\u5C55\u540D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u6587\u4EF6\u540D\u7684\u53CC\u91CD\u6269\u5C55\u540D\u6765\u4F2A\u88C5\u771F\u5B9E\u6587\u4EF6\u7C7B\u578B\u3002\u6587\u4EF6\u540D\u53EF\u80FD\u5305\u542B\u6B21\u8981\u6587\u4EF6\u7C7B\u578B\u6269\u5C55\u540D\uFF0C\u5BFC\u81F4\u5728\u67D0\u4E9B\u89C6\u56FE\u4E2D\u4EC5\u663E\u793A\u7B2C\u4E00\u4E2A\u6269\u5C55\u540D\uFF08\u4F8B\u5982\uFF1AFile.txt.exe \u53EF\u80FD\u5728\u67D0\u4E9B\u89C6\u56FE\u4E2D\u4EC5\u663E\u793A\u4E3A File.txt\uFF09\u3002\u7136\u800C\uFF0C\u7B2C\u4E8C\u4E2A\u6269\u5C55\u540D\u624D\u662F\u51B3\u5B9A\u6587\u4EF6\u5982\u4F55\u6253\u5F00\u548C\u6267\u884C\u7684\u771F\u5B9E\u6587\u4EF6\u7C7B\u578B\u3002\u64CD\u4F5C\u7CFB\u7EDF\u5728\u6587\u4EF6\u6D4F\u89C8\u5668\uFF08\u4F8B\u5982\uFF1Aexplorer.exe\uFF09\u4E2D\u4EE5\u53CA\u4EFB\u4F55\u4F7F\u7528\u6216\u7C7B\u4F3C\u4E8E\u7CFB\u7EDF\u7B56\u7565\u914D\u7F6E\u7684\u8F6F\u4EF6\u4E2D\uFF0C\u53EF\u80FD\u4F1A\u9690\u85CF\u771F\u5B9E\u7684\u6587\u4EF6\u6269\u5C55\u540D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/007\/"},{"id":"T1036.008","name":"\u4F2A\u88C5\u6587\u4EF6\u7C7B\u578B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6539\u53D8\u6076\u610F\u8F7D\u8377\u7684\u683C\u5F0F\uFF0C\u5305\u62EC\u6587\u4EF6\u7684\u7B7E\u540D\u3001\u6269\u5C55\u540D\u3001\u56FE\u6807\u548C\u5185\u5BB9\uFF0C\u5C06\u5176\u4F2A\u88C5\u6210\u5408\u6CD5\u6587\u4EF6\u3002\u4E0D\u540C\u7C7B\u578B\u7684\u6587\u4EF6\u901A\u5E38\u6709\u6807\u51C6\u683C\u5F0F\uFF0C\u5305\u62EC\u7F16\u7801\u548C\u7EC4\u7EC7\u65B9\u5F0F\u3002\u4F8B\u5982\uFF0C\u6587\u4EF6\u7684\u7B7E\u540D\uFF08\u4E5F\u79F0\u4E3A\u6587\u4EF6\u5934\u6216\u9B54\u6570\uFF09\u662F\u6587\u4EF6\u5F00\u5934\u7684\u5B57\u8282\uFF0C\u5E38\u7528\u4E8E\u8BC6\u522B\u6587\u4EF6\u7C7B\u578B\u3002\u4EE5JPEG\u6587\u4EF6\u4E3A\u4F8B\uFF0C\u5176\u6587\u4EF6\u5934\u4E3A0xFF 0xD8\uFF0C\u6587\u4EF6\u6269\u5C55\u540D\u5219\u4E3A.JPE\u3001.JPEG\u6216.JPG\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/008\/"},{"id":"T1036.009","name":"\u4E2D\u65AD\u8FDB\u7A0B\u6811","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u5DF2\u6267\u884C\u6076\u610F\u8F6F\u4EF6\u7684\u7236\u8FDB\u7A0BID\uFF08PPID\uFF09\u6765\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u6811\u7684\u5206\u6790\u3002\u5982\u679C\u7EC8\u7AEF\u9632\u62A4\u8F6F\u4EF6\u4F9D\u8D56\"\u7236\u5B50\"\u5173\u7CFB\u8FDB\u884C\u68C0\u6D4B\uFF0C\u7834\u574F\u8FD9\u79CD\u5173\u7CFB\u53EF\u80FD\u5BFC\u81F4\u653B\u51FB\u8005\u7684\u884C\u4E3A\u65E0\u6CD5\u4E0E\u5148\u524D\u7684\u8FDB\u7A0B\u6811\u6D3B\u52A8\u5173\u8054\u3002\u5728\u57FA\u4E8EUnix\u7684\u7CFB\u7EDF\u4E2D\uFF0C\u7BA1\u7406\u5458\u901A\u8FC7\u811A\u672C\u548C\u7A0B\u5E8F\u6267\u884C\u8F6F\u4EF6\u65F6\uFF0C\u6253\u7834\u8FD9\u79CD\u8FDB\u7A0B\u6811\u5173\u7CFB\u662F\u5E38\u89C1\u505A\u6CD5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/009\/"},{"id":"T1036.010","name":"\u4F2A\u88C5\u8D26\u6237\u540D\u79F0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6A21\u4EFF\u6216\u8FD1\u4F3C\u5408\u6CD5\u8D26\u6237\u7684\u540D\u79F0\uFF0C\u4F7F\u65B0\u521B\u5EFA\u7684\u8D26\u6237\u770B\u8D77\u6765\u65E0\u5BB3\u3002\u8FD9\u79CD\u60C5\u51B5\u901A\u5E38\u53D1\u751F\u5728\u521B\u5EFA\u8D26\u6237\u65F6\uFF0C\u5C3D\u7BA1\u8D26\u6237\u4E5F\u53EF\u80FD\u5728\u4E4B\u540E\u88AB\u91CD\u547D\u540D\u3002\u5982\u679C\u653B\u51FB\u8005\u5148\u5220\u9664\u4E00\u4E2A\u8D26\u6237\uFF0C\u518D\u91CD\u65B0\u521B\u5EFA\u4E00\u4E2A\u540C\u540D\u8D26\u6237\uFF0C\u8FD9\u4E5F\u53EF\u80FD\u4E0E\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u79FB\u9664\u540C\u65F6\u53D1\u751F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/010\/"},{"id":"T1036.011","name":"\u8986\u76D6\u8FDB\u7A0B\u53C2\u6570","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4FEE\u6539\u8FDB\u7A0B\u5185\u5B58\u4E2D\u7684\u53C2\u6570\u4EE5\u6539\u53D8\u5176\u540D\u79F0\uFF0C\u4F7F\u5176\u770B\u8D77\u6765\u50CF\u4E00\u4E2A\u5408\u6CD5\u6216\u826F\u6027\u7684\u8FDB\u7A0B\u3002\u5728Linux\u7CFB\u7EDF\u4E2D\uFF0C\u64CD\u4F5C\u7CFB\u7EDF\u5C06\u547D\u4EE4\u884C\u53C2\u6570\u5B58\u50A8\u5728\u8FDB\u7A0B\u7684\u6808\u4E2D\uFF0C\u5E76\u5C06\u5B83\u4EEC\u4F5C\u4E3Aargv\u6570\u7EC4\u4F20\u9012\u7ED9main()\u51FD\u6570\u3002\u7B2C\u4E00\u4E2A\u5143\u7D20argv[0]\u901A\u5E38\u5305\u542B\u8FDB\u7A0B\u540D\u79F0\u6216\u8DEF\u5F84\u2014\u2014\u9ED8\u8BA4\u60C5\u51B5\u4E0B\uFF0C\u8FD9\u662F\u5B9E\u9645\u7528\u4E8E\u542F\u52A8\u8FDB\u7A0B\u7684\u547D\u4EE4\uFF08\u4F8B\u5982\uFF0Ccat \/etc\/passwd\uFF09\u3002\u9ED8\u8BA4\u60C5\u51B5\u4E0B\uFF0CLinux\u7684\/proc\u6587\u4EF6\u7CFB\u7EDF\u4F7F\u7528\u8FD9\u4E2A\u503C\u6765\u8868\u793A\u8FDB\u7A0B\u540D\u79F0\u3002\/proc\/<PID>\/cmdline\u6587\u4EF6\u53CD\u6620\u4E86\u8BE5\u5185\u5B58\u7684\u5185\u5BB9\uFF0C\u800C\u50CFps\u8FD9\u6837\u7684\u5DE5\u5177\u5219\u4F7F\u7528\u5B83\u6765\u663E\u793A\u8FDB\u7A0B\u4FE1\u606F\u3002\u7531\u4E8E\u53C2\u6570\u5728\u542F\u52A8\u65F6\u5B58\u50A8\u5728\u7528\u6237\u7A7A\u95F4\u5185\u5B58\u4E2D\uFF0C\u56E0\u6B64\u53EF\u4EE5\u5728\u6CA1\u6709\u63D0\u5347\u6743\u9650\u7684\u60C5\u51B5\u4E0B\u6267\u884C\u6B64\u4FEE\u6539\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/011\/"},{"id":"T1036.012","name":"\u6D4F\u89C8\u5668\u6307\u7EB9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4F2A\u9020\u6D4F\u89C8\u5668\u548C\u7CFB\u7EDF\u5C5E\u6027\uFF08\u5982\u64CD\u4F5C\u7CFB\u7EDF\u3001\u7CFB\u7EDF\u8BED\u8A00\u3001\u5E73\u53F0\u3001\u7528\u6237\u4EE3\u7406\u5B57\u7B26\u4E32\u3001\u5206\u8FA8\u7387\u3001\u65F6\u533A\u7B49\uFF09\u6765\u8BD5\u56FE\u6DF7\u5165\u5408\u6CD5\u6D41\u91CF\u4E2D\u3002HTTP\u7528\u6237\u4EE3\u7406\u8BF7\u6C42\u5934\u662F\u4E00\u4E2A\u5B57\u7B26\u4E32\uFF0C\u5B83\u5141\u8BB8\u670D\u52A1\u5668\u548C\u7F51\u7EDC\u5BF9\u7B49\u65B9\u8BC6\u522B\u8BF7\u6C42\u7528\u6237\u4EE3\u7406\u7684\u5E94\u7528\u7A0B\u5E8F\u3001\u64CD\u4F5C\u7CFB\u7EDF\u3001\u4F9B\u5E94\u5546\u548C\/\u6216\u7248\u672C\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/012\/"},{"id":"T1036","name":"\u4F2A\u88C5","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8BD5\u56FE\u64CD\u7EB5\u5176\u653B\u51FB\u5DE5\u5177\u7684\u7279\u5F81\uFF0C\u4F7F\u5176\u5728\u7528\u6237\u548C\/\u6216\u5B89\u5168\u5DE5\u5177\u9762\u524D\u663E\u5F97\u5408\u6CD5\u6216\u65E0\u5BB3\u3002\u4F2A\u88C5\u662F\u6307\u901A\u8FC7\u64CD\u7EB5\u6216\u6EE5\u7528\u5BF9\u8C61\uFF08\u65E0\u8BBA\u662F\u5408\u6CD5\u8FD8\u662F\u6076\u610F\u7684\uFF09\u7684\u540D\u79F0\u6216\u4F4D\u7F6E\uFF0C\u4EE5\u9003\u907F\u9632\u5FA1\u548C\u76D1\u6D4B\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u7BE1\u6539\u6587\u4EF6\u5143\u6570\u636E\u3001\u8BF1\u4F7F\u7528\u6237\u8BEF\u5224\u6587\u4EF6\u7C7B\u578B\uFF0C\u4EE5\u53CA\u4F7F\u7528\u5408\u6CD5\u7684\u4EFB\u52A1\u6216\u670D\u52A1\u540D\u79F0\u3002","sub-techniques":"T1036.001, T1036.002, T1036.003, T1036.004, T1036.005, T1036.006, T1036.007, T1036.008, T1036.009, T1036.010, T1036.011, T1036.012","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1036\/"},{"id":"T1037.001","name":"\u767B\u5F55\u811A\u672C\uFF08Windows\uFF09","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Windows\u767B\u5F55\u811A\u672C\u5728\u767B\u5F55\u521D\u59CB\u5316\u65F6\u81EA\u52A8\u6267\u884C\u7684\u7279\u70B9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u63A7\u5236\u3002Windows\u7CFB\u7EDF\u5141\u8BB8\u5728\u7279\u5B9A\u7528\u6237\u6216\u7528\u6237\u7EC4\u767B\u5F55\u65F6\u8FD0\u884C\u767B\u5F55\u811A\u672C\uFF0C\u8FD9\u53EF\u901A\u8FC7\u5728\u6CE8\u518C\u8868\u952EHKCU\\Environment\\UserInitMprLogonScript\u4E2D\u6DFB\u52A0\u811A\u672C\u8DEF\u5F84\u6765\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/001\/"},{"id":"T1037.002","name":"\u767B\u5F55\u94A9\u5B50","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u767B\u5F55\u94A9\u5B50\uFF08Login Hook\uFF09\u5728\u7528\u6237\u767B\u5F55\u65F6\u5EFA\u7ACB\u6301\u4E45\u5316\u673A\u5236\u3002\u767B\u5F55\u94A9\u5B50\u662F\u4E00\u4E2A\u5C5E\u6027\u5217\u8868\uFF08plist\uFF09\u6587\u4EF6\uFF0C\u6307\u5411\u7528\u6237\u767B\u5F55\u65F6\u4EE5\u6839\u6743\u9650\u6267\u884C\u7684\u7279\u5B9A\u811A\u672C\u3002\u8BE5plist\u6587\u4EF6\u4F4D\u4E8E\/Library\/Preferences\/com.apple.loginwindow.plist\u8DEF\u5F84\u4E0B\uFF0C\u53EF\u901A\u8FC7defaults\u547D\u4EE4\u884C\u5DE5\u5177\u8FDB\u884C\u4FEE\u6539\u3002\u6B64\u673A\u5236\u540C\u6837\u9002\u7528\u4E8E\u6CE8\u9500\u94A9\u5B50\uFF08logout hook\uFF09\uFF0C\u5373\u5728\u7528\u6237\u6CE8\u9500\u65F6\u6267\u884C\u811A\u672C\u3002\u6240\u6709\u94A9\u5B50\u7684\u4FEE\u6539\u6216\u521B\u5EFA\u5747\u9700\u7BA1\u7406\u5458\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/002\/"},{"id":"T1037.003","name":"\u7F51\u7EDC\u767B\u5F55\u811A\u672C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u767B\u5F55\u521D\u59CB\u5316\u65F6\u81EA\u52A8\u6267\u884C\u7684\u7F51\u7EDC\u767B\u5F55\u811A\u672C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u7F51\u7EDC\u767B\u5F55\u811A\u672C\u53EF\u901A\u8FC7Active Directory\u6216\u7EC4\u7B56\u7565\u5BF9\u8C61\u8FDB\u884C\u5206\u914D\u3002\u8FD9\u4E9B\u767B\u5F55\u811A\u672C\u4EE5\u5206\u914D\u7ED9\u7528\u6237\u7684\u6743\u9650\u8FD0\u884C\u3002\u6839\u636E\u7F51\u7EDC\u5185\u7684\u7CFB\u7EDF\u914D\u7F6E\uFF0C\u521D\u59CB\u5316\u6B64\u7C7B\u811A\u672C\u53EF\u80FD\u5F71\u54CD\u591A\u4E2A\u751A\u81F3\u6240\u6709\u7CFB\u7EDF\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/003\/"},{"id":"T1037.004","name":"RC\u811A\u672C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539RC\u811A\u672C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\uFF0C\u8FD9\u4E9B\u811A\u672C\u5728\u7C7BUnix\u7CFB\u7EDF\u542F\u52A8\u65F6\u6267\u884C\u3002\u8FD9\u4E9B\u6587\u4EF6\u5141\u8BB8\u7CFB\u7EDF\u7BA1\u7406\u5458\u5728\u4E0D\u540C\u8FD0\u884C\u7EA7\u522B\u6620\u5C04\u548C\u542F\u52A8\u81EA\u5B9A\u4E49\u670D\u52A1\u3002\u4FEE\u6539RC\u811A\u672C\u9700\u8981root\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/004\/"},{"id":"T1037.005","name":"\u542F\u52A8\u9879","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u542F\u52A8\u65F6\u81EA\u52A8\u6267\u884C\u7684\u542F\u52A8\u9879\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u542F\u52A8\u9879\u5728\u542F\u52A8\u8FC7\u7A0B\u7684\u6700\u540E\u9636\u6BB5\u6267\u884C\uFF0C\u5305\u542Bshell\u811A\u672C\u6216\u5176\u4ED6\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u4EE5\u53CA\u7CFB\u7EDF\u7528\u4E8E\u786E\u5B9A\u6240\u6709\u542F\u52A8\u9879\u6267\u884C\u987A\u5E8F\u7684\u914D\u7F6E\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/005\/"},{"id":"T1037","name":"\u542F\u52A8\u6216\u767B\u5F55\u521D\u59CB\u5316\u811A\u672C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5728\u7CFB\u7EDF\u542F\u52A8\u6216\u767B\u5F55\u521D\u59CB\u5316\u65F6\u81EA\u52A8\u6267\u884C\u7684\u811A\u672C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u521D\u59CB\u5316\u811A\u672C\u53EF\u7528\u4E8E\u6267\u884C\u7BA1\u7406\u529F\u80FD\uFF0C\u8FD9\u4E9B\u529F\u80FD\u901A\u5E38\u4F1A\u8FD0\u884C\u5176\u4ED6\u7A0B\u5E8F\u6216\u5C06\u4FE1\u606F\u53D1\u9001\u5230\u5185\u90E8\u65E5\u5FD7\u670D\u52A1\u5668\u3002\u8FD9\u4E9B\u811A\u672C\u53EF\u80FD\u56E0\u64CD\u4F5C\u7CFB\u7EDF\u4EE5\u53CA\u662F\u5728\u672C\u5730\u5E94\u7528\u8FD8\u662F\u8FDC\u7A0B\u5E94\u7528\u800C\u6709\u6240\u4E0D\u540C\u3002","sub-techniques":"T1037.001, T1037.002, T1037.003, T1037.004, T1037.005","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1037\/"},{"id":"T1039","name":"\u6765\u81EA\u7F51\u7EDC\u5171\u4EAB\u9A71\u52A8\u5668\u7684\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u5176\u5DF2\u653B\u9677\u7684\u8BA1\u7B97\u673A\u4E0A\u641C\u7D22\u7F51\u7EDC\u5171\u4EAB\uFF0C\u4EE5\u5BFB\u627E\u611F\u5174\u8DA3\u7684\u6587\u4EF6\u3002\u5728\u6570\u636E\u5916\u6CC4\u4E4B\u524D\uFF0C\u4ED6\u4EEC\u53EF\u4EE5\u4ECE\u5F53\u524D\u7CFB\u7EDF\u53EF\u8BBF\u95EE\u7684\u8FDC\u7A0B\u7CFB\u7EDF\uFF08\u5982\u4E3B\u673A\u5171\u4EAB\u76EE\u5F55\u3001\u7F51\u7EDC\u6587\u4EF6\u670D\u52A1\u5668\u7B49\uFF09\u901A\u8FC7\u5171\u4EAB\u7F51\u7EDC\u9A71\u52A8\u5668\u6536\u96C6\u654F\u611F\u6570\u636E\u3002\u4EA4\u4E92\u5F0F\u547D\u4EE4\u5916\u58F3\u53EF\u80FD\u88AB\u4F7F\u7528\uFF0C\u5E76\u4E14cmd\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\u53EF\u80FD\u88AB\u7528\u6765\u6536\u96C6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1039\/"},{"id":"T1040","name":"\u7F51\u7EDC\u55C5\u63A2","description":"\u653B\u51FB\u8005\u53EF\u80FD\u88AB\u52A8\u55C5\u63A2\u7F51\u7EDC\u6D41\u91CF\u4EE5\u6355\u83B7\u73AF\u5883\u4FE1\u606F\uFF0C\u5305\u62EC\u901A\u8FC7\u7F51\u7EDC\u4F20\u8F93\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u6750\u6599\u3002\u7F51\u7EDC\u55C5\u63A2\u6307\u7684\u662F\u5229\u7528\u7CFB\u7EDF\u4E0A\u7684\u7F51\u7EDC\u63A5\u53E3\u76D1\u89C6\u6216\u6355\u83B7\u901A\u8FC7\u6709\u7EBF\u6216\u65E0\u7EBF\u8FDE\u63A5\u53D1\u9001\u7684\u4FE1\u606F\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u7F51\u7EDC\u63A5\u53E3\u8BBE\u7F6E\u4E3A\u6DF7\u6742\u6A21\u5F0F\uFF0C\u4EE5\u88AB\u52A8\u8BBF\u95EE\u7F51\u7EDC\u4E2D\u4F20\u8F93\u7684\u6570\u636E\uFF0C\u6216\u4F7F\u7528\u955C\u50CF\u7AEF\u53E3\u6355\u83B7\u66F4\u5927\u91CF\u7684\u6570\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1040\/"},{"id":"T1041","name":"\u901A\u8FC7C2\u901A\u9053\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u73B0\u6709\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u7A83\u53D6\u6570\u636E\u3002\u88AB\u7A83\u53D6\u7684\u6570\u636E\u4F1A\u4F7F\u7528\u4E0E\u547D\u4EE4\u548C\u63A7\u5236\u901A\u4FE1\u76F8\u540C\u7684\u534F\u8BAE\uFF0C\u7F16\u7801\u5230\u6B63\u5E38\u7684\u901A\u4FE1\u901A\u9053\u4E2D\u8FDB\u884C\u4F20\u8F93\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1041\/"},{"id":"T1046","name":"\u7F51\u7EDC\u670D\u52A1\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u8FDC\u7A0B\u4E3B\u673A\u548C\u672C\u5730\u7F51\u7EDC\u57FA\u7840\u8BBE\u65BD\u8BBE\u5907\u4E0A\u8FD0\u884C\u7684\u670D\u52A1\u5217\u8868\uFF0C\u5305\u62EC\u90A3\u4E9B\u53EF\u80FD\u6613\u53D7\u8FDC\u7A0B\u8F6F\u4EF6\u5229\u7528\u7684\u670D\u52A1\u3002\u83B7\u53D6\u6B64\u7C7B\u4FE1\u606F\u7684\u5E38\u89C1\u65B9\u6CD5\u5305\u62EC\u4F7F\u7528\u690D\u5165\u7CFB\u7EDF\u7684\u5DE5\u5177\u8FDB\u884C\u7AEF\u53E3\u626B\u63CF\u3001\u6F0F\u6D1E\u626B\u63CF\u548C\/\u6216\u5B57\u5178\u626B\u63CF\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1046\/"},{"id":"T1047","name":"Windows \u7BA1\u7406\u89C4\u8303","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Windows\u7BA1\u7406\u89C4\u8303\uFF08WMI\uFF09\u6765\u6267\u884C\u6076\u610F\u547D\u4EE4\u548C\u8F7D\u8377\u3002WMI\u4E13\u4E3A\u7A0B\u5E8F\u5458\u8BBE\u8BA1\uFF0C\u662FWindows\u7CFB\u7EDF\u4E0A\u7BA1\u7406\u6570\u636E\u548C\u64CD\u4F5C\u7684\u57FA\u7840\u67B6\u6784\u3002\u4F5C\u4E3A\u4E00\u79CD\u7BA1\u7406\u529F\u80FD\uFF0CWMI\u63D0\u4F9B\u4E86\u4E00\u4E2A\u7EDF\u4E00\u7684\u73AF\u5883\u6765\u8BBF\u95EEWindows\u7CFB\u7EDF\u7EC4\u4EF6\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1047\/"},{"id":"T1048.001","name":"\u901A\u8FC7\u5BF9\u79F0\u52A0\u5BC6\u975EC2\u534F\u8BAE\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5BF9\u79F0\u52A0\u5BC6\u7684\u7F51\u7EDC\u534F\u8BAE\u7A83\u53D6\u6570\u636E\uFF0C\u800C\u975E\u4F7F\u7528\u73B0\u6709\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FD9\u4E9B\u6570\u636E\u4E5F\u53EF\u80FD\u88AB\u53D1\u9001\u81F3\u4E0E\u4E3B\u547D\u4EE4\u63A7\u5236\u670D\u52A1\u5668\u4E0D\u540C\u7684\u5907\u7528\u7F51\u7EDC\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1048\/001\/"},{"id":"T1048.002","name":"\u901A\u8FC7\u975EC2\u534F\u8BAE\u8FDB\u884C\u52A0\u5BC6\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u975E\u5BF9\u79F0\u52A0\u5BC6\u7F51\u7EDC\u534F\u8BAE\u7A83\u53D6\u6570\u636E\uFF0C\u800C\u975E\u4F7F\u7528\u73B0\u6709\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FD9\u4E9B\u6570\u636E\u4E5F\u53EF\u80FD\u88AB\u53D1\u9001\u81F3\u4E0E\u4E3B\u547D\u4EE4\u63A7\u5236\u670D\u52A1\u5668\u4E0D\u540C\u7684\u5907\u7528\u7F51\u7EDC\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1048\/002\/"},{"id":"T1048.003","name":"\u901A\u8FC7\u672A\u52A0\u5BC6\u975EC2\u534F\u8BAE\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u672A\u52A0\u5BC6\u7684\u7F51\u7EDC\u534F\u8BAE\u7A83\u53D6\u6570\u636E\uFF0C\u800C\u975E\u4F7F\u7528\u73B0\u6709\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FD9\u4E9B\u6570\u636E\u4E5F\u53EF\u80FD\u88AB\u53D1\u9001\u81F3\u4E0E\u4E3B\u547D\u4EE4\u63A7\u5236\u670D\u52A1\u5668\u4E0D\u540C\u7684\u5907\u7528\u7F51\u7EDC\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1048\/003\/"},{"id":"T1048","name":"\u901A\u8FC7\u66FF\u4EE3\u534F\u8BAE\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4E0D\u540C\u4E8E\u73B0\u6709\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u7684\u534F\u8BAE\u6765\u7A83\u53D6\u6570\u636E\uFF0C\u5E76\u5C06\u5176\u5916\u6CC4\u3002\u8FD9\u4E9B\u6570\u636E\u4E5F\u53EF\u80FD\u88AB\u53D1\u9001\u5230\u4E0E\u4E3B\u547D\u4EE4\u63A7\u5236\u670D\u52A1\u5668\u4E0D\u540C\u7684\u7F51\u7EDC\u4F4D\u7F6E\u3002","sub-techniques":"T1048.001, T1048.002, T1048.003","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1048\/"},{"id":"T1049","name":"\u7CFB\u7EDF\u7F51\u7EDC\u8FDE\u63A5\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u67E5\u8BE2\u7F51\u7EDC\u4FE1\u606F\uFF0C\u83B7\u53D6\u5F53\u524D\u8BBF\u95EE\u7684\u53D7\u611F\u67D3\u7CFB\u7EDF\u6216\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u7F51\u7EDC\u8FDE\u63A5\u5217\u8868\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1049\/"},{"id":"T1052.001","name":"\u901A\u8FC7USB\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7USB\u8FDE\u63A5\u7684\u7269\u7406\u8BBE\u5907\u5916\u6CC4\u6570\u636E\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u4F8B\u5982\u5728\u9694\u79BB\u7F51\u7EDC\u88AB\u653B\u7834\u65F6\uFF0C\u5916\u6CC4\u53EF\u80FD\u901A\u8FC7\u7528\u6237\u5F15\u5165\u7684USB\u8BBE\u5907\u53D1\u751F\u3002USB\u8BBE\u5907\u53EF\u7528\u4F5C\u6700\u7EC8\u7684\u6570\u636E\u5916\u6CC4\u70B9\uFF0C\u6216\u5728\u5176\u4ED6\u65AD\u5F00\u7684\u7CFB\u7EDF\u4E4B\u95F4\u8FDB\u884C\u8DF3\u8F6C\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1052\/001\/"},{"id":"T1052","name":"\u901A\u8FC7\u7269\u7406\u4ECB\u8D28\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u901A\u8FC7\u7269\u7406\u4ECB\u8D28\uFF08\u5982\u53EF\u79FB\u52A8\u9A71\u52A8\u5668\uFF09\u7A83\u53D6\u6570\u636E\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u4F8B\u5982\u9694\u79BB\u7F51\u7EDC\u906D\u5230\u5165\u4FB5\u65F6\uFF0C\u6570\u636E\u53EF\u80FD\u901A\u8FC7\u7528\u6237\u5F15\u5165\u7684\u7269\u7406\u4ECB\u8D28\u6216\u8BBE\u5907\u88AB\u7A83\u53D6\u3002\u8FD9\u7C7B\u4ECB\u8D28\u53EF\u4EE5\u662F\u5916\u90E8\u786C\u76D8\u3001USB\u9A71\u52A8\u5668\u3001\u624B\u673A\u3001MP3\u64AD\u653E\u5668\u6216\u5176\u4ED6\u53EF\u79FB\u52A8\u5B58\u50A8\u548C\u5904\u7406\u8BBE\u5907\u3002\u7269\u7406\u4ECB\u8D28\u6216\u8BBE\u5907\u53EF\u80FD\u88AB\u7528\u4F5C\u6700\u7EC8\u7684\u6570\u636E\u7A83\u53D6\u70B9\uFF0C\u6216\u5728\u539F\u672C\u65AD\u5F00\u7684\u7CFB\u7EDF\u4E4B\u95F4\u8FDB\u884C\u8DF3\u8F6C\u3002","sub-techniques":"T1052.001","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1052\/"},{"id":"T1053.002","name":"\u5728","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528at\u5DE5\u5177\u6765\u6267\u884C\u4EFB\u52A1\u8C03\u5EA6\uFF0C\u4EE5\u5B9E\u73B0\u6076\u610F\u4EE3\u7801\u7684\u521D\u59CB\u6216\u91CD\u590D\u6267\u884C\u3002at\u5DE5\u5177\u4F5C\u4E3A\u53EF\u6267\u884C\u6587\u4EF6\u5B58\u5728\u4E8EWindows\u3001Linux\u548CmacOS\u7CFB\u7EDF\u4E2D\uFF0C\u7528\u4E8E\u5728\u6307\u5B9A\u7684\u65F6\u95F4\u548C\u65E5\u671F\u8C03\u5EA6\u4EFB\u52A1\u3002\u5C3D\u7BA1\u5728Windows\u73AF\u5883\u4E2D\uFF0Cat\u5DF2\u88AB\u8BA1\u5212\u4EFB\u52A1\u7684schtasks\u6240\u53D6\u4EE3\uFF0C\u4F46\u4F7F\u7528at\u9700\u8981\u4EFB\u52A1\u8C03\u5EA6\u5668\u670D\u52A1\u6B63\u5728\u8FD0\u884C\uFF0C\u5E76\u4E14\u7528\u6237\u5FC5\u987B\u4EE5\u672C\u5730\u7BA1\u7406\u5458\u7EC4\u6210\u5458\u7684\u8EAB\u4EFD\u767B\u5F55\u3002\u9664\u4E86\u663E\u5F0F\u8FD0\u884Cat\u547D\u4EE4\u5916\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u901A\u8FC7\u76F4\u63A5\u5229\u7528Windows\u7BA1\u7406\u89C4\u8303\uFF08WMI\uFF09\u4E2D\u7684Win32_ScheduledJob WMI\u7C7B\u6765\u4F7F\u7528at\u8C03\u5EA6\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/002\/"},{"id":"T1053.003","name":"Cron","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528cron\u5DE5\u5177\u6765\u6267\u884C\u4EFB\u52A1\u8C03\u5EA6\uFF0C\u4EE5\u5B9E\u73B0\u6076\u610F\u4EE3\u7801\u7684\u521D\u59CB\u6216\u91CD\u590D\u6267\u884C\u3002cron\u5DE5\u5177\u662F\u4E00\u79CD\u57FA\u4E8E\u65F6\u95F4\u7684\u4F5C\u4E1A\u8C03\u5EA6\u5668\uFF0C\u9002\u7528\u4E8E\u7C7BUnix\u64CD\u4F5C\u7CFB\u7EDF\u3002crontab\u6587\u4EF6\u5305\u542B\u8981\u8FD0\u884C\u7684cron\u6761\u76EE\u8BA1\u5212\u53CA\u5176\u6307\u5B9A\u7684\u6267\u884C\u65F6\u95F4\u3002\u6240\u6709crontab\u6587\u4EF6\u90FD\u5B58\u50A8\u5728\u64CD\u4F5C\u7CFB\u7EDF\u7279\u5B9A\u7684\u6587\u4EF6\u8DEF\u5F84\u4E2D\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"ESXi,Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/003\/"},{"id":"T1053.005","name":"\u8BA1\u5212\u4EFB\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Windows\u4EFB\u52A1\u8BA1\u5212\u7A0B\u5E8F\u6765\u5B89\u6392\u6076\u610F\u4EE3\u7801\u7684\u521D\u59CB\u6216\u91CD\u590D\u6267\u884C\u3002\u5728Windows\u4E2D\u8BBF\u95EE\u4EFB\u52A1\u8BA1\u5212\u7A0B\u5E8F\u6709\u591A\u79CD\u65B9\u5F0F\u3002\u53EF\u4EE5\u76F4\u63A5\u5728\u547D\u4EE4\u884C\u8FD0\u884Cschtasks\u5B9E\u7528\u7A0B\u5E8F\uFF0C\u4E5F\u53EF\u4EE5\u901A\u8FC7\u63A7\u5236\u9762\u677F\u7684\u7BA1\u7406\u5DE5\u5177\u90E8\u5206\u4E2D\u7684\u56FE\u5F62\u7528\u6237\u754C\u9762\u6253\u5F00\u4EFB\u52A1\u8BA1\u5212\u7A0B\u5E8F\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u653B\u51FB\u8005\u4F7F\u7528\u4E86Windows\u4EFB\u52A1\u8BA1\u5212\u7A0B\u5E8F\u7684.NET\u5305\u88C5\u5668\uFF0C\u6216\u8005\u5229\u7528Windows netapi32\u5E93\u548CWindows\u7BA1\u7406\u89C4\u8303\uFF08WMI\uFF09\u6765\u521B\u5EFA\u8BA1\u5212\u4EFB\u52A1\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5229\u7528PowerShell Cmdlet Invoke-CimMethod\uFF0C\u8BE5\u65B9\u6CD5\u901A\u8FC7WMI\u7C7BPS_ScheduledTask\uFF0C\u501F\u52A9XML\u8DEF\u5F84\u6765\u521B\u5EFA\u8BA1\u5212\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/005\/"},{"id":"T1053.006","name":"Systemd \u5B9A\u65F6\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528systemd\u5B9A\u65F6\u5668\u6765\u6267\u884C\u4EFB\u52A1\u8C03\u5EA6\uFF0C\u4EE5\u5B9E\u73B0\u6076\u610F\u4EE3\u7801\u7684\u521D\u59CB\u6216\u91CD\u590D\u6267\u884C\u3002Systemd\u5B9A\u65F6\u5668\u662F\u4EE5.timer\u4E3A\u6269\u5C55\u540D\u7684\u5355\u5143\u6587\u4EF6\uFF0C\u7528\u4E8E\u63A7\u5236\u670D\u52A1\u3002\u8FD9\u4E9B\u5B9A\u65F6\u5668\u53EF\u4EE5\u8BBE\u7F6E\u4E3A\u5728\u65E5\u5386\u4E8B\u4EF6\u89E6\u53D1\u65F6\u8FD0\u884C\uFF0C\u6216\u5728\u76F8\u5BF9\u4E8E\u67D0\u4E2A\u8D77\u59CB\u70B9\u7684\u65F6\u95F4\u95F4\u9694\u540E\u6267\u884C\u3002\u5728Linux\u73AF\u5883\u4E2D\uFF0C\u5B83\u4EEC\u53EF\u4F5C\u4E3ACron\u7684\u66FF\u4EE3\u65B9\u6848\u3002Systemd\u5B9A\u65F6\u5668\u53EF\u901A\u8FC7systemctl\u547D\u4EE4\u884C\u5DE5\u5177\u8FDC\u7A0B\u6FC0\u6D3B\uFF0C\u8BE5\u5DE5\u5177\u901A\u8FC7SSH\u8FDB\u884C\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/006\/"},{"id":"T1053.007","name":"\u5BB9\u5668\u7F16\u6392\u4F5C\u4E1A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5BB9\u5668\u7F16\u6392\u5DE5\u5177\uFF08\u5982Kubernetes\uFF09\u63D0\u4F9B\u7684\u4EFB\u52A1\u8C03\u5EA6\u529F\u80FD\uFF0C\u6765\u5B89\u6392\u90E8\u7F72\u914D\u7F6E\u4E3A\u6267\u884C\u6076\u610F\u4EE3\u7801\u7684\u5BB9\u5668\u3002\u5BB9\u5668\u7F16\u6392\u4F5C\u4E1A\u4F1A\u5728\u7279\u5B9A\u65E5\u671F\u548C\u65F6\u95F4\u8FD0\u884C\u8FD9\u4E9B\u81EA\u52A8\u5316\u4EFB\u52A1\uFF0C\u7C7B\u4F3C\u4E8ELinux\u7CFB\u7EDF\u4E2D\u7684cron\u4F5C\u4E1A\u3002\u6B64\u7C7B\u90E8\u7F72\u8FD8\u53EF\u4EE5\u914D\u7F6E\u4E3A\u968F\u65F6\u95F4\u7EF4\u6301\u4E00\u5B9A\u6570\u91CF\u7684\u5BB9\u5668\uFF0C\u4ECE\u800C\u81EA\u52A8\u5316\u5728\u96C6\u7FA4\u5185\u7EF4\u6301\u6301\u4E45\u6027\u7684\u8FC7\u7A0B\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/007\/"},{"id":"T1053","name":"\u8BA1\u5212\u4EFB\u52A1\/\u4F5C\u4E1A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u4EFB\u52A1\u8C03\u5EA6\u529F\u80FD\uFF0C\u4EE5\u4FC3\u8FDB\u6076\u610F\u4EE3\u7801\u7684\u521D\u59CB\u6216\u91CD\u590D\u6267\u884C\u3002\u6240\u6709\u4E3B\u6D41\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u90FD\u5B58\u5728\u7528\u4E8E\u5728\u6307\u5B9A\u65E5\u671F\u548C\u65F6\u95F4\u8C03\u5EA6\u7A0B\u5E8F\u6216\u811A\u672C\u6267\u884C\u7684\u5B9E\u7528\u5DE5\u5177\u3002\u53EA\u8981\u6EE1\u8DB3\u9002\u5F53\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u6761\u4EF6\uFF08\u4F8B\u5982\uFF0C\u5728Windows\u73AF\u5883\u4E2D\u7684RPC\u53CA\u6587\u4EF6\u548C\u6253\u5370\u673A\u5171\u4EAB\uFF09\uFF0C\u4EFB\u52A1\u4E5F\u53EF\u4EE5\u5728\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u8C03\u5EA6\u3002\u5728\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u8C03\u5EA6\u4EFB\u52A1\u901A\u5E38\u9700\u8981\u6210\u4E3A\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u7BA1\u7406\u5458\u6216\u5176\u4ED6\u7279\u6743\u7EC4\u7684\u6210\u5458\u3002","sub-techniques":"T1053.002, T1053.003, T1053.005, T1053.006, T1053.007","tactic":"\u6267\u884C,\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668,ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1053\/"},{"id":"T1055.001","name":"\u52A8\u6001\u94FE\u63A5\u5E93\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\u6CE8\u5165\u5230\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002DLL\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/001\/"},{"id":"T1055.002","name":"\u53EF\u79FB\u690D\u53EF\u6267\u884C\u6587\u4EF6\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u53EF\u79FB\u690D\u53EF\u6267\u884C\u6587\u4EF6\uFF08PE\uFF09\u6CE8\u5165\u5230\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002PE\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/002\/"},{"id":"T1055.003","name":"\u7EBF\u7A0B\u6267\u884C\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6076\u610F\u4EE3\u7801\u6CE8\u5165\u88AB\u52AB\u6301\u7684\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002\u7EBF\u7A0B\u6267\u884C\u52AB\u6301\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/003\/"},{"id":"T1055.004","name":"\u5F02\u6B65\u8FC7\u7A0B\u8C03\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5F02\u6B65\u8FC7\u7A0B\u8C03\u7528\uFF08APC\uFF09\u961F\u5217\u5411\u8FDB\u7A0B\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002APC\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/004\/"},{"id":"T1055.005","name":"\u7EBF\u7A0B\u672C\u5730\u5B58\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7EBF\u7A0B\u672C\u5730\u5B58\u50A8\uFF08TLS\uFF09\u56DE\u8C03\u5411\u8FDB\u7A0B\u4E2D\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002TLS\u56DE\u8C03\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/005\/"},{"id":"T1055.008","name":"Ptrace \u7CFB\u7EDF\u8C03\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7ptrace\uFF08\u8FDB\u7A0B\u8DDF\u8E2A\uFF09\u7CFB\u7EDF\u8C03\u7528\u5411\u8FDB\u7A0B\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002Ptrace\u7CFB\u7EDF\u8C03\u7528\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/008\/"},{"id":"T1055.009","name":"\u5185\u5B58\u8FDB\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\/proc\u6587\u4EF6\u7CFB\u7EDF\u5411\u8FDB\u7A0B\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002Proc\u5185\u5B58\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/009\/"},{"id":"T1055.011","name":"\u989D\u5916\u7A97\u53E3\u5185\u5B58\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u989D\u5916\u7A97\u53E3\u5185\u5B58\uFF08EWM\uFF09\u5411\u8FDB\u7A0B\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002EWM\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/011\/"},{"id":"T1055.012","name":"\u8FDB\u7A0B\u9542\u7A7A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u6076\u610F\u4EE3\u7801\u6CE8\u5165\u5230\u88AB\u6302\u8D77\u548C\u638F\u7A7A\u7684\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\u3002\u8FDB\u7A0B\u638F\u7A7A\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/012\/"},{"id":"T1055.013","name":"\u8FDB\u7A0B\u66FF\u8EAB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8FDB\u7A0B\u66FF\u8EAB\u6280\u672F\u5411\u8FDB\u7A0B\u4E2D\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002\u8FDB\u7A0B\u66FF\u8EAB\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/013\/"},{"id":"T1055.014","name":"VDSO\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u865A\u62DF\u52A8\u6001\u5171\u4EAB\u5BF9\u8C61\uFF08VDSO\uFF09\u52AB\u6301\u5411\u8FDB\u7A0B\u4E2D\u6CE8\u5165\u6076\u610F\u4EE3\u7801\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002\u865A\u62DF\u52A8\u6001\u5171\u4EAB\u5BF9\u8C61\u52AB\u6301\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/014\/"},{"id":"T1055.015","name":"\u690D\u7269\u6E05\u5355","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5217\u8868\u89C6\u56FE\u63A7\u4EF6\uFF0C\u5C06\u6076\u610F\u4EE3\u7801\u6CE8\u5165\u88AB\u52AB\u6301\u7684\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002\u5217\u8868\u690D\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002\u901A\u8FC7\u5217\u8868\u690D\u5165\u6267\u884C\u7684\u4EE3\u7801\u8FD8\u53EF\u80FD\u9003\u907F\u5B89\u5168\u4EA7\u54C1\u7684\u68C0\u6D4B\uFF0C\u56E0\u4E3A\u5176\u6267\u884C\u8FC7\u7A0B\u88AB\u63A9\u76D6\u5728\u5408\u6CD5\u8FDB\u7A0B\u4E4B\u4E0B\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/015\/"},{"id":"T1055","name":"\u8FDB\u7A0B\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u4EE3\u7801\u6CE8\u5165\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u89C4\u907F\u57FA\u4E8E\u8FDB\u7A0B\u7684\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u53EF\u80FD\u63D0\u5347\u6743\u9650\u3002\u8FDB\u7A0B\u6CE8\u5165\u662F\u4E00\u79CD\u5728\u72EC\u7ACB\u6D3B\u52A8\u8FDB\u7A0B\u7684\u5730\u5740\u7A7A\u95F4\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u7684\u65B9\u6CD5\u3002\u5728\u53E6\u4E00\u4E2A\u8FDB\u7A0B\u7684\u4E0A\u4E0B\u6587\u4E2D\u8FD0\u884C\u4EE3\u7801\uFF0C\u53EF\u80FD\u5141\u8BB8\u8BBF\u95EE\u8BE5\u8FDB\u7A0B\u7684\u5185\u5B58\u3001\u7CFB\u7EDF\/\u7F51\u7EDC\u8D44\u6E90\uFF0C\u5E76\u53EF\u80FD\u83B7\u5F97\u63D0\u5347\u7684\u6743\u9650\u3002\u901A\u8FC7\u8FDB\u7A0B\u6CE8\u5165\u6267\u884C\u4EE3\u7801\u8FD8\u53EF\u80FD\u9003\u907F\u5B89\u5168\u4EA7\u54C1\u7684\u68C0\u6D4B\uFF0C\u56E0\u4E3A\u6267\u884C\u8FC7\u7A0B\u88AB\u9690\u85CF\u5728\u5408\u6CD5\u8FDB\u7A0B\u4E4B\u4E0B\u3002","sub-techniques":"T1055.001, T1055.002, T1055.003, T1055.004, T1055.005, T1055.008, T1055.009, T1055.011, T1055.012, T1055.013, T1055.014, T1055.015","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1055\/"},{"id":"T1056.001","name":"\u952E\u76D8\u8BB0\u5F55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8BB0\u5F55\u7528\u6237\u51FB\u952E\u6765\u622A\u83B7\u7528\u6237\u8F93\u5165\u7684\u51ED\u8BC1\u3002\u5F53\u64CD\u4F5C\u7CFB\u7EDF\u51ED\u8BC1\u8F6C\u50A8\u624B\u6BB5\u6548\u679C\u4E0D\u4F73\u65F6\uFF0C\u952E\u76D8\u8BB0\u5F55\u5F88\u53EF\u80FD\u88AB\u7528\u4E8E\u83B7\u53D6\u65B0\u8BBF\u95EE\u673A\u4F1A\u7684\u51ED\u8BC1\uFF0C\u5E76\u4E14\u53EF\u80FD\u9700\u8981\u653B\u51FB\u8005\u5728\u7CFB\u7EDF\u4E0A\u957F\u65F6\u95F4\u62E6\u622A\u51FB\u952E\u624D\u80FD\u6210\u529F\u6355\u83B7\u51ED\u8BC1\u3002\u4E3A\u4E86\u63D0\u9AD8\u5FEB\u901F\u6355\u83B7\u51ED\u8BC1\u7684\u53EF\u80FD\u6027\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u91C7\u53D6\u8BF8\u5982\u6E05\u9664\u6D4F\u89C8\u5668cookie\u7B49\u64CD\u4F5C\uFF0C\u4EE5\u8FEB\u4F7F\u7528\u6237\u91CD\u65B0\u5411\u7CFB\u7EDF\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1056\/001\/"},{"id":"T1056.002","name":"\u56FE\u5F62\u7528\u6237\u754C\u9762\u8F93\u5165\u6355\u83B7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6A21\u4EFF\u5E38\u89C1\u7684\u64CD\u4F5C\u7CFB\u7EDF\u56FE\u5F62\u7528\u6237\u754C\u9762\u7EC4\u4EF6\uFF0C\u4EE5\u770B\u4F3C\u5408\u6CD5\u7684\u63D0\u793A\u6846\u8BF1\u4F7F\u7528\u6237\u8F93\u5165\u51ED\u636E\u3002\u5F53\u6267\u884C\u9700\u8981\u6BD4\u5F53\u524D\u7528\u6237\u4E0A\u4E0B\u6587\u66F4\u9AD8\u6743\u9650\u7684\u7A0B\u5E8F\u65F6\uFF0C\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u4F1A\u63D0\u793A\u7528\u6237\u8F93\u5165\u6B63\u786E\u7684\u51ED\u636E\uFF0C\u4EE5\u6388\u6743\u8BE5\u4EFB\u52A1\u63D0\u5347\u6743\u9650\uFF08\u4F8B\u5982\uFF1A\u7ED5\u8FC7\u7528\u6237\u8D26\u6237\u63A7\u5236\uFF09\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1056\/002\/"},{"id":"T1056.003","name":"\u7F51\u7EDC\u95E8\u6237\u6355\u83B7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u5916\u90E8\u95E8\u6237\u7F51\u7AD9\uFF08\u5982VPN\u767B\u5F55\u9875\u9762\uFF09\u4E0A\u690D\u5165\u4EE3\u7801\uFF0C\u4EE5\u6355\u83B7\u5E76\u4F20\u8F93\u5C1D\u8BD5\u767B\u5F55\u670D\u52A1\u7684\u7528\u6237\u51ED\u8BC1\u3002\u4F8B\u5982\uFF0C\u88AB\u7BE1\u6539\u7684\u767B\u5F55\u9875\u9762\u53EF\u80FD\u4F1A\u5728\u7528\u6237\u767B\u5F55\u670D\u52A1\u4E4B\u524D\uFF0C\u8BB0\u5F55\u5176\u63D0\u4F9B\u7684\u7528\u6237\u51ED\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1056\/003\/"},{"id":"T1056.004","name":"\u51ED\u8BC1API\u6302\u94A9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6302\u94A9Windows\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\u51FD\u6570\u548CLinux\u7CFB\u7EDF\u51FD\u6570\u6765\u6536\u96C6\u7528\u6237\u51ED\u636E\u3002\u6076\u610F\u6302\u94A9\u673A\u5236\u53EF\u80FD\u6355\u83B7\u5305\u542B\u63ED\u793A\u7528\u6237\u8BA4\u8BC1\u51ED\u636E\u53C2\u6570\u7684API\u6216\u51FD\u6570\u8C03\u7528\u3002\u4E0E\u952E\u76D8\u8BB0\u5F55\u4E0D\u540C\uFF0C\u6B64\u6280\u672F\u4E13\u95E8\u9488\u5BF9\u90A3\u4E9B\u5305\u542B\u63ED\u793A\u7528\u6237\u51ED\u636E\u53C2\u6570\u7684API\u51FD\u6570\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1056\/004\/"},{"id":"T1056","name":"\u8F93\u5165\u6355\u83B7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u91C7\u7528\u6355\u83B7\u7528\u6237\u8F93\u5165\u7684\u65B9\u6CD5\u6765\u83B7\u53D6\u51ED\u8BC1\u6216\u6536\u96C6\u4FE1\u606F\u3002\u5728\u6B63\u5E38\u7CFB\u7EDF\u4F7F\u7528\u8FC7\u7A0B\u4E2D\uFF0C\u7528\u6237\u7ECF\u5E38\u9700\u8981\u5411\u591A\u4E2A\u4E0D\u540C\u4F4D\u7F6E\u63D0\u4F9B\u51ED\u8BC1\uFF0C\u4F8B\u5982\u767B\u5F55\u9875\u9762\/\u95E8\u6237\u6216\u7CFB\u7EDF\u5BF9\u8BDD\u6846\u3002\u8F93\u5165\u6355\u83B7\u673A\u5236\u53EF\u80FD\u5BF9\u7528\u6237\u900F\u660E\uFF08\u4F8B\u5982\u51ED\u8BC1API\u94A9\u5B50\u6280\u672F\uFF09\uFF0C\u4E5F\u53EF\u80FD\u4F9D\u8D56\u6B3A\u9A97\u624B\u6BB5\uFF0C\u8BF1\u4F7F\u7528\u6237\u5411\u770B\u4F3C\u5408\u6CD5\u7684\u670D\u52A1\u63D0\u4F9B\u8F93\u5165\u4FE1\u606F\uFF08\u4F8B\u5982\u7F51\u9875\u95E8\u6237\u6355\u83B7\uFF09\u3002","sub-techniques":"T1056.001, T1056.002, T1056.003, T1056.004","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1056\/"},{"id":"T1057","name":"\u6D41\u7A0B\u6316\u6398","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u7CFB\u7EDF\u4E0A\u8FD0\u884C\u8FDB\u7A0B\u7684\u4FE1\u606F\u3002\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u4E86\u89E3\u7F51\u7EDC\u5185\u7CFB\u7EDF\u4E0A\u8FD0\u884C\u7684\u5E38\u89C1\u8F6F\u4EF6\/\u5E94\u7528\u7A0B\u5E8F\u3002\u7BA1\u7406\u5458\u6216\u66F4\u9AD8\u6743\u9650\u7684\u8BBF\u95EE\u53EF\u80FD\u63D0\u4F9B\u66F4\u8BE6\u7EC6\u7684\u8FDB\u7A0B\u4FE1\u606F\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u5229\u7528\u8FDB\u7A0B\u53D1\u73B0\u6240\u83B7\u5F97\u7684\u4FE1\u606F\uFF0C\u6765\u8C03\u6574\u540E\u7EED\u884C\u4E3A\uFF0C\u5305\u62EC\u51B3\u5B9A\u662F\u5426\u5B8C\u5168\u611F\u67D3\u76EE\u6807\u53CA\/\u6216\u5C1D\u8BD5\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1057\/"},{"id":"T1059.001","name":"PowerShell","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528PowerShell\u547D\u4EE4\u548C\u811A\u672C\u8FDB\u884C\u653B\u51FB\u3002PowerShell\u662FWindows\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u5305\u542B\u7684\u5F3A\u5927\u4EA4\u4E92\u5F0F\u547D\u4EE4\u884C\u754C\u9762\u548C\u811A\u672C\u73AF\u5883\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528PowerShell\u6267\u884C\u591A\u79CD\u64CD\u4F5C\uFF0C\u5305\u62EC\u4FE1\u606F\u63A2\u6D4B\u548C\u4EE3\u7801\u6267\u884C\u3002\u4F8B\u5982\uFF0CStart-Process cmdlet\u53EF\u7528\u4E8E\u8FD0\u884C\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u800CInvoke-Command cmdlet\u53EF\u5728\u672C\u5730\u6216\u8FDC\u7A0B\u8BA1\u7B97\u673A\u4E0A\u8FD0\u884C\u547D\u4EE4\uFF08\u5C3D\u7BA1\u4F7F\u7528PowerShell\u8FDE\u63A5\u8FDC\u7A0B\u7CFB\u7EDF\u9700\u8981\u7BA1\u7406\u5458\u6743\u9650\uFF09\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/001\/"},{"id":"T1059.002","name":"AppleScript","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528AppleScript\u8FDB\u884C\u6267\u884C\u64CD\u4F5C\u3002AppleScript\u662F\u4E00\u79CDmacOS\u811A\u672C\u8BED\u8A00\uFF0C\u65E8\u5728\u901A\u8FC7\u79F0\u4E3AAppleEvents\u7684\u5E94\u7528\u7A0B\u5E8F\u95F4\u6D88\u606F\u6765\u63A7\u5236\u5E94\u7528\u7A0B\u5E8F\u548C\u64CD\u4F5C\u7CFB\u7EDF\u90E8\u5206\u3002\u8FD9\u4E9BAppleEvent\u6D88\u606F\u53EF\u4EE5\u72EC\u7ACB\u53D1\u9001\uFF0C\u4E5F\u53EF\u4EE5\u8F7B\u677E\u901A\u8FC7AppleScript\u7F16\u5199\u811A\u672C\u3002\u8FD9\u4E9B\u4E8B\u4EF6\u80FD\u591F\u5B9A\u4F4D\u6253\u5F00\u7684\u7A97\u53E3\u3001\u53D1\u9001\u51FB\u952E\u52A8\u4F5C\uFF0C\u5E76\u4E0E\u672C\u5730\u6216\u8FDC\u7A0B\u51E0\u4E4E\u6240\u6709\u6253\u5F00\u7684\u5E94\u7528\u7A0B\u5E8F\u8FDB\u884C\u4EA4\u4E92\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/002\/"},{"id":"T1059.003","name":"Windows \u547D\u4EE4\u63D0\u793A\u7B26","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Windows\u547D\u4EE4\u5916\u58F3\u8FDB\u884C\u6267\u884C\u64CD\u4F5C\u3002Windows\u547D\u4EE4\u5916\u58F3\uFF08cmd\uFF09\u662FWindows\u7CFB\u7EDF\u4E0A\u7684\u4E3B\u8981\u547D\u4EE4\u63D0\u793A\u7B26\u3002\u901A\u8FC7Windows\u547D\u4EE4\u63D0\u793A\u7B26\uFF0C\u51E0\u4E4E\u53EF\u4EE5\u63A7\u5236\u7CFB\u7EDF\u4EFB\u4F55\u65B9\u9762\uFF0C\u4E0D\u540C\u547D\u4EE4\u5B50\u96C6\u9700\u8981\u4E0D\u540C\u7684\u6743\u9650\u7EA7\u522B\u3002\u547D\u4EE4\u63D0\u793A\u7B26\u53EF\u901A\u8FC7SSH\u7B49\u8FDC\u7A0B\u670D\u52A1\u8FDC\u7A0B\u8C03\u7528\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/003\/"},{"id":"T1059.004","name":"Unix Shell","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Unix shell\u547D\u4EE4\u548C\u811A\u672C\u8FDB\u884C\u6267\u884C\u64CD\u4F5C\u3002Unix shell\u662FLinux\u3001macOS\u548CESXi\u7CFB\u7EDF\u4E0A\u7684\u4E3B\u8981\u547D\u4EE4\u63D0\u793A\u7B26\uFF0C\u5C3D\u7BA1\u6839\u636E\u5177\u4F53\u7684\u64CD\u4F5C\u7CFB\u7EDF\u6216\u53D1\u884C\u7248\u5B58\u5728\u591A\u79CDUnix shell\u53D8\u4F53\uFF08\u4F8B\u5982sh\u3001ash\u3001bash\u3001zsh\u7B49\uFF09\u3002Unix shell\u53EF\u4EE5\u63A7\u5236\u7CFB\u7EDF\u7684\u5404\u4E2A\u65B9\u9762\uFF0C\u5176\u4E2D\u67D0\u4E9B\u547D\u4EE4\u9700\u8981\u63D0\u5347\u6743\u9650\u624D\u80FD\u6267\u884C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/004\/"},{"id":"T1059.005","name":"Visual Basic","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Visual Basic\uFF08VB\uFF09\u8FDB\u884C\u6267\u884C\u64CD\u4F5C\u3002VB\u662F\u4E00\u79CD\u7531\u5FAE\u8F6F\u521B\u5EFA\u7684\u7F16\u7A0B\u8BED\u8A00\uFF0C\u901A\u8FC7Windows API\u4E0E\u8BB8\u591AWindows\u6280\u672F\uFF08\u5982\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\u548C\u539F\u751FAPI\uFF09\u5B9E\u73B0\u4E92\u64CD\u4F5C\u6027\u3002\u5C3D\u7BA1VB\u88AB\u6807\u8BB0\u4E3A\u9057\u7559\u6280\u672F\u4E14\u65E0\u8BA1\u5212\u8FDB\u884C\u672A\u6765\u6F14\u8FDB\uFF0C\u4F46\u5B83\u4ECD\u88AB\u96C6\u6210\u5E76\u652F\u6301\u5728.NET\u6846\u67B6\u53CA\u8DE8\u5E73\u53F0\u7684.NET Core\u4E2D\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/005\/"},{"id":"T1059.006","name":"Python","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Python\u547D\u4EE4\u548C\u811A\u672C\u8FDB\u884C\u6076\u610F\u64CD\u4F5C\u3002Python\u662F\u4E00\u79CD\u975E\u5E38\u6D41\u884C\u7684\u811A\u672C\/\u7F16\u7A0B\u8BED\u8A00\uFF0C\u5177\u5907\u6267\u884C\u591A\u79CD\u529F\u80FD\u7684\u80FD\u529B\u3002Python\u53EF\u4EE5\u901A\u8FC7\u547D\u4EE4\u884C\u4EA4\u4E92\u5F0F\u6267\u884C\uFF08\u901A\u8FC7python.exe\u89E3\u91CA\u5668\uFF09\uFF0C\u4E5F\u53EF\u4EE5\u901A\u8FC7\u7F16\u5199\u5E76\u5206\u53D1\u5230\u4E0D\u540C\u7CFB\u7EDF\u7684\u811A\u672C\uFF08.py\uFF09\u6765\u6267\u884C\u3002Python\u4EE3\u7801\u8FD8\u53EF\u4EE5\u88AB\u7F16\u8BD1\u6210\u4E8C\u8FDB\u5236\u53EF\u6267\u884C\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/006\/"},{"id":"T1059.007","name":"JavaScript","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528JavaScript\u7684\u5404\u79CD\u5B9E\u73B0\u6765\u6267\u884C\u6076\u610F\u64CD\u4F5C\u3002JavaScript\uFF08JS\uFF09\u662F\u4E00\u79CD\u5E73\u53F0\u72EC\u7ACB\u7684\u811A\u672C\u8BED\u8A00\uFF08\u5728\u8FD0\u884C\u65F6\u5373\u65F6\u7F16\u8BD1\uFF09\uFF0C\u901A\u5E38\u4E0E\u7F51\u9875\u4E2D\u7684\u811A\u672C\u76F8\u5173\u8054\uFF0C\u4F46JS\u4E5F\u53EF\u4EE5\u5728\u6D4F\u89C8\u5668\u4E4B\u5916\u7684\u8FD0\u884C\u65F6\u73AF\u5883\u4E2D\u6267\u884C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/007\/"},{"id":"T1059.008","name":"\u7F51\u7EDC\u8BBE\u5907\u547D\u4EE4\u884C\u754C\u9762","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7F51\u7EDC\u8BBE\u5907\u4E0A\u7684\u811A\u672C\u6216\u5185\u7F6E\u547D\u4EE4\u884C\u89E3\u91CA\u5668\uFF08CLI\uFF09\u6765\u6267\u884C\u6076\u610F\u547D\u4EE4\u548C\u8F7D\u8377\u3002\u547D\u4EE4\u884C\u89E3\u91CA\u5668\u662F\u7528\u6237\u548C\u7BA1\u7406\u5458\u4E0E\u8BBE\u5907\u4EA4\u4E92\u7684\u4E3B\u8981\u65B9\u5F0F\uFF0C\u7528\u4E8E\u67E5\u770B\u7CFB\u7EDF\u4FE1\u606F\u3001\u4FEE\u6539\u8BBE\u5907\u64CD\u4F5C\u6216\u6267\u884C\u8BCA\u65AD\u548C\u7BA1\u7406\u529F\u80FD\u3002\u547D\u4EE4\u884C\u89E3\u91CA\u5668\u901A\u5E38\u5305\u542B\u4E0D\u540C\u547D\u4EE4\u6240\u9700\u7684\u5404\u79CD\u6743\u9650\u7EA7\u522B\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/008\/"},{"id":"T1059.009","name":"\u4E91API","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u4E91API\u6765\u6267\u884C\u6076\u610F\u547D\u4EE4\u3002\u4E91\u73AF\u5883\u4E2D\u53EF\u7528\u7684API\u63D0\u4F9B\u4E86\u591A\u79CD\u529F\u80FD\uFF0C\u662F\u4E00\u79CD\u529F\u80FD\u4E30\u5BCC\u7684\u65B9\u6CD5\uFF0C\u53EF\u901A\u8FC7\u7F16\u7A0B\u65B9\u5F0F\u8BBF\u95EE\u79DF\u6237\u7684\u51E0\u4E4E\u6240\u6709\u65B9\u9762\u3002\u8FD9\u4E9BAPI\u53EF\u4EE5\u901A\u8FC7\u591A\u79CD\u65B9\u5F0F\u4F7F\u7528\uFF0C\u4F8B\u5982\u547D\u4EE4\u884C\u89E3\u91CA\u5668\uFF08CLI\uFF09\u3001\u6D4F\u89C8\u5668\u5185\u7684\u4E91Shell\u3001PowerShell\u6A21\u5757\uFF08\u5982Azure PowerShell\uFF09\uFF0C\u6216\u9002\u7528\u4E8EPython\u7B49\u8BED\u8A00\u7684\u8F6F\u4EF6\u5F00\u53D1\u5DE5\u5177\u5305\uFF08SDK\uFF09\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/009\/"},{"id":"T1059.010","name":"AutoHotKey \u4E0E AutoIT","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528AutoIT\u548CAutoHotKey\u81EA\u52A8\u5316\u811A\u672C\u6765\u6267\u884C\u547D\u4EE4\u5E76\u5B8C\u6210\u6076\u610F\u4EFB\u52A1\u3002AutoIT\u548CAutoHotkey\uFF08AHK\uFF09\u662F\u4E24\u79CD\u811A\u672C\u8BED\u8A00\uFF0C\u5141\u8BB8\u7528\u6237\u81EA\u52A8\u5316Windows\u4EFB\u52A1\u3002\u8FD9\u4E9B\u81EA\u52A8\u5316\u811A\u672C\u53EF\u7528\u4E8E\u6267\u884C\u591A\u79CD\u64CD\u4F5C\uFF0C\u4F8B\u5982\u70B9\u51FB\u6309\u94AE\u3001\u8F93\u5165\u6587\u672C\u4EE5\u53CA\u6253\u5F00\u548C\u5173\u95ED\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/010\/"},{"id":"T1059.011","name":"Lua","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Lua\u547D\u4EE4\u548C\u811A\u672C\u6765\u6267\u884C\u6076\u610F\u64CD\u4F5C\u3002Lua\u662F\u4E00\u79CD\u8DE8\u5E73\u53F0\u7684\u811A\u672C\u548C\u7F16\u7A0B\u8BED\u8A00\uFF0C\u4E3B\u8981\u8BBE\u8BA1\u7528\u4E8E\u5E94\u7528\u7A0B\u5E8F\u7684\u5D4C\u5165\u5F0F\u573A\u666F\u3002\u5B83\u53EF\u901A\u8FC7\u547D\u4EE4\u884C\uFF08\u901A\u8FC7\u72EC\u7ACB\u7684Lua\u89E3\u91CA\u5668\uFF09\u3001\u811A\u672C\u6587\u4EF6\uFF08.lua\uFF09\u6216\u5728\u5D4C\u5165Lua\u7684\u7A0B\u5E8F\u4E2D\uFF08\u901A\u8FC7lua_State\u7ED3\u6784\uFF09\u6267\u884C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/011\/"},{"id":"T1059.012","name":"\u865A\u62DF\u673A\u76D1\u63A7\u7A0B\u5E8F\u547D\u4EE4\u884C\u754C\u9762","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u547D\u4EE4\u884C\u754C\u9762\uFF08CLI\uFF09\u6765\u6267\u884C\u6076\u610F\u547D\u4EE4\u3002\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8FCLI\u901A\u5E38\u63D0\u4F9B\u5E7F\u6CDB\u7684\u529F\u80FD\uFF0C\u7528\u4E8E\u7BA1\u7406\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u672C\u8EAB\u53CA\u5176\u6258\u7BA1\u7684\u5BA2\u6237\u865A\u62DF\u673A\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"ESXi","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/012\/"},{"id":"T1059.013","name":"\u5BB9\u5668CLI\/API","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5185\u7F6E\u7684\u547D\u4EE4\u884C\u754C\u9762\u5DE5\u5177\u6216API\u8C03\u7528\u6765\u5728\u5BB9\u5668\u5316\u73AF\u5883\u4E2D\u6267\u884C\u6076\u610F\u547D\u4EE4\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/013\/"},{"id":"T1059","name":"\u547D\u4EE4\u4E0E\u811A\u672C\u89E3\u91CA\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u547D\u4EE4\u548C\u811A\u672C\u89E3\u91CA\u5668\u6765\u6267\u884C\u547D\u4EE4\u3001\u811A\u672C\u6216\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002\u8FD9\u4E9B\u63A5\u53E3\u548C\u8BED\u8A00\u63D0\u4F9B\u4E86\u4E0E\u8BA1\u7B97\u673A\u7CFB\u7EDF\u4EA4\u4E92\u7684\u65B9\u5F0F\uFF0C\u5E76\u4E14\u662F\u8BB8\u591A\u4E0D\u540C\u5E73\u53F0\u4E0A\u7684\u5E38\u89C1\u529F\u80FD\u3002\u5927\u591A\u6570\u7CFB\u7EDF\u90FD\u5185\u7F6E\u4E86\u67D0\u4E9B\u547D\u4EE4\u884C\u754C\u9762\u548C\u811A\u672C\u529F\u80FD\uFF0C\u4F8B\u5982\uFF0CmacOS\u548CLinux\u53D1\u884C\u7248\u5305\u542B\u67D0\u79CDUnix Shell\uFF0C\u800CWindows\u5B89\u88C5\u5219\u5305\u542BWindows\u547D\u4EE4\u63D0\u793A\u7B26\u548CPowerShell\u3002","sub-techniques":"T1059.001, T1059.002, T1059.003, T1059.004, T1059.005, T1059.006, T1059.007, T1059.008, T1059.009, T1059.010, T1059.011, T1059.012, T1059.013","tactic":"\u6267\u884C","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1059\/"},{"id":"T1068","name":"\u7279\u6743\u63D0\u5347\u5229\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8F6F\u4EF6\u6F0F\u6D1E\u5C1D\u8BD5\u63D0\u5347\u6743\u9650\u3002\u5F53\u653B\u51FB\u8005\u5229\u7528\u7A0B\u5E8F\u3001\u670D\u52A1\u6216\u64CD\u4F5C\u7CFB\u7EDF\u8F6F\u4EF6\u53CA\u5185\u6838\u672C\u8EAB\u7684\u7F16\u7A0B\u9519\u8BEF\u6765\u6267\u884C\u5176\u63A7\u5236\u7684\u4EE3\u7801\u65F6\uFF0C\u5373\u53D1\u751F\u8F6F\u4EF6\u6F0F\u6D1E\u5229\u7528\u3002\u6743\u9650\u7EA7\u522B\u7B49\u5B89\u5168\u673A\u5236\u901A\u5E38\u4F1A\u963B\u788D\u5BF9\u4FE1\u606F\u7684\u8BBF\u95EE\u548C\u7279\u5B9A\u6280\u672F\u7684\u4F7F\u7528\uFF0C\u56E0\u6B64\u653B\u51FB\u8005\u5F88\u53EF\u80FD\u9700\u8981\u901A\u8FC7\u7279\u6743\u5347\u7EA7\uFF08\u5305\u62EC\u5229\u7528\u8F6F\u4EF6\u6F0F\u6D1E\uFF09\u6765\u7ED5\u8FC7\u8FD9\u4E9B\u9650\u5236\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1068\/"},{"id":"T1069.001","name":"\u5730\u65B9\u56E2\u4F53","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u67E5\u627E\u672C\u5730\u7CFB\u7EDF\u7EC4\u548C\u6743\u9650\u8BBE\u7F6E\u3002\u4E86\u89E3\u672C\u5730\u7CFB\u7EDF\u6743\u9650\u7EC4\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u5B58\u5728\u54EA\u4E9B\u7EC4\u4EE5\u53CA\u54EA\u4E9B\u7528\u6237\u5C5E\u4E8E\u7279\u5B9A\u7EC4\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u4FE1\u606F\u6765\u786E\u5B9A\u54EA\u4E9B\u7528\u6237\u62E5\u6709\u63D0\u5347\u7684\u6743\u9650\uFF0C\u4F8B\u5982\u672C\u5730\u7BA1\u7406\u5458\u7EC4\u4E2D\u7684\u7528\u6237\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1069\/001\/"},{"id":"T1069.002","name":"\u57DF\u7EC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u67E5\u627E\u57DF\u7EA7\u522B\u7684\u7EC4\u548C\u6743\u9650\u8BBE\u7F6E\u3002\u4E86\u89E3\u57DF\u7EA7\u522B\u7684\u6743\u9650\u7EC4\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u5B58\u5728\u54EA\u4E9B\u7EC4\u4EE5\u53CA\u54EA\u4E9B\u7528\u6237\u5C5E\u4E8E\u7279\u5B9A\u7EC4\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u4FE1\u606F\u6765\u8BC6\u522B\u54EA\u4E9B\u7528\u6237\u62E5\u6709\u63D0\u5347\u7684\u6743\u9650\uFF0C\u4F8B\u5982\u57DF\u7BA1\u7406\u5458\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1069\/002\/"},{"id":"T1069.003","name":"\u4E91\u7EC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5BFB\u627E\u4E91\u7EC4\u548C\u6743\u9650\u8BBE\u7F6E\u3002\u4E86\u89E3\u4E91\u6743\u9650\u7EC4\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u73AF\u5883\u4E2D\u7528\u6237\u548C\u7EC4\u7684\u7279\u5B9A\u89D2\u8272\uFF0C\u4EE5\u53CA\u54EA\u4E9B\u7528\u6237\u4E0E\u7279\u5B9A\u7EC4\u76F8\u5173\u8054\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1069\/003\/"},{"id":"T1069","name":"\u6743\u9650\u7EC4\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u63A2\u67E5\u7FA4\u7EC4\u548C\u6743\u9650\u8BBE\u7F6E\u3002\u8FD9\u7C7B\u4FE1\u606F\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u8BC6\u522B\u53EF\u7528\u7684\u7528\u6237\u8D26\u6237\u4E0E\u7FA4\u7EC4\u3001\u7279\u5B9A\u7FA4\u7EC4\u6210\u5458\u6784\u6210\uFF0C\u4EE5\u53CA\u54EA\u4E9B\u7528\u6237\u548C\u7FA4\u7EC4\u62E5\u6709\u63D0\u5347\u540E\u7684\u6743\u9650\u3002","sub-techniques":"T1069.001, T1069.002, T1069.003","tactic":"\u53D1\u73B0","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1069\/"},{"id":"T1070.001","name":"\u6E05\u9664Windows\u4E8B\u4EF6\u65E5\u5FD7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6E05\u9664Windows\u4E8B\u4EF6\u65E5\u5FD7\u4EE5\u63A9\u76D6\u5165\u4FB5\u6D3B\u52A8\u7684\u75D5\u8FF9\u3002Windows\u4E8B\u4EF6\u65E5\u5FD7\u8BB0\u5F55\u4E86\u8BA1\u7B97\u673A\u7684\u8B66\u62A5\u548C\u901A\u77E5\u4FE1\u606F\u3002\u7CFB\u7EDF\u9884\u5B9A\u4E49\u7684\u4E8B\u4EF6\u6765\u6E90\u6709\u4E09\u79CD\uFF1A\u7CFB\u7EDF\u65E5\u5FD7\u3001\u5E94\u7528\u7A0B\u5E8F\u65E5\u5FD7\u548C\u5B89\u5168\u65E5\u5FD7\uFF0C\u4E8B\u4EF6\u7C7B\u578B\u5219\u5206\u4E3A\u4E94\u7C7B\uFF1A\u9519\u8BEF\u3001\u8B66\u544A\u3001\u4FE1\u606F\u3001\u6210\u529F\u5BA1\u6838\u4E0E\u5931\u8D25\u5BA1\u6838\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/001\/"},{"id":"T1070.002","name":"\u6E05\u9664 Linux \u6216 Mac \u7CFB\u7EDF\u65E5\u5FD7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6E05\u9664\u7CFB\u7EDF\u65E5\u5FD7\u4EE5\u63A9\u76D6\u5165\u4FB5\u75D5\u8FF9\u3002macOS\u548CLinux\u7CFB\u7EDF\u5747\u901A\u8FC7\u7CFB\u7EDF\u65E5\u5FD7\u8BB0\u5F55\u7CFB\u7EDF\u6216\u7528\u6237\u53D1\u8D77\u7684\u64CD\u4F5C\u3002\u5927\u90E8\u5206\u539F\u751F\u7CFB\u7EDF\u65E5\u5FD7\u5B58\u50A8\u5728\/var\/log\/\u76EE\u5F55\u4E0B\uFF0C\u8BE5\u76EE\u5F55\u4E2D\u7684\u5B50\u6587\u4EF6\u5939\u6839\u636E\u76F8\u5173\u529F\u80FD\u5BF9\u65E5\u5FD7\u8FDB\u884C\u5206\u7C7B\uFF0C\u4F8B\u5982\uFF1A","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/002\/"},{"id":"T1070.003","name":"\u6E05\u9664\u547D\u4EE4\u5386\u53F2\u8BB0\u5F55","description":"\u9664\u4E86\u6E05\u9664\u7CFB\u7EDF\u65E5\u5FD7\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u6E05\u9664\u88AB\u5165\u4FB5\u8D26\u6237\u7684\u547D\u4EE4\u5386\u53F2\u8BB0\u5F55\uFF0C\u4EE5\u63A9\u76D6\u5165\u4FB5\u671F\u95F4\u6240\u91C7\u53D6\u7684\u884C\u52A8\u3002\u4E0D\u540C\u7684\u547D\u4EE4\u89E3\u91CA\u5668\u4F1A\u8BB0\u5F55\u7528\u6237\u5728\u7EC8\u7AEF\u8F93\u5165\u7684\u547D\u4EE4\uFF0C\u4EE5\u4FBF\u7528\u6237\u8FFD\u6EAF\u81EA\u5DF1\u7684\u64CD\u4F5C\u5386\u53F2\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/003\/"},{"id":"T1070.004","name":"\u6587\u4EF6\u5220\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5220\u9664\u5176\u5165\u4FB5\u6D3B\u52A8\u7559\u4E0B\u7684\u6587\u4EF6\u3002\u6076\u610F\u8F6F\u4EF6\u3001\u5DE5\u5177\u6216\u5176\u4ED6\u975E\u672C\u5730\u6587\u4EF6\u88AB\u653B\u51FB\u8005\u6295\u653E\u5230\u7CFB\u7EDF\u4E0A\u6216\u521B\u5EFA\uFF08\u4F8B\u5982\uFF1A\u5165\u4FB5\u5DE5\u5177\u4F20\u8F93\uFF09\uFF0C\u53EF\u80FD\u4F1A\u7559\u4E0B\u75D5\u8FF9\uFF0C\u63ED\u793A\u5728\u7F51\u7EDC\u5185\u8FDB\u884C\u4E86\u54EA\u4E9B\u64CD\u4F5C\u4EE5\u53CA\u5982\u4F55\u8FDB\u884C\u7684\u3002\u8FD9\u4E9B\u6587\u4EF6\u7684\u5220\u9664\u53EF\u80FD\u5728\u5165\u4FB5\u8FC7\u7A0B\u4E2D\u53D1\u751F\uFF0C\u6216\u4F5C\u4E3A\u5165\u4FB5\u540E\u6E05\u7406\u7684\u4E00\u90E8\u5206\uFF0C\u4EE5\u6700\u5C0F\u5316\u653B\u51FB\u8005\u7684\u8DB3\u8FF9\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/004\/"},{"id":"T1070.005","name":"\u7F51\u7EDC\u5171\u4EAB\u8FDE\u63A5\u79FB\u9664","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u79FB\u9664\u4E0D\u518D\u6709\u7528\u7684\u5171\u4EAB\u8FDE\u63A5\uFF0C\u4EE5\u6E05\u7406\u5176\u64CD\u4F5C\u75D5\u8FF9\u3002\u5F53\u4E0D\u518D\u9700\u8981\u65F6\uFF0C\u53EF\u4EE5\u79FB\u9664Windows\u5171\u4EAB\u9A71\u52A8\u5668\u548CSMB\/Windows\u7BA1\u7406\u5171\u4EAB\u8FDE\u63A5\u3002\u4F8B\u5982\uFF0CNet\u5DE5\u5177\u53EF\u7528\u4E8E\u901A\u8FC7\u547D\u4EE4`net use \\\\system\\share \/delete`\u6765\u5220\u9664\u7F51\u7EDC\u5171\u4EAB\u8FDE\u63A5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/005\/"},{"id":"T1070.006","name":"\u65F6\u95F4\u6233","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u6587\u4EF6\u65F6\u95F4\u5C5E\u6027\u4EE5\u9690\u85CF\u65B0\u6587\u4EF6\u6216\u5BF9\u73B0\u6709\u6587\u4EF6\u7684\u66F4\u6539\u3002\u65F6\u95F4\u6233\u7BE1\u6539\u662F\u4E00\u79CD\u4FEE\u6539\u6587\u4EF6\u65F6\u95F4\u6233\uFF08\u4FEE\u6539\u65F6\u95F4\u3001\u8BBF\u95EE\u65F6\u95F4\u3001\u521B\u5EFA\u65F6\u95F4\u548C\u66F4\u6539\u65F6\u95F4\uFF09\u7684\u6280\u672F\uFF0C\u901A\u5E38\u7528\u4E8E\u6A21\u4EFF\u540C\u4E00\u6587\u4EF6\u5939\u4E2D\u7684\u6587\u4EF6\uFF0C\u4F7F\u6076\u610F\u6587\u4EF6\u4E0E\u5408\u6CD5\u6587\u4EF6\u6DF7\u4E3A\u4E00\u4F53\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/006\/"},{"id":"T1070.007","name":"\u6E05\u9664\u7F51\u7EDC\u8FDE\u63A5\u5386\u53F2\u4E0E\u914D\u7F6E","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6E05\u9664\u6216\u79FB\u9664\u6076\u610F\u7F51\u7EDC\u8FDE\u63A5\u7684\u8BC1\u636E\uFF0C\u4EE5\u6E05\u7406\u5176\u64CD\u4F5C\u75D5\u8FF9\u3002\u7CFB\u7EDF\u914D\u7F6E\u8BBE\u7F6E\u4EE5\u53CA\u5404\u79CD\u8BB0\u5F55\u8FDE\u63A5\u5386\u53F2\u7684\u75D5\u8FF9\uFF0C\u53EF\u80FD\u56E0\u9700\u8981\u7F51\u7EDC\u8FDE\u63A5\u7684\u884C\u4E3A\uFF08\u5982\u8FDC\u7A0B\u670D\u52A1\u6216\u5916\u90E8\u8FDC\u7A0B\u670D\u52A1\uFF09\u800C\u5728\u7CFB\u7EDF\u6216\u5E94\u7528\u7A0B\u5E8F\u65E5\u5FD7\u4E2D\u4EA7\u751F\u3002\u9632\u5FA1\u8005\u53EF\u4EE5\u5229\u7528\u8FD9\u4E9B\u75D5\u8FF9\u6765\u76D1\u63A7\u6216\u5206\u6790\u5BF9\u624B\u521B\u5EFA\u7684\u7F51\u7EDC\u8FDE\u63A5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/007\/"},{"id":"T1070.008","name":"\u6E05\u9664\u90AE\u7BB1\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u90AE\u4EF6\u548C\u90AE\u4EF6\u5E94\u7528\u6570\u636E\u4EE5\u6D88\u9664\u5176\u6D3B\u52A8\u75D5\u8FF9\u3002\u7535\u5B50\u90AE\u4EF6\u5E94\u7528\u7A0B\u5E8F\u5141\u8BB8\u7528\u6237\u53CA\u5176\u4ED6\u7A0B\u5E8F\u901A\u8FC7\u547D\u4EE4\u884C\u5DE5\u5177\u6216API\u63A5\u53E3\u5BFC\u51FA\u548C\u5220\u9664\u90AE\u7BB1\u6570\u636E\u3002\u90AE\u4EF6\u5E94\u7528\u6570\u636E\u53EF\u5305\u62EC\u7535\u5B50\u90AE\u4EF6\u3001\u90AE\u4EF6\u5143\u6570\u636E\uFF0C\u6216\u7531\u5E94\u7528\u7A0B\u5E8F\u53CA\u64CD\u4F5C\u7CFB\u7EDF\u751F\u6210\u7684\u65E5\u5FD7\uFF0C\u4F8B\u5982\u5BFC\u51FA\u8BF7\u6C42\u8BB0\u5F55\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/008\/"},{"id":"T1070.009","name":"\u6E05\u9664\u6301\u4E45\u6027","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6E05\u9664\u4E0E\u5148\u524D\u5728\u4E3B\u673A\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u7684\u6301\u4E45\u6027\u673A\u5236\u76F8\u5173\u7684\u75D5\u8FF9\uFF0C\u4EE5\u6D88\u9664\u5176\u6D3B\u52A8\u8BC1\u636E\u3002\u8FD9\u53EF\u80FD\u6D89\u53CA\u591A\u79CD\u64CD\u4F5C\uFF0C\u4F8B\u5982\u79FB\u9664\u670D\u52A1\u3001\u5220\u9664\u53EF\u6267\u884C\u6587\u4EF6\u3001\u4FEE\u6539\u6CE8\u518C\u8868\u3001\u4FEE\u6539Plist\u6587\u4EF6\uFF0C\u6216\u91C7\u7528\u5176\u4ED6\u6E05\u7406\u65B9\u6CD5\uFF0C\u4EE5\u9632\u6B62\u9632\u5FA1\u8005\u6536\u96C6\u5230\u5176\u6301\u7EED\u5B58\u5728\u7684\u8BC1\u636E\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5220\u9664\u5148\u524D\u4E3A\u7EF4\u6301\u6301\u4E45\u6027\u800C\u521B\u5EFA\u7684\u8D26\u6237\uFF08\u4F8B\u5982\u521B\u5EFA\u8D26\u6237\u64CD\u4F5C\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/009\/"},{"id":"T1070.010","name":"\u91CD\u65B0\u5B9A\u4F4D\u6076\u610F\u8F6F\u4EF6","description":"\u4E00\u65E6\u6709\u6548\u8F7D\u8377\u88AB\u9001\u8FBE\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u5BB3\u7CFB\u7EDF\u4E0A\u590D\u5236\u76F8\u540C\u7684\u6076\u610F\u8F6F\u4EF6\u526F\u672C\uFF0C\u4EE5\u6D88\u9664\u5176\u5B58\u5728\u7684\u75D5\u8FF9\u548C\/\u6216\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u5C06\u6076\u610F\u8F6F\u4EF6\u6709\u6548\u8F7D\u8377\u590D\u5236\u5230\u65B0\u4F4D\u7F6E\uFF0C\u4E5F\u53EF\u80FD\u4E0E\u6587\u4EF6\u5220\u9664\u64CD\u4F5C\u76F8\u7ED3\u5408\uFF0C\u4EE5\u6E05\u7406\u65E7\u6709\u7684\u653B\u51FB\u75D5\u8FF9\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/010\/"},{"id":"T1070","name":"\u6307\u6807\u79FB\u9664","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5220\u9664\u6216\u4FEE\u6539\u7CFB\u7EDF\u5185\u751F\u6210\u7684\u75D5\u8FF9\uFF0C\u4EE5\u6D88\u9664\u5176\u5B58\u5728\u7684\u8BC1\u636E\u6216\u963B\u788D\u9632\u5FA1\u3002\u8FD9\u4E9B\u75D5\u8FF9\u53EF\u80FD\u7531\u5BF9\u624B\u521B\u5EFA\uFF0C\u6216\u53EF\u5F52\u56E0\u4E8E\u5BF9\u624B\u7684\u884C\u4E3A\u3002\u901A\u5E38\uFF0C\u8FD9\u4E9B\u75D5\u8FF9\u88AB\u7528\u4F5C\u4E0E\u76D1\u63A7\u4E8B\u4EF6\u76F8\u5173\u7684\u9632\u5FA1\u6307\u6807\uFF0C\u5982\u4E0B\u8F7D\u6587\u4EF6\u4E2D\u7684\u5B57\u7B26\u4E32\u3001\u7528\u6237\u64CD\u4F5C\u751F\u6210\u7684\u65E5\u5FD7\uFF0C\u4EE5\u53CA\u9632\u5FA1\u8005\u5206\u6790\u7684\u5176\u4ED6\u6570\u636E\u3002\u75D5\u8FF9\u7684\u4F4D\u7F6E\u3001\u683C\u5F0F\u548C\u7C7B\u578B\uFF08\u5982\u547D\u4EE4\u6216\u767B\u5F55\u5386\u53F2\uFF09\u901A\u5E38\u56E0\u5E73\u53F0\u800C\u5F02\u3002","sub-techniques":"T1070.001, T1070.002, T1070.003, T1070.004, T1070.005, T1070.006, T1070.007, T1070.008, T1070.009, T1070.010","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1070\/"},{"id":"T1071.001","name":"\u7F51\u7EDC\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4E0E\u7F51\u7EDC\u6D41\u91CF\u76F8\u5173\u7684\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u907F\u514D\u88AB\u68C0\u6D4B\u6216\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u547D\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\u901A\u5E38\u4F1A\u5D4C\u5165\u5728\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/001\/"},{"id":"T1071.002","name":"\u6587\u4EF6\u4F20\u8F93\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4E0E\u6587\u4EF6\u4F20\u8F93\u76F8\u5173\u7684\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u89C4\u907F\u68C0\u6D4B\u548C\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u6307\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\u901A\u5E38\u4F1A\u5D4C\u5165\u5728\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/002\/"},{"id":"T1071.003","name":"\u90AE\u4EF6\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4E0E\u7535\u5B50\u90AE\u4EF6\u4F20\u9012\u76F8\u5173\u7684\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u907F\u514D\u88AB\u68C0\u6D4B\u6216\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u547D\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\u901A\u5E38\u4F1A\u5D4C\u5165\u5728\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/003\/"},{"id":"T1071.004","name":"\u57DF\u540D\u7CFB\u7EDF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u57DF\u540D\u7CFB\u7EDF\uFF08DNS\uFF09\u8FD9\u4E00\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u89C4\u907F\u68C0\u6D4B\u548C\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u6307\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\u901A\u5E38\u4F1A\u5D4C\u5165\u5230\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/004\/"},{"id":"T1071.005","name":"\u53D1\u5E03\/\u8BA2\u9605\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u53D1\u5E03\/\u8BA2\u9605\uFF08pub\/sub\uFF09\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u89C4\u907F\u68C0\u6D4B\u548C\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u6307\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\uFF0C\u901A\u5E38\u4F1A\u5D4C\u5165\u5728\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/005\/"},{"id":"T1071","name":"\u5E94\u7528\u5C42\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528OSI\u5E94\u7528\u5C42\u534F\u8BAE\u8FDB\u884C\u901A\u4FE1\uFF0C\u4EE5\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u4E2D\uFF0C\u4ECE\u800C\u907F\u514D\u88AB\u68C0\u6D4B\u6216\u7F51\u7EDC\u8FC7\u6EE4\u3002\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u547D\u4EE4\u53CA\u5176\u6267\u884C\u7ED3\u679C\u901A\u5E38\u4F1A\u5D4C\u5165\u5728\u5BA2\u6237\u7AEF\u4E0E\u670D\u52A1\u5668\u4E4B\u95F4\u7684\u534F\u8BAE\u6D41\u91CF\u4E2D\u3002","sub-techniques":"T1071.001, T1071.002, T1071.003, T1071.004, T1071.005","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1071\/"},{"id":"T1072","name":"\u8F6F\u4EF6\u90E8\u7F72\u5DE5\u5177","description":"\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u5E76\u5229\u7528\u4F01\u4E1A\u5185\u5B89\u88C5\u7684\u96C6\u4E2D\u5F0F\u8F6F\u4EF6\u5957\u4EF6\u6765\u6267\u884C\u547D\u4EE4\u5E76\u5728\u7F51\u7EDC\u4E2D\u6A2A\u5411\u79FB\u52A8\u3002\u914D\u7F6E\u7BA1\u7406\u548C\u8F6F\u4EF6\u90E8\u7F72\u5E94\u7528\u7A0B\u5E8F\u901A\u5E38\u5728\u4F01\u4E1A\u7F51\u7EDC\u6216\u4E91\u73AF\u5883\u4E2D\u7528\u4E8E\u65E5\u5E38\u7BA1\u7406\u76EE\u7684\uFF0C\u8FD9\u4E9B\u7CFB\u7EDF\u4E5F\u53EF\u80FD\u88AB\u6574\u5408\u5230CI\/CD\u6D41\u6C34\u7EBF\u4E2D\u3002\u6B64\u7C7B\u89E3\u51B3\u65B9\u6848\u7684\u5B9E\u4F8B\u5305\u62EC\uFF1ASCCM\u3001HBSS\u3001Altiris\u3001AWS Systems Manager\u3001Microsoft Intune\u3001Azure Arc\u4EE5\u53CAGCP Deployment Manager\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1072\/"},{"id":"T1074.001","name":"\u672C\u5730\u6570\u636E\u6682\u5B58","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6570\u636E\u5916\u6CC4\u524D\uFF0C\u5C06\u6536\u96C6\u5230\u7684\u6570\u636E\u6682\u5B58\u5728\u672C\u5730\u7CFB\u7EDF\u7684\u4E2D\u592E\u4F4D\u7F6E\u6216\u76EE\u5F55\u4E2D\u3002\u8FD9\u4E9B\u6570\u636E\u53EF\u80FD\u88AB\u4FDD\u5B58\u5728\u5355\u72EC\u7684\u6587\u4EF6\u4E2D\uFF0C\u6216\u901A\u8FC7\u8BF8\u5982\u201C\u5F52\u6863\u6536\u96C6\u6570\u636E\u201D\u7B49\u6280\u672F\u5408\u5E76\u6210\u4E00\u4E2A\u6587\u4EF6\u3002\u4ED6\u4EEC\u53EF\u80FD\u4F7F\u7528\u4EA4\u4E92\u5F0F\u547D\u4EE4\u5916\u58F3\uFF0C\u5E76\u5229\u7528cmd\u548Cbash\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\u5C06\u6570\u636E\u590D\u5236\u5230\u6682\u5B58\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1074\/001\/"},{"id":"T1074.002","name":"\u8FDC\u7A0B\u6570\u636E\u6682\u5B58","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6570\u636E\u5916\u6CC4\u524D\uFF0C\u5C06\u591A\u4E2A\u7CFB\u7EDF\u6536\u96C6\u7684\u6570\u636E\u6682\u5B58\u4E8E\u67D0\u4E2A\u7CFB\u7EDF\u7684\u4E2D\u592E\u4F4D\u7F6E\u6216\u76EE\u5F55\u4E2D\u3002\u8FD9\u4E9B\u6570\u636E\u53EF\u80FD\u4FDD\u5B58\u5728\u5355\u72EC\u7684\u6587\u4EF6\u91CC\uFF0C\u6216\u901A\u8FC7\u201C\u5F52\u6863\u6536\u96C6\u6570\u636E\u201D\u7B49\u6280\u672F\u5408\u5E76\u4E3A\u4E00\u4E2A\u6587\u4EF6\u3002\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u4EA4\u4E92\u5F0F\u547D\u4EE4\u5916\u58F3\uFF0C\u5E76\u5229\u7528cmd\u548Cbash\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\u5C06\u6570\u636E\u590D\u5236\u5230\u6682\u5B58\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1074\/002\/"},{"id":"T1074","name":"\u6570\u636E\u5DF2\u5C31\u7EEA","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6570\u636E\u5916\u6CC4\u524D\uFF0C\u5C06\u6536\u96C6\u5230\u7684\u6570\u636E\u6682\u5B58\u4E8E\u4E2D\u592E\u4F4D\u7F6E\u6216\u76EE\u5F55\u4E2D\u3002\u8FD9\u4E9B\u6570\u636E\u53EF\u80FD\u88AB\u4FDD\u5B58\u5728\u5355\u72EC\u7684\u6587\u4EF6\u91CC\uFF0C\u6216\u901A\u8FC7\u201C\u5F52\u6863\u6536\u96C6\u6570\u636E\u201D\u7B49\u6280\u672F\u5408\u5E76\u6210\u4E00\u4E2A\u6587\u4EF6\u3002\u4ED6\u4EEC\u53EF\u80FD\u4F7F\u7528\u4EA4\u4E92\u5F0F\u547D\u4EE4\u5916\u58F3\uFF0C\u5E76\u5229\u7528cmd\u548Cbash\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\u5C06\u6570\u636E\u590D\u5236\u5230\u6682\u5B58\u4F4D\u7F6E\u3002","sub-techniques":"T1074.001, T1074.002","tactic":"\u6536\u85CF","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1074\/"},{"id":"T1078.001","name":"\u9ED8\u8BA4\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u5E76\u6EE5\u7528\u9ED8\u8BA4\u8D26\u6237\u7684\u51ED\u636E\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u83B7\u53D6\u521D\u59CB\u8BBF\u95EE\u6743\u9650\u3001\u7EF4\u6301\u6301\u4E45\u6027\u3001\u63D0\u5347\u6743\u9650\u6216\u9003\u907F\u9632\u5FA1\u7684\u624B\u6BB5\u3002\u9ED8\u8BA4\u8D26\u6237\u662F\u6307\u64CD\u4F5C\u7CFB\u7EDF\u5185\u7F6E\u7684\u8D26\u6237\uFF0C\u4F8B\u5982Windows\u7CFB\u7EDF\u4E2D\u7684\u6765\u5BBE\u8D26\u6237\u6216\u7BA1\u7406\u5458\u8D26\u6237\u3002\u9ED8\u8BA4\u8D26\u6237\u8FD8\u5305\u62EC\u5176\u4ED6\u7C7B\u578B\u7CFB\u7EDF\u3001\u8F6F\u4EF6\u6216\u8BBE\u5907\u4E0A\u7684\u9ED8\u8BA4\u51FA\u5382\/\u63D0\u4F9B\u5546\u8BBE\u7F6E\u8D26\u6237\uFF0C\u4F8B\u5982AWS\u4E2D\u7684\u6839\u7528\u6237\u8D26\u6237\u3001ESXi\u4E2D\u7684\u6839\u7528\u6237\u8D26\u6237\u4EE5\u53CAKubernetes\u4E2D\u7684\u9ED8\u8BA4\u670D\u52A1\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1078\/001\/"},{"id":"T1078.002","name":"\u57DF\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u5E76\u6EE5\u7528\u57DF\u8D26\u6237\u51ED\u8BC1\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u83B7\u5F97\u521D\u59CB\u8BBF\u95EE\u6743\u9650\u3001\u7EF4\u6301\u6301\u4E45\u5316\u3001\u63D0\u5347\u6743\u9650\u6216\u9003\u907F\u9632\u5FA1\u7684\u624B\u6BB5\u3002\u57DF\u8D26\u6237\u662F\u7531Active Directory\u57DF\u670D\u52A1\u7BA1\u7406\u7684\u8D26\u6237\uFF0C\u5176\u8BBF\u95EE\u6743\u9650\u548C\u6743\u9650\u914D\u7F6E\u8986\u76D6\u5C5E\u4E8E\u8BE5\u57DF\u7684\u7CFB\u7EDF\u548C\u670D\u52A1\u3002\u57DF\u8D26\u6237\u53EF\u6DB5\u76D6\u7528\u6237\u3001\u7BA1\u7406\u5458\u53CA\u670D\u52A1\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1078\/002\/"},{"id":"T1078.003","name":"\u672C\u5730\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u5E76\u6EE5\u7528\u672C\u5730\u8D26\u6237\u51ED\u8BC1\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u83B7\u5F97\u521D\u59CB\u8BBF\u95EE\u6743\u9650\u3001\u7EF4\u6301\u6301\u4E45\u6027\u3001\u63D0\u5347\u6743\u9650\u6216\u9003\u907F\u9632\u5FA1\u7684\u624B\u6BB5\u3002\u672C\u5730\u8D26\u6237\u662F\u7531\u7EC4\u7EC7\u914D\u7F6E\uFF0C\u4F9B\u7528\u6237\u3001\u8FDC\u7A0B\u652F\u6301\u3001\u670D\u52A1\u4F7F\u7528\uFF0C\u6216\u7528\u4E8E\u5355\u4E2A\u7CFB\u7EDF\u6216\u670D\u52A1\u7BA1\u7406\u7684\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1078\/003\/"},{"id":"T1078.004","name":"\u4E91\u8D26\u6237","description":"\u4E91\u73AF\u5883\u4E2D\u7684\u6709\u6548\u8D26\u6237\u53EF\u80FD\u4F7F\u5BF9\u624B\u80FD\u591F\u6267\u884C\u64CD\u4F5C\uFF0C\u4EE5\u5B9E\u73B0\u521D\u59CB\u8BBF\u95EE\u3001\u6301\u4E45\u5316\u3001\u6743\u9650\u63D0\u5347\u6216\u9632\u5FA1\u89C4\u907F\u3002\u4E91\u8D26\u6237\u662F\u7531\u7EC4\u7EC7\u521B\u5EFA\u548C\u914D\u7F6E\uFF0C\u4F9B\u7528\u6237\u3001\u8FDC\u7A0B\u652F\u6301\u3001\u670D\u52A1\u4F7F\u7528\uFF0C\u6216\u7528\u4E8E\u7BA1\u7406\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u6216SaaS\u5E94\u7528\u7A0B\u5E8F\u5185\u8D44\u6E90\u7684\u8D26\u6237\u3002\u4E91\u8D26\u6237\u53EF\u4EE5\u4EC5\u5B58\u5728\u4E8E\u4E91\u7AEF\uFF1B\u6216\u8005\uFF0C\u5B83\u4EEC\u53EF\u4EE5\u901A\u8FC7\u4E0EWindows Active Directory\u7B49\u5176\u4ED6\u8EAB\u4EFD\u6E90\u8FDB\u884C\u540C\u6B65\u6216\u8054\u5408\uFF0C\u5B9E\u73B0\u672C\u5730\u7CFB\u7EDF\u4E0E\u4E91\u4E4B\u95F4\u7684\u6DF7\u5408\u8FDE\u63A5\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1078\/004\/"},{"id":"T1078","name":"\u6709\u6548\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u5E76\u6EE5\u7528\u73B0\u6709\u8D26\u6237\u7684\u51ED\u8BC1\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u521D\u59CB\u8BBF\u95EE\u3001\u6301\u4E45\u5316\u3001\u6743\u9650\u63D0\u5347\u6216\u9632\u5FA1\u89C4\u907F\u7684\u624B\u6BB5\u3002\u88AB\u7A83\u53D6\u7684\u51ED\u8BC1\u53EF\u7528\u4E8E\u7ED5\u8FC7\u7F51\u7EDC\u5185\u7CFB\u7EDF\u4E0A\u5404\u7C7B\u8D44\u6E90\u7684\u8BBF\u95EE\u63A7\u5236\uFF0C\u751A\u81F3\u53EF\u80FD\u7528\u4E8E\u5BF9\u8FDC\u7A0B\u7CFB\u7EDF\u548C\u5916\u90E8\u53EF\u7528\u670D\u52A1\uFF08\u5982VPN\u3001Outlook Web Access\u3001\u7F51\u7EDC\u8BBE\u5907\u53CA\u8FDC\u7A0B\u684C\u9762\uFF09\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u6B64\u5916\uFF0C\u5931\u9677\u51ED\u8BC1\u8FD8\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u83B7\u5F97\u7279\u5B9A\u7CFB\u7EDF\u7684\u66F4\u9AD8\u6743\u9650\uFF0C\u6216\u8BBF\u95EE\u7F51\u7EDC\u7684\u53D7\u9650\u533A\u57DF\u3002\u653B\u51FB\u8005\u53EF\u80FD\u9009\u62E9\u4E0D\u914D\u5408\u4F7F\u7528\u6076\u610F\u8F6F\u4EF6\u6216\u5DE5\u5177\uFF0C\u800C\u662F\u76F4\u63A5\u5229\u7528\u8FD9\u4E9B\u51ED\u8BC1\u63D0\u4F9B\u7684\u5408\u6CD5\u8BBF\u95EE\u6743\u9650\uFF0C\u4EE5\u589E\u52A0\u5176\u6D3B\u52A8\u88AB\u68C0\u6D4B\u7684\u96BE\u5EA6\u3002","sub-techniques":"T1078.001, T1078.002, T1078.003, T1078.004","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1078\/"},{"id":"T1080","name":"\u6C61\u67D3\u5171\u4EAB\u5185\u5BB9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5411\u5171\u4EAB\u5B58\u50A8\u4F4D\u7F6E\uFF08\u5982\u7F51\u7EDC\u9A71\u52A8\u5668\u6216\u5185\u90E8\u4EE3\u7801\u4ED3\u5E93\uFF09\u6DFB\u52A0\u5185\u5BB9\uFF0C\u5C06\u6709\u6548\u8F7D\u8377\u6295\u9001\u5230\u8FDC\u7A0B\u7CFB\u7EDF\u3002\u5B58\u50A8\u5728\u7F51\u7EDC\u9A71\u52A8\u5668\u6216\u5176\u4ED6\u5171\u4EAB\u4F4D\u7F6E\u7684\u5185\u5BB9\u53EF\u80FD\u88AB\u6C61\u67D3\uFF0C\u5373\u5728\u539F\u672C\u5408\u6CD5\u7684\u6587\u4EF6\u4E2D\u6DFB\u52A0\u6076\u610F\u7A0B\u5E8F\u3001\u811A\u672C\u6216\u5229\u7528\u4EE3\u7801\u3002\u4E00\u65E6\u7528\u6237\u6253\u5F00\u88AB\u6C61\u67D3\u7684\u5171\u4EAB\u5185\u5BB9\uFF0C\u6076\u610F\u90E8\u5206\u4FBF\u4F1A\u88AB\u6267\u884C\uFF0C\u4ECE\u800C\u5728\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u8FD0\u884C\u653B\u51FB\u8005\u7684\u4EE3\u7801\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u88AB\u6C61\u67D3\u7684\u5171\u4EAB\u5185\u5BB9\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1080\/"},{"id":"T1082","name":"\u7CFB\u7EDF\u4FE1\u606F\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u6709\u5173\u64CD\u4F5C\u7CFB\u7EDF\u548C\u786C\u4EF6\u7684\u8BE6\u7EC6\u4FE1\u606F\uFF0C\u5305\u62EC\u7248\u672C\u3001\u8865\u4E01\u3001\u70ED\u4FEE\u590D\u3001\u670D\u52A1\u5305\u548C\u67B6\u6784\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u4FE1\u606F\u6765\u89C4\u5212\u540E\u7EED\u884C\u4E3A\uFF0C\u5305\u62EC\u662F\u5426\u5B8C\u5168\u611F\u67D3\u76EE\u6807\u4EE5\u53CA\/\u6216\u5C1D\u8BD5\u7279\u5B9A\u64CD\u4F5C\u3002\u6B64\u884C\u4E3A\u4E0E\u672C\u5730\u5B58\u50A8\u53D1\u73B0\u4E0D\u540C\uFF0C\u540E\u8005\u662F\u653B\u51FB\u8005\u5BF9\u672C\u5730\u9A71\u52A8\u5668\u3001\u78C1\u76D8\u548C\/\u6216\u5377\u7684\u53D1\u73B0\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1082\/"},{"id":"T1083","name":"\u6587\u4EF6\u548C\u76EE\u5F55\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u679A\u4E3E\u6587\u4EF6\u548C\u76EE\u5F55\uFF0C\u6216\u5728\u4E3B\u673A\u6216\u7F51\u7EDC\u5171\u4EAB\u7684\u7279\u5B9A\u4F4D\u7F6E\u641C\u7D22\u6587\u4EF6\u7CFB\u7EDF\u4E2D\u7684\u7279\u5B9A\u4FE1\u606F\u3002\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6587\u4EF6\u548C\u76EE\u5F55\u53D1\u73B0\u6240\u83B7\u53D6\u7684\u4FE1\u606F\u6765\u8C03\u6574\u540E\u7EED\u884C\u4E3A\uFF0C\u5305\u62EC\u51B3\u5B9A\u662F\u5426\u5B8C\u5168\u611F\u67D3\u76EE\u6807\u53CA\/\u6216\u5C1D\u8BD5\u6267\u884C\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1083\/"},{"id":"T1087.001","name":"\u672C\u5730\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u672C\u5730\u7CFB\u7EDF\u8D26\u6237\u5217\u8868\u3002\u6B64\u7C7B\u4FE1\u606F\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u7CFB\u7EDF\u4E0A\u5B58\u5728\u54EA\u4E9B\u672C\u5730\u8D26\u6237\uFF0C\u4ECE\u800C\u4E3A\u540E\u7EED\u884C\u4E3A\u63D0\u4F9B\u652F\u6301\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1087\/001\/"},{"id":"T1087.002","name":"\u57DF\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u57DF\u8D26\u6237\u5217\u8868\u3002\u6B64\u7C7B\u4FE1\u606F\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u5B58\u5728\u54EA\u4E9B\u57DF\u8D26\u6237\uFF0C\u4ECE\u800C\u652F\u6301\u540E\u7EED\u884C\u4E3A\uFF0C\u4F8B\u5982\u9488\u5BF9\u62E5\u6709\u7279\u5B9A\u6743\u9650\u7684\u8D26\u6237\u8FDB\u884C\u5B9A\u5411\u653B\u51FB\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1087\/002\/"},{"id":"T1087.003","name":"\u7535\u5B50\u90AE\u4EF6\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u7535\u5B50\u90AE\u4EF6\u5730\u5740\u548C\u8D26\u6237\u5217\u8868\u3002\u4ED6\u4EEC\u53EF\u80FD\u4F1A\u5C1D\u8BD5\u8F6C\u50A8Exchange\u5730\u5740\u5217\u8868\uFF0C\u4F8B\u5982\u5168\u5C40\u5730\u5740\u5217\u8868\uFF08GAL\uFF09\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1087\/003\/"},{"id":"T1087.004","name":"\u4E91\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u4E91\u8D26\u6237\u5217\u8868\u3002\u4E91\u8D26\u6237\u662F\u7531\u7EC4\u7EC7\u521B\u5EFA\u548C\u914D\u7F6E\uFF0C\u4F9B\u7528\u6237\u3001\u8FDC\u7A0B\u652F\u6301\u3001\u670D\u52A1\u4F7F\u7528\uFF0C\u6216\u7528\u4E8E\u7BA1\u7406\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u6216SaaS\u5E94\u7528\u7A0B\u5E8F\u5185\u8D44\u6E90\u7684\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1087\/004\/"},{"id":"T1087","name":"\u8D26\u6237\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u7CFB\u7EDF\u6216\u53D7\u611F\u67D3\u73AF\u5883\u4E2D\u6709\u6548\u8D26\u6237\u3001\u7528\u6237\u540D\u6216\u7535\u5B50\u90AE\u4EF6\u5730\u5740\u7684\u5217\u8868\u3002\u8FD9\u4E9B\u4FE1\u606F\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u786E\u5B9A\u54EA\u4E9B\u8D26\u6237\u5B58\u5728\uFF0C\u8FDB\u800C\u652F\u6301\u540E\u7EED\u884C\u4E3A\uFF0C\u5982\u66B4\u529B\u7834\u89E3\u3001\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u653B\u51FB\u6216\u8D26\u6237\u63A5\u7BA1\uFF08\u4F8B\u5982\uFF0C\u5229\u7528\u6709\u6548\u8D26\u6237\uFF09\u3002","sub-techniques":"T1087.001, T1087.002, T1087.003, T1087.004","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1087\/"},{"id":"T1090.001","name":"\u5185\u90E8\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5185\u90E8\u4EE3\u7406\u5728\u53D7\u611F\u67D3\u73AF\u5883\u4E2D\u5F15\u5BFC\u4E24\u4E2A\u6216\u66F4\u591A\u7CFB\u7EDF\u4E4B\u95F4\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u3002\u73B0\u6709\u591A\u79CD\u5DE5\u5177\u53EF\u5B9E\u73B0\u901A\u8FC7\u4EE3\u7406\u6216\u7AEF\u53E3\u91CD\u5B9A\u5411\u8FDB\u884C\u6D41\u91CF\u8F6C\u53D1\uFF0C\u5305\u62ECHTRAN\u3001ZXProxy\u548CZXPortMap\u3002\u653B\u51FB\u8005\u4F7F\u7528\u5185\u90E8\u4EE3\u7406\u6765\u7BA1\u7406\u53D7\u611F\u67D3\u73AF\u5883\u5185\u7684\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u4FE1\uFF0C\u4EE5\u51CF\u5C11\u540C\u65F6\u51FA\u7AD9\u7F51\u7EDC\u8FDE\u63A5\u7684\u6570\u91CF\uFF0C\u5728\u8FDE\u63A5\u4E22\u5931\u65F6\u63D0\u4F9B\u6062\u590D\u80FD\u529B\uFF0C\u6216\u5229\u7528\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E4B\u95F4\u73B0\u6709\u7684\u53EF\u4FE1\u901A\u4FE1\u8DEF\u5F84\u6765\u907F\u514D\u5F15\u8D77\u6000\u7591\u3002\u5185\u90E8\u4EE3\u7406\u8FDE\u63A5\u53EF\u80FD\u91C7\u7528\u5E38\u89C1\u7684\u70B9\u5BF9\u70B9\uFF08P2P\uFF09\u7F51\u7EDC\u534F\u8BAE\uFF0C\u5982SMB\uFF0C\u4EE5\u66F4\u597D\u5730\u878D\u5165\u73AF\u5883\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1090\/001\/"},{"id":"T1090.002","name":"\u5916\u90E8\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5916\u90E8\u4EE3\u7406\u4F5C\u4E3A\u7F51\u7EDC\u901A\u4FE1\u7684\u4E2D\u4ECB\uFF0C\u8FDE\u63A5\u81F3\u547D\u4EE4\u4E0E\u63A7\u5236\u670D\u52A1\u5668\uFF0C\u4EE5\u6B64\u907F\u514D\u76F4\u63A5\u4E0E\u5176\u57FA\u7840\u8BBE\u65BD\u5EFA\u7ACB\u8FDE\u63A5\u3002\u73B0\u6709\u591A\u79CD\u5DE5\u5177\u53EF\u5B9E\u73B0\u901A\u8FC7\u4EE3\u7406\u6216\u7AEF\u53E3\u91CD\u5B9A\u5411\u8FDB\u884C\u6D41\u91CF\u8F6C\u53D1\uFF0C\u4F8B\u5982HTRAN\u3001ZXProxy\u548CZXPortMap\u3002\u653B\u51FB\u8005\u4F7F\u7528\u8FD9\u7C7B\u4EE3\u7406\u6765\u7BA1\u7406\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u4FE1\uFF0C\u4EE5\u5E94\u5BF9\u8FDE\u63A5\u4E2D\u65AD\u65F6\u4FDD\u6301\u97E7\u6027\uFF0C\u6216\u5229\u7528\u73B0\u6709\u53EF\u4FE1\u901A\u4FE1\u8DEF\u5F84\u6765\u89C4\u907F\u6000\u7591\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1090\/002\/"},{"id":"T1090.003","name":"\u591A\u8DF3\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4E32\u8054\u4F7F\u7528\u591A\u4E2A\u4EE3\u7406\u670D\u52A1\u5668\u6765\u63A9\u76D6\u6076\u610F\u6D41\u91CF\u7684\u6765\u6E90\u3002\u901A\u5E38\uFF0C\u9632\u5FA1\u8005\u80FD\u591F\u8BC6\u522B\u6D41\u91CF\u8FDB\u5165\u5176\u7F51\u7EDC\u524D\u7ECF\u8FC7\u7684\u6700\u540E\u4E00\u4E2A\u4EE3\u7406\uFF1B\u800C\u5BF9\u4E8E\u6700\u540E\u4E00\u8DF3\u4EE3\u7406\u4E4B\u524D\u7684\u5176\u4ED6\u4EE3\u7406\uFF0C\u9632\u5FA1\u8005\u53EF\u80FD\u65E0\u6CD5\u5168\u90E8\u8BC6\u522B\u3002\u8FD9\u79CD\u6280\u672F\u901A\u8FC7\u8FEB\u4F7F\u9632\u5FA1\u8005\u8FFD\u8E2A\u6076\u610F\u6D41\u91CF\u7A7F\u8D8A\u591A\u4E2A\u4EE3\u7406\u670D\u52A1\u5668\u6765\u5B9A\u4F4D\u5176\u6E90\u5934\uFF0C\u4ECE\u800C\u4F7F\u5F97\u8FFD\u6EAF\u6076\u610F\u6D41\u91CF\u7684\u539F\u59CB\u6765\u6E90\u53D8\u5F97\u66F4\u52A0\u56F0\u96BE\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1090\/003\/"},{"id":"T1090.004","name":"\u57DF\u540D\u524D\u7F6E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5185\u5BB9\u5206\u53D1\u7F51\u7EDC\uFF08CDN\uFF09\u53CA\u5176\u4ED6\u6258\u7BA1\u591A\u57DF\u540D\u7684\u670D\u52A1\u4E2D\u7684\u8DEF\u7531\u65B9\u6848\uFF0C\u6765\u63A9\u76D6HTTPS\u6D41\u91CF\u6216\u901A\u8FC7HTTPS\u96A7\u9053\u4F20\u8F93\u6D41\u91CF\u7684\u771F\u5B9E\u76EE\u7684\u5730\u3002\u57DF\u540D\u524D\u7F6E\u6280\u672F\u6D89\u53CA\u5728TLS\u5934\u90E8\u7684SNI\u5B57\u6BB5\u548CHTTP\u5934\u90E8\u7684Host\u5B57\u6BB5\u4E2D\u4F7F\u7528\u4E0D\u540C\u7684\u57DF\u540D\u3002\u5982\u679C\u8FD9\u4E24\u4E2A\u57DF\u540D\u7531\u540C\u4E00CDN\u63D0\u4F9B\u670D\u52A1\uFF0C\u5219CDN\u5728\u89E3\u5C01\u88C5TLS\u5934\u90E8\u540E\uFF0C\u53EF\u80FD\u4F1A\u6839\u636EHTTP\u5934\u90E8\u4E2D\u6307\u5B9A\u7684\u5730\u5740\u8FDB\u884C\u8DEF\u7531\u3002\u8BE5\u6280\u672F\u7684\u4E00\u79CD\u53D8\u4F53\u79F0\u4E3A\u201C\u65E0\u57DF\u540D\u201D\u524D\u7F6E\uFF0C\u5176\u7279\u70B9\u662FSNI\u5B57\u6BB5\u7559\u7A7A\uFF1B\u5373\u4F7FCDN\u5C1D\u8BD5\u9A8C\u8BC1SNI\u4E0EHTTP Host\u5B57\u6BB5\u662F\u5426\u5339\u914D\uFF08\u82E5\u7A7A\u767D\u7684SNI\u5B57\u6BB5\u88AB\u5FFD\u7565\uFF09\uFF0C\u8FD9\u79CD\u65B9\u5F0F\u4ECD\u53EF\u80FD\u4F7F\u524D\u7F6E\u6280\u672F\u751F\u6548\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1090\/004\/"},{"id":"T1090","name":"\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u8FDE\u63A5\u4EE3\u7406\u6765\u5F15\u5BFC\u7CFB\u7EDF\u95F4\u7684\u7F51\u7EDC\u6D41\u91CF\uFF0C\u6216\u4F5C\u4E3A\u7F51\u7EDC\u901A\u4FE1\u5230\u547D\u4EE4\u4E0E\u63A7\u5236\u670D\u52A1\u5668\u7684\u4E2D\u95F4\u5A92\u4ECB\uFF0C\u4EE5\u907F\u514D\u76F4\u63A5\u8FDE\u63A5\u5230\u5176\u57FA\u7840\u8BBE\u65BD\u3002\u5B58\u5728\u591A\u79CD\u5DE5\u5177\u53EF\u5B9E\u73B0\u901A\u8FC7\u4EE3\u7406\u6216\u7AEF\u53E3\u91CD\u5B9A\u5411\u8FDB\u884C\u6D41\u91CF\u8F6C\u53D1\uFF0C\u5305\u62ECHTRAN\u3001ZXProxy\u548CZXPortMap\u3002\u653B\u51FB\u8005\u5229\u7528\u8FD9\u7C7B\u4EE3\u7406\u6765\u7BA1\u7406\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u4FE1\u3001\u51CF\u5C11\u540C\u65F6\u51FA\u7AD9\u7F51\u7EDC\u8FDE\u63A5\u7684\u6570\u91CF\u3001\u5728\u8FDE\u63A5\u4E22\u5931\u65F6\u63D0\u4F9B\u6062\u590D\u80FD\u529B\uFF0C\u6216\u5229\u7528\u53D7\u5BB3\u8005\u4E4B\u95F4\u5DF2\u6709\u7684\u53EF\u4FE1\u901A\u4FE1\u8DEF\u5F84\u6765\u907F\u514D\u5F15\u8D77\u6000\u7591\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u591A\u4E2A\u4EE3\u7406\u4E32\u8054\u4F7F\u7528\uFF0C\u4EE5\u8FDB\u4E00\u6B65\u63A9\u76D6\u6076\u610F\u6D41\u91CF\u7684\u6765\u6E90\u3002","sub-techniques":"T1090.001, T1090.002, T1090.003, T1090.004","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1090\/"},{"id":"T1091","name":"\u901A\u8FC7\u53EF\u79FB\u52A8\u4ECB\u8D28\u8FDB\u884C\u590D\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u6076\u610F\u8F6F\u4EF6\u590D\u5236\u5230\u53EF\u79FB\u52A8\u5A92\u4F53\u4E0A\uFF0C\u5E76\u5229\u7528\u5A92\u4F53\u63D2\u5165\u7CFB\u7EDF\u65F6\u7684\u81EA\u52A8\u8FD0\u884C\u529F\u80FD\u6765\u6267\u884C\uFF0C\u4ECE\u800C\u4FB5\u5165\u7CFB\u7EDF\uFF0C\u5305\u62EC\u90A3\u4E9B\u5904\u4E8E\u65AD\u5F00\u8FDE\u63A5\u6216\u7269\u7406\u9694\u79BB\u7F51\u7EDC\u4E2D\u7684\u7CFB\u7EDF\u3002\u5728\u6A2A\u5411\u79FB\u52A8\u7684\u60C5\u51B5\u4E0B\uFF0C\u8FD9\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u5B58\u50A8\u5728\u53EF\u79FB\u52A8\u5A92\u4F53\u4E0A\u7684\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u6216\u901A\u8FC7\u590D\u5236\u6076\u610F\u8F6F\u4EF6\u5E76\u5C06\u5176\u91CD\u547D\u540D\u4E3A\u770B\u4F3C\u5408\u6CD5\u7684\u6587\u4EF6\uFF0C\u8BF1\u4F7F\u7528\u6237\u5728\u53E6\u4E00\u7CFB\u7EDF\u4E0A\u6267\u884C\u6765\u5B9E\u73B0\u3002\u5728\u521D\u59CB\u8BBF\u95EE\u7684\u60C5\u51B5\u4E0B\uFF0C\u8FD9\u53EF\u80FD\u901A\u8FC7\u624B\u52A8\u64CD\u4F5C\u5A92\u4F53\u3001\u4FEE\u6539\u7528\u4E8E\u521D\u59CB\u683C\u5F0F\u5316\u5A92\u4F53\u7684\u7CFB\u7EDF\uFF0C\u6216\u4FEE\u6539\u5A92\u4F53\u672C\u8EAB\u7684\u56FA\u4EF6\u6765\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1091\/"},{"id":"T1092","name":"\u901A\u8FC7\u53EF\u79FB\u52A8\u4ECB\u8D28\u8FDB\u884C\u901A\u4FE1","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u53EF\u79FB\u52A8\u4ECB\u8D28\u5728\u53EF\u80FD\u65AD\u7F51\u7684\u53D7\u611F\u67D3\u4E3B\u673A\u4E4B\u95F4\u8FDB\u884C\u547D\u4EE4\u4E0E\u63A7\u5236\uFF0C\u901A\u8FC7\u4ECB\u8D28\u5728\u7CFB\u7EDF\u95F4\u4F20\u9012\u6307\u4EE4\u3002\u8FD9\u8981\u6C42\u4E24\u4E2A\u7CFB\u7EDF\u5747\u5DF2\u88AB\u5165\u4FB5\uFF0C\u901A\u5E38\u5148\u653B\u7834\u8054\u7F51\u4E3B\u673A\uFF0C\u518D\u901A\u8FC7\"\u53EF\u79FB\u52A8\u4ECB\u8D28\u590D\u5236\"\u6280\u672F\u6A2A\u5411\u6E17\u900F\u81F3\u9694\u79BB\u7CFB\u7EDF\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u5C06\u9694\u79BB\u7CFB\u7EDF\u4E2D\u7684\u6307\u4EE4\u548C\u6587\u4EF6\u7ECF\u8054\u7F51\u4E3B\u673A\u4E2D\u8F6C\u81F3\u5176\u76F4\u63A5\u63A7\u5236\u7684\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1092\/"},{"id":"T1095","name":"\u975E\u5E94\u7528\u5C42\u534F\u8BAE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528OSI\u975E\u5E94\u7528\u5C42\u534F\u8BAE\u5728\u4E3B\u673A\u4E0E\u547D\u4EE4\u63A7\u5236\u670D\u52A1\u5668\u4E4B\u95F4\uFF0C\u6216\u53D7\u611F\u67D3\u4E3B\u673A\u5728\u7F51\u7EDC\u5185\u90E8\u8FDB\u884C\u901A\u4FE1\u3002\u53EF\u7528\u7684\u534F\u8BAE\u79CD\u7C7B\u7E41\u591A\uFF0C\u5177\u4F53\u5B9E\u4F8B\u5305\u62EC\u4F7F\u7528\u7F51\u7EDC\u5C42\u534F\u8BAE\uFF08\u5982\u4E92\u8054\u7F51\u63A7\u5236\u6D88\u606F\u534F\u8BAEICMP\uFF09\u3001\u4F20\u8F93\u5C42\u534F\u8BAE\uFF08\u5982\u7528\u6237\u6570\u636E\u62A5\u534F\u8BAEUDP\uFF09\u3001\u4F1A\u8BDD\u5C42\u534F\u8BAE\uFF08\u5982Socket Secure SOCKS\uFF09\uFF0C\u4EE5\u53CA\u91CD\u5B9A\u5411\/\u96A7\u9053\u534F\u8BAE\uFF08\u5982\u5C40\u57DF\u7F51\u4E32\u884C\u4F20\u8F93SOL\uFF09\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1095\/"},{"id":"T1098.001","name":"\u9644\u52A0\u4E91\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5411\u4E91\u8D26\u6237\u6DFB\u52A0\u53D7\u5176\u63A7\u5236\u7684\u51ED\u8BC1\uFF0C\u4EE5\u7EF4\u6301\u5BF9\u73AF\u5883\u4E2D\u53D7\u5BB3\u8005\u8D26\u6237\u548C\u5B9E\u4F8B\u7684\u6301\u4E45\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/001\/"},{"id":"T1098.002","name":"\u9644\u52A0\u7535\u5B50\u90AE\u4EF6\u59D4\u6D3E\u6743\u9650","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6388\u4E88\u989D\u5916\u7684\u6743\u9650\u7EA7\u522B\uFF0C\u4EE5\u7EF4\u6301\u5BF9\u53D7\u5176\u63A7\u5236\u7684\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u7684\u6301\u4E45\u8BBF\u95EE\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/002\/"},{"id":"T1098.003","name":"\u9644\u52A0\u4E91\u89D2\u8272","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5411\u53D7\u5176\u63A7\u5236\u7684\u4E91\u8D26\u6237\u6DFB\u52A0\u989D\u5916\u89D2\u8272\u6216\u6743\u9650\uFF0C\u4EE5\u7EF4\u6301\u5BF9\u79DF\u6237\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u4F8B\u5982\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u57FA\u4E8E\u4E91\u7684\u73AF\u5883\u4E2D\u66F4\u65B0IAM\u7B56\u7565\uFF0C\u6216\u5728Office 365\u73AF\u5883\u4E2D\u6DFB\u52A0\u65B0\u7684\u5168\u5C40\u7BA1\u7406\u5458\u3002\u4E00\u65E6\u83B7\u5F97\u8DB3\u591F\u6743\u9650\uFF0C\u88AB\u5165\u4FB5\u7684\u8D26\u6237\u51E0\u4E4E\u53EF\u4EE5\u65E0\u9650\u5236\u5730\u8BBF\u95EE\u6570\u636E\u548C\u8BBE\u7F6E\uFF08\u5305\u62EC\u91CD\u7F6E\u5176\u4ED6\u7BA1\u7406\u5458\u5BC6\u7801\u7684\u80FD\u529B\uFF09\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/003\/"},{"id":"T1098.004","name":"SSH\u6388\u6743\u5BC6\u94A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539SSH\u6388\u6743\u5BC6\u94A5\u6587\u4EF6\u6765\u7EF4\u6301\u5BF9\u53D7\u5BB3\u4E3B\u673A\u7684\u6301\u4E45\u8BBF\u95EE\u3002Linux\u53D1\u884C\u7248\u3001macOS\u4EE5\u53CAESXi\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u901A\u5E38\u91C7\u7528\u57FA\u4E8E\u5BC6\u94A5\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u6765\u52A0\u5F3ASSH\u8FDC\u7A0B\u7BA1\u7406\u4F1A\u8BDD\u7684\u8BA4\u8BC1\u5B89\u5168\u6027\u3002SSH\u4E2D\u7684authorized_keys\u6587\u4EF6\u89C4\u5B9A\u4E86\u53EF\u7528\u4E8E\u767B\u5F55\u76F8\u5E94\u7528\u6237\u8D26\u6237\u7684SSH\u5BC6\u94A5\uFF0C\u8BE5\u6587\u4EF6\u901A\u5E38\u4F4D\u4E8E\u7528\u6237\u4E3B\u76EE\u5F55\u4E0B\u7684&lt;\u7528\u6237\u4E3B\u76EE\u5F55&gt;\/.ssh\/authorized_keys\uFF08\u5728ESXi\u7CFB\u7EDF\u4E2D\u5219\u4F4D\u4E8E\/etc\/ssh\/keys-&lt;\u7528\u6237\u540D&gt;\/authorized_keys\uFF09\u3002\u7528\u6237\u53EF\u901A\u8FC7\u7F16\u8F91\u7CFB\u7EDF\u7684SSH\u914D\u7F6E\u6587\u4EF6\uFF0C\u5C06PubkeyAuthentication\u548CRSAAuthentication\u6307\u4EE4\u503C\u8BBE\u4E3Ayes\u4EE5\u786E\u4FDD\u542F\u7528\u516C\u94A5\u53CARSA\u8BA4\u8BC1\uFF0C\u540C\u65F6\u53EF\u5C06PermitRootLogin\u6307\u4EE4\u503C\u8BBE\u4E3Ayes\u4EE5\u542F\u7528\u901A\u8FC7SSH\u8FDB\u884C\u7684\u6839\u7528\u6237\u8BA4\u8BC1\u3002SSH\u914D\u7F6E\u6587\u4EF6\u901A\u5E38\u4F4D\u4E8E\/etc\/ssh\/sshd_config\u8DEF\u5F84\u4E0B\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/004\/"},{"id":"T1098.005","name":"\u8BBE\u5907\u6CE8\u518C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u8BBE\u5907\u6CE8\u518C\u5230\u53D7\u5176\u63A7\u5236\u7684\u8D26\u6237\u4E2D\u3002\u8BBE\u5907\u53EF\u80FD\u88AB\u6CE8\u518C\u5230\u5904\u7406\u7F51\u7EDC\u8BA4\u8BC1\u7684\u591A\u56E0\u7D20\u8BA4\u8BC1\uFF08MFA\uFF09\u7CFB\u7EDF\uFF0C\u6216\u662F\u5904\u7406\u8BBE\u5907\u8BBF\u95EE\u4E0E\u5408\u89C4\u6027\u7684\u8BBE\u5907\u7BA1\u7406\u7CFB\u7EDF\u4E2D\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/005\/"},{"id":"T1098.006","name":"\u9644\u52A0\u5BB9\u5668\u96C6\u7FA4\u89D2\u8272","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5411\u53D7\u5176\u63A7\u5236\u7684\u7528\u6237\u6216\u670D\u52A1\u8D26\u6237\u6DFB\u52A0\u989D\u5916\u89D2\u8272\u6216\u6743\u9650\uFF0C\u4EE5\u7EF4\u6301\u5BF9\u5BB9\u5668\u7F16\u6392\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u4F8B\u5982\uFF0C\u62E5\u6709\u8DB3\u591F\u6743\u9650\u7684\u653B\u51FB\u8005\u53EF\u4EE5\u521B\u5EFARoleBinding\u6216ClusterRoleBinding\uFF0C\u5C06Role\u6216ClusterRole\u7ED1\u5B9A\u5230Kubernetes\u8D26\u6237\u3002\u5728\u4F7F\u7528\u57FA\u4E8E\u5C5E\u6027\u7684\u8BBF\u95EE\u63A7\u5236\uFF08ABAC\uFF09\u7684\u60C5\u51B5\u4E0B\uFF0C\u62E5\u6709\u8DB3\u591F\u6743\u9650\u7684\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539Kubernetes ABAC\u7B56\u7565\uFF0C\u4E3A\u76EE\u6807\u8D26\u6237\u6388\u4E88\u989D\u5916\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/006\/"},{"id":"T1098.007","name":"\u5176\u4ED6\u672C\u5730\u6216\u57DF\u7EC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5411\u53D7\u5176\u63A7\u5236\u7684\u8D26\u6237\u6DFB\u52A0\u989D\u5916\u7684\u672C\u5730\u6216\u57DF\u7EC4\uFF0C\u4EE5\u7EF4\u6301\u5BF9\u7CFB\u7EDF\u6216\u57DF\u7684\u6301\u4E45\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/007\/"},{"id":"T1098","name":"\u8D26\u6237\u64CD\u7EB5","description":"\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u64CD\u7EB5\u8D26\u6237\u6765\u7EF4\u6301\u548C\/\u6216\u63D0\u5347\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u8D26\u6237\u64CD\u7EB5\u5305\u62EC\u4EFB\u4F55\u65E8\u5728\u4FDD\u7559\u6216\u4FEE\u6539\u5BF9\u624B\u5BF9\u5DF2\u5165\u4FB5\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u7684\u884C\u4E3A\uFF0C\u4F8B\u5982\u4FEE\u6539\u51ED\u636E\u6216\u6743\u9650\u7EC4\u3002\u8FD9\u4E9B\u884C\u4E3A\u8FD8\u53EF\u80FD\u5305\u62EC\u65E8\u5728\u89C4\u907F\u5B89\u5168\u7B56\u7565\u7684\u8D26\u6237\u6D3B\u52A8\uFF0C\u4F8B\u5982\u6267\u884C\u8FED\u4EE3\u5BC6\u7801\u66F4\u65B0\u4EE5\u7ED5\u8FC7\u5BC6\u7801\u6709\u6548\u671F\u7B56\u7565\uFF0C\u4ECE\u800C\u5EF6\u957F\u88AB\u5165\u4FB5\u51ED\u636E\u7684\u4F7F\u7528\u5BFF\u547D\u3002","sub-techniques":"T1098.001, T1098.002, T1098.003, T1098.004, T1098.005, T1098.006, T1098.007","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1098\/"},{"id":"T1102.001","name":"\u6B7B\u4FE1\u6295\u9012\u89E3\u6790\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u73B0\u6709\u7684\u5408\u6CD5\u5916\u90E8\u7F51\u7EDC\u670D\u52A1\u6765\u6258\u7BA1\u6307\u5411\u989D\u5916\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u57FA\u7840\u8BBE\u65BD\u7684\u4FE1\u606F\u3002\u4ED6\u4EEC\u4F1A\u5728\u7F51\u7EDC\u670D\u52A1\u4E0A\u53D1\u5E03\u88AB\u79F0\u4E3A\"\u6B7B\u4FE1\u6295\u9012\u89E3\u6790\u5668\"\u7684\u5185\u5BB9\uFF0C\u5176\u4E2D\u5305\u542B\u5D4C\u5165\u7684\uFF08\u901A\u5E38\u7ECF\u8FC7\u6DF7\u6DC6\u6216\u7F16\u7801\u7684\uFF09\u57DF\u540D\u6216IP\u5730\u5740\u3002\u4E00\u65E6\u53D7\u5BB3\u8005\u8BBE\u5907\u88AB\u611F\u67D3\uFF0C\u4FBF\u4F1A\u4E3B\u52A8\u8054\u7CFB\u8FD9\u4E9B\u89E3\u6790\u5668\u5E76\u88AB\u5176\u91CD\u5B9A\u5411\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1102\/001\/"},{"id":"T1102.002","name":"\u53CC\u5411\u901A\u4FE1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u73B0\u6709\u7684\u5408\u6CD5\u5916\u90E8\u7F51\u7EDC\u670D\u52A1\uFF0C\u901A\u8FC7\u8BE5\u670D\u52A1\u6E20\u9053\u5411\u53D7\u611F\u67D3\u7CFB\u7EDF\u53D1\u9001\u6307\u4EE4\u5E76\u63A5\u6536\u8F93\u51FA\u3002\u53D7\u611F\u67D3\u7CFB\u7EDF\u53EF\u80FD\u5229\u7528\u70ED\u95E8\u7F51\u7AD9\u548C\u793E\u4EA4\u5A92\u4F53\u6258\u7BA1\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u6307\u4EE4\uFF0C\u968F\u540E\u901A\u8FC7\u540C\u4E00\u7F51\u7EDC\u670D\u52A1\u6E20\u9053\u5C06\u547D\u4EE4\u6267\u884C\u7ED3\u679C\u56DE\u4F20\u3002\u56DE\u4F20\u6D41\u91CF\u7684\u5F62\u5F0F\u591A\u6837\uFF0C\u5177\u4F53\u53D6\u51B3\u4E8E\u6240\u4F7F\u7528\u7684\u7F51\u7EDC\u670D\u52A1\u7C7B\u578B\u3002\u4F8B\u5982\uFF0C\u53D7\u611F\u67D3\u7CFB\u7EDF\u53EF\u80FD\u5728\u8BBA\u575B\u53D1\u5E03\u8BC4\u8BBA\u3001\u5411\u5F00\u53D1\u9879\u76EE\u63D0\u4EA4\u62C9\u53D6\u8BF7\u6C42\u3001\u66F4\u65B0\u7F51\u7EDC\u670D\u52A1\u6258\u7BA1\u7684\u6587\u6863\uFF0C\u6216\u901A\u8FC7\u53D1\u9001\u63A8\u6587\u7B49\u65B9\u5F0F\u5B9E\u73B0\u6570\u636E\u56DE\u4F20\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1102\/002\/"},{"id":"T1102.003","name":"\u5355\u5411\u6C9F\u901A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u73B0\u6709\u7684\u5408\u6CD5\u5916\u90E8\u7F51\u7EDC\u670D\u52A1\uFF0C\u5411\u53D7\u611F\u67D3\u7CFB\u7EDF\u53D1\u9001\u6307\u4EE4\uFF0C\u800C\u65E0\u9700\u901A\u8FC7\u7F51\u7EDC\u670D\u52A1\u901A\u9053\u63A5\u6536\u8FD4\u56DE\u7684\u8F93\u51FA\u3002\u53D7\u611F\u67D3\u7CFB\u7EDF\u53EF\u80FD\u5229\u7528\u70ED\u95E8\u7F51\u7AD9\u548C\u793E\u4EA4\u5A92\u4F53\u6765\u6258\u7BA1\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u6307\u4EE4\u3002\u8FD9\u4E9B\u53D7\u611F\u67D3\u7CFB\u7EDF\u53EF\u80FD\u9009\u62E9\u901A\u8FC7\u4E0D\u540C\u7684C2\u901A\u9053\u53D1\u9001\u547D\u4EE4\u8F93\u51FA\uFF0C\u5305\u62EC\u53D1\u9001\u5230\u53E6\u4E00\u4E2A\u72EC\u7ACB\u7684\u7F51\u7EDC\u670D\u52A1\u3002\u6216\u8005\uFF0C\u5728\u653B\u51FB\u8005\u5E0C\u671B\u5411\u7CFB\u7EDF\u53D1\u9001\u6307\u4EE4\u4E14\u4E0D\u9700\u8981\u56DE\u5E94\u7684\u60C5\u51B5\u4E0B\uFF0C\u53D7\u611F\u67D3\u7CFB\u7EDF\u53EF\u80FD\u5B8C\u5168\u4E0D\u8FD4\u56DE\u4EFB\u4F55\u8F93\u51FA\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1102\/003\/"},{"id":"T1102","name":"\u7F51\u7EDC\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u73B0\u6709\u7684\u5408\u6CD5\u5916\u90E8\u7F51\u7EDC\u670D\u52A1\u4F5C\u4E3A\u4E2D\u7EE7\u6570\u636E\u8FDB\u51FA\u53D7\u611F\u67D3\u7CFB\u7EDF\u7684\u9014\u5F84\u3002\u7531\u4E8E\u7F51\u7EDC\u5185\u7684\u4E3B\u673A\u5728\u906D\u53D7\u5165\u4FB5\u524D\u5F88\u53EF\u80FD\u5DF2\u4E0E\u8FD9\u4E9B\u6D41\u884C\u7F51\u7AD9\u3001\u4E91\u670D\u52A1\u548C\u793E\u4EA4\u5A92\u4F53\u8FDB\u884C\u901A\u4FE1\uFF0C\u8FD9\u4E9B\u5E73\u53F0\u82E5\u88AB\u7528\u4F5C\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u6E20\u9053\uFF0C\u5C06\u80FD\u63D0\u4F9B\u663E\u8457\u7684\u9690\u853D\u6027\u3002\u901A\u8FC7\u4F7F\u7528\u8C37\u6B4C\u3001\u5FAE\u8F6F\u6216\u63A8\u7279\u7B49\u5E38\u89C1\u670D\u52A1\uFF0C\u653B\u51FB\u8005\u66F4\u5BB9\u6613\u85CF\u533F\u4E8E\u9884\u671F\u7684\u7F51\u7EDC\u6D41\u91CF\u566A\u58F0\u4E2D\u3002\u7F51\u7EDC\u670D\u52A1\u63D0\u4F9B\u5546\u666E\u904D\u91C7\u7528SSL\/TLS\u52A0\u5BC6\uFF0C\u8FD9\u4E3A\u653B\u51FB\u8005\u63D0\u4F9B\u4E86\u989D\u5916\u7684\u4FDD\u62A4\u5C42\u3002","sub-techniques":"T1102.001, T1102.002, T1102.003","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1102\/"},{"id":"T1104","name":"\u591A\u7EA7\u6E20\u9053","description":"\u5BF9\u624B\u53EF\u80FD\u4E3A\u547D\u4EE4\u4E0E\u63A7\u5236\u521B\u5EFA\u591A\u4E2A\u9636\u6BB5\uFF0C\u8FD9\u4E9B\u9636\u6BB5\u5728\u4E0D\u540C\u6761\u4EF6\u4E0B\u6216\u9488\u5BF9\u7279\u5B9A\u529F\u80FD\u4F7F\u7528\u3002\u91C7\u7528\u591A\u9636\u6BB5\u7B56\u7565\u53EF\u4EE5\u6DF7\u6DC6\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\uFF0C\u4ECE\u800C\u589E\u52A0\u68C0\u6D4B\u96BE\u5EA6\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1104\/"},{"id":"T1105","name":"Ingress\u5DE5\u5177\u8F6C\u79FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u5DE5\u5177\u6216\u5176\u4ED6\u6587\u4EF6\u4ECE\u5916\u90E8\u7CFB\u7EDF\u8F6C\u79FB\u5230\u53D7\u611F\u67D3\u7684\u73AF\u5883\u4E2D\u3002\u8FD9\u4E9B\u5DE5\u5177\u6216\u6587\u4EF6\u53EF\u4EE5\u901A\u8FC7\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\uFF0C\u6216\u901A\u8FC7\u5982FTP\u7B49\u66FF\u4EE3\u534F\u8BAE\uFF0C\u4ECE\u5916\u90E8\u7531\u653B\u51FB\u8005\u63A7\u5236\u7684\u7CFB\u7EDF\u590D\u5236\u5230\u53D7\u5BB3\u7F51\u7EDC\u4E2D\u3002\u4E00\u65E6\u8FD9\u4E9B\u5DE5\u5177\u6216\u6587\u4EF6\u5B58\u5728\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u73AF\u5883\u5185\u7684\u53D7\u5BB3\u8BBE\u5907\u4E4B\u95F4\u8F6C\u79FB\u6216\u4F20\u64AD\u5DE5\u5177\uFF08\u5373\u6A2A\u5411\u5DE5\u5177\u8F6C\u79FB\uFF09\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1105\/"},{"id":"T1106","name":"\u539F\u751FAPI","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u901A\u8FC7\u64CD\u4F5C\u7CFB\u7EDF\u539F\u751F\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\u6765\u6267\u884C\u6076\u610F\u884C\u4E3A\u3002\u539F\u751FAPI\u63D0\u4F9B\u4E86\u4E00\u79CD\u53D7\u63A7\u7684\u65B9\u5F0F\uFF0C\u7528\u4E8E\u8C03\u7528\u5185\u6838\u4E2D\u7684\u5E95\u5C42\u64CD\u4F5C\u7CFB\u7EDF\u670D\u52A1\uFF0C\u4F8B\u5982\u6D89\u53CA\u786C\u4EF6\/\u8BBE\u5907\u3001\u5185\u5B58\u548C\u8FDB\u7A0B\u7684\u64CD\u4F5C\u3002\u64CD\u4F5C\u7CFB\u7EDF\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\uFF08\u5F53\u5176\u4ED6\u7CFB\u7EDF\u7EC4\u4EF6\u5C1A\u672A\u521D\u59CB\u5316\u65F6\uFF09\u4F1A\u5229\u7528\u8FD9\u4E9B\u539F\u751FAPI\uFF0C\u5E76\u5728\u65E5\u5E38\u64CD\u4F5C\u4E2D\u6267\u884C\u4EFB\u52A1\u548C\u5904\u7406\u8BF7\u6C42\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1106\/"},{"id":"T1110.001","name":"\u5BC6\u7801\u731C\u6D4B","description":"\u5BF9\u7CFB\u7EDF\u6216\u73AF\u5883\u4E2D\u5408\u6CD5\u51ED\u8BC1\u4E00\u65E0\u6240\u77E5\u7684\u5BF9\u624B\u53EF\u80FD\u4F1A\u731C\u6D4B\u5BC6\u7801\u4EE5\u5C1D\u8BD5\u8BBF\u95EE\u8D26\u6237\u3002\u5728\u4E0D\u77E5\u9053\u8D26\u6237\u5BC6\u7801\u7684\u60C5\u51B5\u4E0B\uFF0C\u5BF9\u624B\u53EF\u80FD\u9009\u62E9\u4F7F\u7528\u91CD\u590D\u6216\u8FED\u4EE3\u673A\u5236\u7CFB\u7EDF\u6027\u5730\u731C\u6D4B\u5BC6\u7801\u3002\u5728\u64CD\u4F5C\u8FC7\u7A0B\u4E2D\uFF0C\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u4F7F\u7528\u5E38\u89C1\u5BC6\u7801\u5217\u8868\u6765\u731C\u6D4B\u767B\u5F55\u51ED\u8BC1\uFF0C\u800C\u65E0\u9700\u4E8B\u5148\u4E86\u89E3\u7CFB\u7EDF\u6216\u73AF\u5883\u7684\u5BC6\u7801\u3002\u5BC6\u7801\u731C\u6D4B\u53EF\u80FD\u4F1A\u4E5F\u53EF\u80FD\u4E0D\u4F1A\u8003\u8651\u76EE\u6807\u5173\u4E8E\u5BC6\u7801\u590D\u6742\u6027\u7684\u7B56\u7565\uFF0C\u6216\u8005\u4F7F\u7528\u5728\u591A\u6B21\u5C1D\u8BD5\u5931\u8D25\u540E\u9501\u5B9A\u8D26\u6237\u7684\u7B56\u7565\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1110\/001\/"},{"id":"T1110.002","name":"\u5BC6\u7801\u7834\u89E3","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5BC6\u7801\u7834\u89E3\u5C1D\u8BD5\u6062\u590D\u53EF\u7528\u7684\u51ED\u8BC1\uFF0C\u4F8B\u5982\u660E\u6587\u5BC6\u7801\uFF0C\u5C24\u5176\u662F\u5728\u83B7\u53D6\u5230\u5BC6\u7801\u54C8\u5E0C\u7B49\u51ED\u8BC1\u6750\u6599\u65F6\u3002\u64CD\u4F5C\u7CFB\u7EDF\u51ED\u8BC1\u8F6C\u50A8\u53EF\u7528\u4E8E\u83B7\u53D6\u5BC6\u7801\u54C8\u5E0C\uFF0C\u4F46\u5F53\u65E0\u6CD5\u4F7F\u7528\u54C8\u5E0C\u4F20\u9012\u653B\u51FB\u65F6\uFF0C\u8FD9\u79CD\u65B9\u6CD5\u5BF9\u653B\u51FB\u8005\u7684\u5E2E\u52A9\u6709\u9650\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u914D\u7F6E\u5B58\u50A8\u5E93\u4E2D\u7684\u6570\u636E\uFF0C\u4EE5\u83B7\u53D6\u7F51\u7EDC\u8BBE\u5907\u7684\u54C8\u5E0C\u51ED\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1110\/002\/"},{"id":"T1110.003","name":"\u5BC6\u7801\u55B7\u6D12\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u5355\u4E2A\u6216\u5C11\u91CF\u5E38\u7528\u5BC6\u7801\u5217\u8868\uFF0C\u9488\u5BF9\u591A\u4E2A\u4E0D\u540C\u8D26\u6237\u5C1D\u8BD5\u83B7\u53D6\u6709\u6548\u7684\u8D26\u6237\u51ED\u636E\u3002\u5BC6\u7801\u55B7\u6D12\u653B\u51FB\u91C7\u7528\u4E00\u4E2A\u5BC6\u7801\uFF08\u4F8B\u5982'Password01'\uFF09\u6216\u4E00\u5C0F\u7EC4\u5E38\u7528\u5BC6\u7801\uFF0C\u8FD9\u4E9B\u5BC6\u7801\u53EF\u80FD\u7B26\u5408\u57DF\u7B56\u7565\u7684\u590D\u6742\u6027\u8981\u6C42\u3002\u901A\u8FC7\u4F7F\u7528\u8BE5\u5BC6\u7801\u5BF9\u7F51\u7EDC\u4E0A\u591A\u4E2A\u4E0D\u540C\u8D26\u6237\u5C1D\u8BD5\u767B\u5F55\uFF0C\u53EF\u4EE5\u907F\u514D\u56E0\u5BF9\u5355\u4E2A\u8D26\u6237\u4F7F\u7528\u5927\u91CF\u5BC6\u7801\u8FDB\u884C\u66B4\u529B\u7834\u89E3\u800C\u901A\u5E38\u89E6\u53D1\u7684\u8D26\u6237\u9501\u5B9A\u673A\u5236\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1110\/003\/"},{"id":"T1110.004","name":"\u51ED\u8BC1\u586B\u5145","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4ECE\u65E0\u5173\u8D26\u6237\u6CC4\u9732\u6570\u636E\u4E2D\u83B7\u53D6\u7684\u51ED\u8BC1\uFF0C\u901A\u8FC7\u51ED\u8BC1\u91CD\u53E0\u6765\u8BBF\u95EE\u76EE\u6807\u8D26\u6237\u3002\u5F53\u7F51\u7AD9\u6216\u670D\u52A1\u906D\u5230\u5165\u4FB5\uFF0C\u7528\u6237\u8D26\u6237\u51ED\u8BC1\u88AB\u7A83\u53D6\u65F6\uFF0C\u5927\u91CF\u7528\u6237\u540D\u548C\u5BC6\u7801\u7EC4\u5408\u5076\u5C14\u4F1A\u88AB\u5728\u7EBF\u516C\u5F00\u3002\u8FD9\u4E9B\u4FE1\u606F\u5BF9\u4E8E\u8BD5\u56FE\u5165\u4FB5\u8D26\u6237\u7684\u653B\u51FB\u8005\u53EF\u80FD\u6709\u7528\uFF0C\u56E0\u4E3A\u4ED6\u4EEC\u53EF\u4EE5\u5229\u7528\u7528\u6237\u5728\u4E2A\u4EBA\u548C\u5DE5\u4F5C\u8D26\u6237\u4E2D\u4F7F\u7528\u76F8\u540C\u5BC6\u7801\u7684\u503E\u5411\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1110\/004\/"},{"id":"T1110","name":"\u66B4\u529B\u7834\u89E3","description":"\u5F53\u5BC6\u7801\u672A\u77E5\u6216\u83B7\u53D6\u5230\u5BC6\u7801\u54C8\u5E0C\u503C\u65F6\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u91C7\u7528\u66B4\u529B\u7834\u89E3\u6280\u672F\u6765\u83B7\u53D6\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u3002\u5728\u4E0D\u77E5\u9053\u8D26\u6237\u6216\u4E00\u7EC4\u8D26\u6237\u5BC6\u7801\u7684\u60C5\u51B5\u4E0B\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u91CD\u590D\u6216\u8FED\u4EE3\u673A\u5236\u7CFB\u7EDF\u6027\u5730\u731C\u6D4B\u5BC6\u7801\u3002\u66B4\u529B\u7834\u89E3\u5BC6\u7801\u53EF\u901A\u8FC7\u4E24\u79CD\u65B9\u5F0F\u8FDB\u884C\uFF1A\u4E00\u662F\u4E0E\u9A8C\u8BC1\u51ED\u8BC1\u6709\u6548\u6027\u7684\u670D\u52A1\u8FDB\u884C\u4EA4\u4E92\u5F0F\u5C1D\u8BD5\uFF0C\u4E8C\u662F\u5BF9\u5148\u524D\u83B7\u53D6\u7684\u51ED\u8BC1\u6570\u636E\uFF08\u5982\u5BC6\u7801\u54C8\u5E0C\u503C\uFF09\u8FDB\u884C\u79BB\u7EBF\u7834\u89E3\u3002","sub-techniques":"T1110.001, T1110.002, T1110.003, T1110.004","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1110\/"},{"id":"T1111","name":"\u591A\u56E0\u7D20\u8BA4\u8BC1\u62E6\u622A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u591A\u56E0\u7D20\u8BA4\u8BC1\uFF08MFA\uFF09\u673A\u5236\uFF08\u5982\u667A\u80FD\u5361\u3001\u4EE4\u724C\u751F\u6210\u5668\u7B49\uFF09\u8FDB\u884C\u653B\u51FB\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u8BBF\u95EE\u7CFB\u7EDF\u3001\u670D\u52A1\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u51ED\u8BC1\u3002\u867D\u7136\u5EFA\u8BAE\u4F7F\u7528MFA\uFF0C\u5B83\u6BD4\u4EC5\u4F7F\u7528\u7528\u6237\u540D\u548C\u5BC6\u7801\u63D0\u4F9B\u66F4\u9AD8\u7EA7\u522B\u7684\u5B89\u5168\u6027\uFF0C\u4F46\u7EC4\u7EC7\u5E94\u8B66\u60D5\u53EF\u80FD\u7528\u4E8E\u62E6\u622A\u548C\u7ED5\u8FC7\u8FD9\u4E9B\u5B89\u5168\u673A\u5236\u7684\u6280\u672F\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1111\/"},{"id":"T1112","name":"\u4FEE\u6539\u6CE8\u518C\u8868","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u591A\u79CD\u6280\u672F\u624B\u6BB5\u4E0EWindows\u6CE8\u518C\u8868\u4EA4\u4E92\uFF0C\u4EE5\u534F\u52A9\u5B9E\u73B0\u9632\u5FA1\u89C4\u907F\u3001\u6301\u4E45\u5316\u9A7B\u7559\u53CA\u6267\u884C\u6076\u610F\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1112\/"},{"id":"T1113","name":"\u5C4F\u5E55\u622A\u56FE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u64CD\u4F5C\u8FC7\u7A0B\u4E2D\u5C1D\u8BD5\u622A\u53D6\u684C\u9762\u5C4F\u5E55\u4EE5\u6536\u96C6\u4FE1\u606F\u3002\u622A\u5C4F\u529F\u80FD\u53EF\u80FD\u4F5C\u4E3A\u540E\u6E17\u900F\u9636\u6BB5\u4F7F\u7528\u7684\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u7684\u4E00\u9879\u7279\u6027\u3002\u6B64\u5916\uFF0C\u901A\u8FC7\u539F\u751F\u5DE5\u5177\u6216API\u8C03\u7528\uFF08\u5982CopyFromScreen\u3001xwd\u6216screencapture\uFF09\u901A\u5E38\u4E5F\u80FD\u5B9E\u73B0\u5C4F\u5E55\u622A\u56FE\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1113\/"},{"id":"T1114.001","name":"\u672C\u5730\u90AE\u4EF6\u6536\u96C6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u672C\u5730\u7CFB\u7EDF\u4E2D\u7684\u7528\u6237\u7535\u5B50\u90AE\u4EF6\uFF0C\u4EE5\u6536\u96C6\u654F\u611F\u4FE1\u606F\u3002\u5305\u542B\u7535\u5B50\u90AE\u4EF6\u6570\u636E\u7684\u6587\u4EF6\u53EF\u4EE5\u4ECE\u7528\u6237\u7684\u672C\u5730\u7CFB\u7EDF\u83B7\u53D6\uFF0C\u4F8B\u5982Outlook\u5B58\u50A8\u6587\u4EF6\u6216\u7F13\u5B58\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1114\/001\/"},{"id":"T1114.002","name":"\u8FDC\u7A0B\u90AE\u4EF6\u6536\u96C6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9Exchange\u670D\u52A1\u5668\u3001Office 365\u6216Google Workspace\u6765\u6536\u96C6\u654F\u611F\u4FE1\u606F\u3002\u4ED6\u4EEC\u53EF\u80FD\u5229\u7528\u7528\u6237\u51ED\u8BC1\u76F4\u63A5\u4E0EExchange\u670D\u52A1\u5668\u4EA4\u4E92\uFF0C\u4ECE\u7F51\u7EDC\u5185\u90E8\u83B7\u53D6\u4FE1\u606F\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u901A\u8FC7\u5916\u90E8\u8BBF\u95EEExchange\u670D\u52A1\u3001Office 365\u6216Google Workspace\uFF0C\u4F7F\u7528\u51ED\u8BC1\u6216\u8BBF\u95EE\u4EE4\u724C\u6765\u83B7\u53D6\u7535\u5B50\u90AE\u4EF6\u3002\u8BF8\u5982MailSniper\u4E4B\u7C7B\u7684\u5DE5\u5177\u53EF\u7528\u4E8E\u81EA\u52A8\u641C\u7D22\u7279\u5B9A\u5173\u952E\u8BCD\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1114\/002\/"},{"id":"T1114.003","name":"\u7535\u5B50\u90AE\u4EF6\u8F6C\u53D1\u89C4\u5219","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BBE\u7F6E\u90AE\u4EF6\u8F6C\u53D1\u89C4\u5219\u4EE5\u6536\u96C6\u654F\u611F\u4FE1\u606F\u3002\u4ED6\u4EEC\u53EF\u80FD\u6EE5\u7528\u90AE\u4EF6\u8F6C\u53D1\u89C4\u5219\u6765\u76D1\u63A7\u53D7\u5BB3\u8005\u7684\u6D3B\u52A8\u3001\u7A83\u53D6\u4FE1\u606F\uFF0C\u5E76\u8FDB\u4E00\u6B65\u83B7\u53D6\u53D7\u5BB3\u8005\u6216\u5176\u7EC4\u7EC7\u7684\u60C5\u62A5\uFF0C\u4F5C\u4E3A\u540E\u7EED\u653B\u51FB\u6216\u884C\u52A8\u7684\u4E00\u90E8\u5206\u3002\u6B64\u5916\uFF0C\u5373\u4F7F\u7BA1\u7406\u5458\u91CD\u7F6E\u4E86\u88AB\u76D7\u7528\u7684\u51ED\u636E\uFF0C\u90AE\u4EF6\u8F6C\u53D1\u89C4\u5219\u4ECD\u80FD\u8BA9\u653B\u51FB\u8005\u6301\u7EED\u8BBF\u95EE\u53D7\u5BB3\u8005\u7684\u90AE\u4EF6\u3002\u5927\u591A\u6570\u90AE\u4EF6\u5BA2\u6237\u7AEF\u5141\u8BB8\u7528\u6237\u4E3A\u5404\u79CD\u90AE\u4EF6\u529F\u80FD\u521B\u5EFA\u6536\u4EF6\u7BB1\u89C4\u5219\uFF0C\u5305\u62EC\u5C06\u90AE\u4EF6\u8F6C\u53D1\u7ED9\u4E0D\u540C\u7684\u6536\u4EF6\u4EBA\u3002\u8FD9\u4E9B\u89C4\u5219\u53EF\u4EE5\u901A\u8FC7\u672C\u5730\u90AE\u4EF6\u5E94\u7528\u7A0B\u5E8F\u3001\u7F51\u9875\u754C\u9762\u6216\u547D\u4EE4\u884C\u754C\u9762\u521B\u5EFA\u3002\u90AE\u4EF6\u53EF\u4EE5\u8F6C\u53D1\u7ED9\u5185\u90E8\u6216\u5916\u90E8\u6536\u4EF6\u4EBA\uFF0C\u4E14\u5BF9\u6B64\u7C7B\u89C4\u5219\u7684\u8303\u56F4\u6CA1\u6709\u9650\u5236\u3002\u7BA1\u7406\u5458\u4E5F\u53EF\u80FD\u4E3A\u7528\u6237\u8D26\u6237\u521B\u5EFA\u8F6C\u53D1\u89C4\u5219\uFF0C\u5176\u8003\u8651\u56E0\u7D20\u548C\u540E\u679C\u4E0E\u4E0A\u8FF0\u76F8\u540C\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1114\/003\/"},{"id":"T1114","name":"\u7535\u5B50\u90AE\u4EF6\u6536\u96C6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u7528\u6237\u7535\u5B50\u90AE\u4EF6\u4EE5\u6536\u96C6\u654F\u611F\u4FE1\u606F\u3002\u90AE\u4EF6\u4E2D\u53EF\u80FD\u5305\u542B\u654F\u611F\u6570\u636E\uFF0C\u5305\u62EC\u5546\u4E1A\u79D8\u5BC6\u6216\u4E2A\u4EBA\u9690\u79C1\uFF0C\u8FD9\u4E9B\u5BF9\u653B\u51FB\u8005\u5177\u6709\u91CD\u8981\u4EF7\u503C\u3002\u90AE\u4EF6\u8FD8\u53EF\u80FD\u6D89\u53CA\u6B63\u5728\u8FDB\u884C\u7684\u5E94\u6025\u54CD\u5E94\u64CD\u4F5C\u7EC6\u8282\uFF0C\u8FD9\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u8C03\u6574\u5176\u6280\u672F\u624B\u6BB5\uFF0C\u4EE5\u7EF4\u6301\u6301\u4E45\u8BBF\u95EE\u6216\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u4ECE\u90AE\u4EF6\u670D\u52A1\u5668\u6216\u5BA2\u6237\u7AEF\u6536\u96C6\u6216\u8F6C\u53D1\u7535\u5B50\u90AE\u4EF6\u3002","sub-techniques":"T1114.001, T1114.002, T1114.003","tactic":"\u6536\u85CF","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1114\/"},{"id":"T1115","name":"\u526A\u8D34\u677F\u6570\u636E","description":"\u5BF9\u624B\u53EF\u80FD\u4ECE\u7528\u6237\u5728\u5E94\u7528\u7A0B\u5E8F\u5185\u90E8\u6216\u5E94\u7528\u7A0B\u5E8F\u4E4B\u95F4\u590D\u5236\u4FE1\u606F\u7684\u8FC7\u7A0B\u4E2D\uFF0C\u6536\u96C6\u5B58\u50A8\u5728\u526A\u8D34\u677F\u4E2D\u7684\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1115\/"},{"id":"T1119","name":"\u81EA\u52A8\u5316\u6536\u96C6","description":"\u4E00\u65E6\u5728\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E2D\u7ACB\u8DB3\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u91C7\u7528\u81EA\u52A8\u5316\u6280\u672F\u6765\u6536\u96C6\u5185\u90E8\u6570\u636E\u3002\u6267\u884C\u6B64\u6280\u672F\u7684\u65B9\u6CD5\u53EF\u80FD\u5305\u62EC\u4F7F\u7528\u547D\u4EE4\u548C\u811A\u672C\u89E3\u91CA\u5668\uFF0C\u6309\u7167\u8BBE\u5B9A\u7684\u6807\u51C6\uFF08\u5982\u6587\u4EF6\u7C7B\u578B\u3001\u4F4D\u7F6E\u6216\u540D\u79F0\uFF09\u5728\u7279\u5B9A\u65F6\u95F4\u95F4\u9694\u5185\u641C\u7D22\u5E76\u590D\u5236\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1119\/"},{"id":"T1120","name":"\u5916\u56F4\u8BBE\u5907\u53D1\u73B0","description":"\u5BF9\u624B\u53EF\u80FD\u8BD5\u56FE\u6536\u96C6\u6709\u5173\u8FDE\u63A5\u5230\u8BA1\u7B97\u673A\u7CFB\u7EDF\u7684\u5916\u56F4\u8BBE\u5907\u548C\u7EC4\u4EF6\u7684\u4FE1\u606F\u3002\u5916\u56F4\u8BBE\u5907\u53EF\u80FD\u5305\u62EC\u652F\u6301\u591A\u79CD\u529F\u80FD\u7684\u8F85\u52A9\u8D44\u6E90\uFF0C\u5982\u952E\u76D8\u3001\u6253\u5370\u673A\u3001\u6444\u50CF\u5934\u3001\u667A\u80FD\u5361\u8BFB\u5361\u5668\u6216\u53EF\u79FB\u52A8\u5B58\u50A8\u8BBE\u5907\u3002\u8FD9\u4E9B\u4FE1\u606F\u53EF\u80FD\u88AB\u7528\u6765\u589E\u5F3A\u4ED6\u4EEC\u5BF9\u7CFB\u7EDF\u548C\u7F51\u7EDC\u73AF\u5883\u7684\u4E86\u89E3\uFF0C\u6216\u7528\u4E8E\u8FDB\u4E00\u6B65\u7684\u884C\u52A8\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1120\/"},{"id":"T1123","name":"\u97F3\u9891\u6355\u83B7","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u8BA1\u7B97\u673A\u7684\u5916\u56F4\u8BBE\u5907\uFF08\u5982\u9EA6\u514B\u98CE\u548C\u7F51\u7EDC\u6444\u50CF\u5934\uFF09\u6216\u5E94\u7528\u7A0B\u5E8F\uFF08\u5982\u8BED\u97F3\u548C\u89C6\u9891\u901A\u8BDD\u670D\u52A1\uFF09\u6765\u5F55\u5236\u97F3\u9891\uFF0C\u76EE\u7684\u662F\u7A83\u542C\u654F\u611F\u5BF9\u8BDD\u4EE5\u6536\u96C6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1123\/"},{"id":"T1124","name":"\u7CFB\u7EDF\u65F6\u95F4\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u672C\u5730\u6216\u8FDC\u7A0B\u7CFB\u7EDF\u6536\u96C6\u7CFB\u7EDF\u65F6\u95F4\u548C\/\u6216\u65F6\u533A\u8BBE\u7F6E\u3002\u7CFB\u7EDF\u65F6\u95F4\u7531\u670D\u52A1\u8BBE\u5B9A\u548C\u5B58\u50A8\uFF0C\u4F8B\u5982Windows\u4E0A\u7684Windows\u65F6\u95F4\u670D\u52A1\u6216macOS\u4E0A\u7684systemsetup\u3002\u5728\u4F01\u4E1A\u7F51\u7EDC\u4E2D\uFF0C\u8FD9\u4E9B\u65F6\u95F4\u8BBE\u7F6E\u4E5F\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E0E\u670D\u52A1\u4E4B\u95F4\u540C\u6B65\uFF0C\u901A\u5E38\u901A\u8FC7\u57DF\u5185\u7684\u7F51\u7EDC\u65F6\u95F4\u670D\u52A1\u5668\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1124\/"},{"id":"T1125","name":"\u89C6\u9891\u6355\u83B7","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u8BA1\u7B97\u673A\u7684\u5916\u56F4\u8BBE\u5907\uFF08\u5982\u5185\u7F6E\u6444\u50CF\u5934\u6216\u7F51\u7EDC\u6444\u50CF\u5934\uFF09\u6216\u5E94\u7528\u7A0B\u5E8F\uFF08\u5982\u89C6\u9891\u901A\u8BDD\u670D\u52A1\uFF09\u6765\u5F55\u5236\u89C6\u9891\uFF0C\u4EE5\u6536\u96C6\u4FE1\u606F\u3002\u6B64\u5916\uFF0C\u4E5F\u53EF\u80FD\u4ECE\u8BBE\u5907\u6216\u5E94\u7528\u7A0B\u5E8F\u4E2D\u6355\u83B7\u56FE\u50CF\uFF0C\u8FD9\u4E9B\u56FE\u50CF\u53EF\u80FD\u4EE5\u7279\u5B9A\u95F4\u9694\u62CD\u6444\uFF0C\u4EE5\u66FF\u4EE3\u89C6\u9891\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1125\/"},{"id":"T1127.001","name":"MSBuild","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528MSBuild\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684Windows\u5B9E\u7528\u7A0B\u5E8F\u4EE3\u7406\u6267\u884C\u4EE3\u7801\u3002MSBuild.exe\uFF08Microsoft\u751F\u6210\u5F15\u64CE\uFF09\u662FVisual Studio\u4F7F\u7528\u7684\u8F6F\u4EF6\u751F\u6210\u5E73\u53F0\uFF0C\u5B83\u5904\u7406XML\u683C\u5F0F\u7684\u9879\u76EE\u6587\u4EF6\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u5B9A\u4E49\u4E86\u52A0\u8F7D\u548C\u6784\u5EFA\u5404\u79CD\u5E73\u53F0\u53CA\u914D\u7F6E\u7684\u8981\u6C42\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1127\/001\/"},{"id":"T1127.002","name":"\u5355\u51FB\u4E00\u6B21","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528ClickOnce\u5E94\u7528\u7A0B\u5E8F\uFF08.appref-ms\u548C.application\u6587\u4EF6\uFF09\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684Windows\u5B9E\u7528\u7A0B\u5E8F\u4EE3\u7406\u6267\u884C\u4EE3\u7801\u3002ClickOnce\u662F\u4E00\u79CD\u90E8\u7F72\u6280\u672F\uFF0C\u5141\u8BB8\u7528\u6237\u521B\u5EFA\u81EA\u66F4\u65B0\u7684\u57FA\u4E8EWindows\u7684.NET\u5E94\u7528\u7A0B\u5E8F\uFF08\u5982.XBAP\u3001.EXE\u6216.DLL\uFF09\uFF0C\u8FD9\u4E9B\u5E94\u7528\u7A0B\u5E8F\u53EF\u4ECE\u6587\u4EF6\u5171\u4EAB\u6216\u7F51\u9875\u4EE5\u6700\u5C11\u7684\u7528\u6237\u4EA4\u4E92\u8FDB\u884C\u5B89\u88C5\u548C\u8FD0\u884C\u3002\u8BE5\u5E94\u7528\u7A0B\u5E8F\u4F5C\u4E3ADFSVC.EXE\u7684\u5B50\u8FDB\u7A0B\u542F\u52A8\uFF0CDFSVC.EXE\u8D1F\u8D23\u5B89\u88C5\u3001\u542F\u52A8\u548C\u66F4\u65B0\u5E94\u7528\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1127\/002\/"},{"id":"T1127.003","name":"JamPlus","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528JamPlus\u4F5C\u4E3A\u4EE3\u7406\u6765\u6267\u884C\u6076\u610F\u811A\u672C\u3002JamPlus\u662F\u4E00\u6B3E\u7528\u4E8E\u4EE3\u7801\u548C\u6570\u636E\u6784\u5EFA\u7CFB\u7EDF\u7684\u7F16\u8BD1\u8F85\u52A9\u5DE5\u5177\uFF0C\u5B83\u517C\u5BB9\u591A\u79CD\u4E3B\u6D41\u7F16\u8BD1\u5668\uFF0C\u5E76\u53EF\u7528\u4E8E\u5728Visual Studio\u7B49\u4EE3\u7801\u7F16\u8F91\u5668\u4E2D\u751F\u6210\u5DE5\u4F5C\u7A7A\u95F4\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1127\/003\/"},{"id":"T1127","name":"\u53D7\u4FE1\u4EFB\u7684\u5F00\u53D1\u8005\u5B9E\u7528\u7A0B\u5E8F\u4EE3\u7406\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u53D7\u4FE1\u4EFB\u7684\u5F00\u53D1\u5DE5\u5177\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u8F7D\u8377\u3002\u8BB8\u591A\u7528\u4E8E\u8F6F\u4EF6\u5F00\u53D1\u76F8\u5173\u4EFB\u52A1\u7684\u5B9E\u7528\u7A0B\u5E8F\u53EF\u4EE5\u6267\u884C\u5404\u79CD\u5F62\u5F0F\u7684\u4EE3\u7801\uFF0C\u4EE5\u534F\u52A9\u5F00\u53D1\u3001\u8C03\u8BD5\u548C\u9006\u5411\u5DE5\u7A0B\u3002\u8FD9\u4E9B\u5DE5\u5177\u901A\u5E38\u4F7F\u7528\u5408\u6CD5\u8BC1\u4E66\u7B7E\u540D\uFF0C\u4F7F\u5176\u80FD\u591F\u5728\u7CFB\u7EDF\u4E0A\u6267\u884C\uFF0C\u5E76\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684\u8FDB\u7A0B\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\uFF0C\u4ECE\u800C\u6709\u6548\u7ED5\u8FC7\u5E94\u7528\u7A0B\u5E8F\u63A7\u5236\u89E3\u51B3\u65B9\u6848\u3002","sub-techniques":"T1127.001, T1127.002, T1127.003","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1127\/"},{"id":"T1129","name":"\u5171\u4EAB\u6A21\u5757","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52A0\u8F7D\u5171\u4EAB\u6A21\u5757\u6765\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u3002\u5171\u4EAB\u6A21\u5757\u662F\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u88AB\u52A0\u8F7D\u5230\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u63D0\u4F9B\u5BF9\u53EF\u91CD\u7528\u4EE3\u7801\u7684\u8BBF\u95EE\uFF0C\u4F8B\u5982\u7279\u5B9A\u7684\u81EA\u5B9A\u4E49\u51FD\u6570\u6216\u8C03\u7528\u64CD\u4F5C\u7CFB\u7EDFAPI\u51FD\u6570\uFF08\u5373\u539F\u751FAPI\uFF09\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1129\/"},{"id":"T1132.001","name":"\u6807\u51C6\u7F16\u7801","description":"\u5BF9\u624B\u53EF\u80FD\u4F7F\u7528\u6807\u51C6\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u5BF9\u6570\u636E\u8FDB\u884C\u7F16\u7801\uFF0C\u4EE5\u4F7F\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u7684\u5185\u5BB9\u66F4\u96BE\u4EE5\u88AB\u68C0\u6D4B\u3002\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u4FE1\u606F\u53EF\u4EE5\u901A\u8FC7\u9075\u5FAA\u73B0\u6709\u534F\u8BAE\u89C4\u8303\u7684\u6807\u51C6\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u8FDB\u884C\u7F16\u7801\u3002\u5E38\u89C1\u7684\u6570\u636E\u7F16\u7801\u65B9\u6848\u5305\u62ECASCII\u3001Unicode\u3001\u5341\u516D\u8FDB\u5236\u3001Base64\u548CMIME\u3002\u67D0\u4E9B\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u8FD8\u53EF\u80FD\u5B9E\u73B0\u6570\u636E\u538B\u7F29\uFF0C\u4F8B\u5982gzip\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1132\/001\/"},{"id":"T1132.002","name":"\u975E\u6807\u51C6\u7F16\u7801","description":"\u653B\u51FB\u8005\u53EF\u80FD\u91C7\u7528\u975E\u6807\u51C6\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u5BF9\u6570\u636E\u8FDB\u884C\u7F16\u7801\uFF0C\u4EE5\u4F7F\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u7684\u5185\u5BB9\u66F4\u96BE\u4EE5\u88AB\u68C0\u6D4B\u3002\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u4FE1\u606F\u53EF\u4EE5\u901A\u8FC7\u4F7F\u7528\u504F\u79BB\u73B0\u6709\u534F\u8BAE\u89C4\u8303\u7684\u975E\u6807\u51C6\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u8FDB\u884C\u7F16\u7801\u3002\u8FD9\u4E9B\u975E\u6807\u51C6\u6570\u636E\u7F16\u7801\u65B9\u6848\u53EF\u80FD\u57FA\u4E8E\u6216\u4E0E\u6807\u51C6\u6570\u636E\u7F16\u7801\u65B9\u6848\u76F8\u5173\uFF0C\u4F8B\u5982\u5BF9HTTP\u8BF7\u6C42\u6D88\u606F\u4F53\u91C7\u7528\u4FEE\u6539\u8FC7\u7684Base64\u7F16\u7801\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1132\/002\/"},{"id":"T1132","name":"\u6570\u636E\u7F16\u7801","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5BF9\u6570\u636E\u8FDB\u884C\u7F16\u7801\uFF0C\u4EE5\u4F7F\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u7684\u5185\u5BB9\u66F4\u96BE\u4EE5\u88AB\u68C0\u6D4B\u3002\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08C2\uFF09\u4FE1\u606F\u53EF\u4EE5\u5229\u7528\u6807\u51C6\u7684\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u8FDB\u884C\u7F16\u7801\u3002\u6570\u636E\u7F16\u7801\u7684\u4F7F\u7528\u53EF\u80FD\u9075\u5FAA\u73B0\u6709\u7684\u534F\u8BAE\u89C4\u8303\uFF0C\u5305\u62EC\u4F7F\u7528ASCII\u3001Unicode\u3001Base64\u3001MIME\u6216\u5176\u4ED6\u4E8C\u8FDB\u5236\u5230\u6587\u672C\u53CA\u5B57\u7B26\u7F16\u7801\u7CFB\u7EDF\u3002\u67D0\u4E9B\u6570\u636E\u7F16\u7801\u7CFB\u7EDF\u8FD8\u53EF\u80FD\u5B9E\u73B0\u6570\u636E\u538B\u7F29\uFF0C\u4F8B\u5982gzip\u3002","sub-techniques":"T1132.001, T1132.002","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1132\/"},{"id":"T1133","name":"\u5916\u90E8\u8FDC\u7A0B\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u9762\u5411\u5916\u90E8\u7684\u8FDC\u7A0B\u670D\u52A1\u6765\u521D\u59CB\u8BBF\u95EE\u7F51\u7EDC\u548C\/\u6216\u5728\u7F51\u7EDC\u4E2D\u6301\u4E45\u5316\u3002\u8BF8\u5982VPN\u3001Citrix\u53CA\u5176\u4ED6\u63A5\u5165\u673A\u5236\u7B49\u8FDC\u7A0B\u670D\u52A1\uFF0C\u5141\u8BB8\u7528\u6237\u4ECE\u5916\u90E8\u4F4D\u7F6E\u8FDE\u63A5\u5230\u4F01\u4E1A\u5185\u90E8\u7F51\u7EDC\u8D44\u6E90\u3002\u901A\u5E38\u5B58\u5728\u8FDC\u7A0B\u670D\u52A1\u7F51\u5173\u6765\u7BA1\u7406\u8FD9\u4E9B\u670D\u52A1\u7684\u8FDE\u63A5\u548C\u51ED\u8BC1\u8BA4\u8BC1\u3002\u8BF8\u5982Windows\u8FDC\u7A0B\u7BA1\u7406\u548CVNC\u7B49\u670D\u52A1\u4E5F\u53EF\u5728\u5916\u90E8\u4F7F\u7528\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u575A\u6301","platforms":"\u5BB9\u5668,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1133\/"},{"id":"T1134.001","name":"\u4EE4\u724C\u6A21\u62DF\/\u7A83\u53D6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u590D\u5236\u5E76\u5192\u5145\u5176\u4ED6\u7528\u6237\u7684\u73B0\u6709\u4EE4\u724C\uFF0C\u4EE5\u63D0\u5347\u6743\u9650\u5E76\u7ED5\u8FC7\u8BBF\u95EE\u63A7\u5236\u3002\u4F8B\u5982\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u4F7F\u7528DuplicateToken\u6216DuplicateTokenEx\u590D\u5236\u73B0\u6709\u4EE4\u724C\u3002\u968F\u540E\uFF0C\u8BE5\u4EE4\u724C\u53EF\u4E0EImpersonateLoggedOnUser\u7ED3\u5408\u4F7F\u7528\uFF0C\u4F7F\u8C03\u7528\u7EBF\u7A0B\u80FD\u591F\u6A21\u62DF\u5DF2\u767B\u5F55\u7528\u6237\u7684\u5B89\u5168\u4E0A\u4E0B\u6587\uFF0C\u6216\u4E0ESetThreadToken\u914D\u5408\uFF0C\u5C06\u6A21\u62DF\u4EE4\u724C\u5206\u914D\u7ED9\u7EBF\u7A0B\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/001\/"},{"id":"T1134.002","name":"\u4F7F\u7528\u4EE4\u724C\u521B\u5EFA\u8FDB\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4F7F\u7528\u73B0\u6709\u4EE4\u724C\u521B\u5EFA\u65B0\u8FDB\u7A0B\u6765\u63D0\u5347\u6743\u9650\u5E76\u7ED5\u8FC7\u8BBF\u95EE\u63A7\u5236\u3002\u5229\u7528\u8BF8\u5982CreateProcessWithTokenW\u548Crunas\u7B49\u529F\u80FD\uFF0C\u53EF\u4EE5\u4EE5\u5176\u4ED6\u7528\u6237\u7684\u4EE4\u724C\u53CA\u7531\u6B64\u4EA7\u751F\u7684\u5B89\u5168\u4E0A\u4E0B\u6587\u6765\u521B\u5EFA\u8FDB\u7A0B\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/002\/"},{"id":"T1134.003","name":"\u521B\u5EFA\u5E76\u6A21\u62DF\u4EE4\u724C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u65B0\u7684\u4EE4\u724C\u5E76\u5192\u5145\u7528\u6237\uFF0C\u4EE5\u63D0\u5347\u6743\u9650\u5E76\u7ED5\u8FC7\u8BBF\u95EE\u63A7\u5236\u3002\u4F8B\u5982\uFF0C\u82E5\u653B\u51FB\u8005\u638C\u63E1\u4E86\u7528\u6237\u540D\u548C\u5BC6\u7801\uFF0C\u4F46\u8BE5\u7528\u6237\u5E76\u672A\u767B\u5F55\u7CFB\u7EDF\uFF0C\u653B\u51FB\u8005\u4FBF\u53EF\u5229\u7528LogonUser\u51FD\u6570\u4E3A\u8BE5\u7528\u6237\u521B\u5EFA\u4E00\u4E2A\u767B\u5F55\u4F1A\u8BDD\u3002\u8BE5\u51FD\u6570\u5C06\u8FD4\u56DE\u65B0\u4F1A\u8BDD\u8BBF\u95EE\u4EE4\u724C\u7684\u526F\u672C\uFF0C\u653B\u51FB\u8005\u968F\u540E\u53EF\u4F7F\u7528SetThreadToken\u5C06\u6B64\u4EE4\u724C\u5206\u914D\u7ED9\u7EBF\u7A0B\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/003\/"},{"id":"T1134.004","name":"\u7236\u8FDB\u7A0BID\u6B3A\u9A97","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F2A\u9020\u65B0\u8FDB\u7A0B\u7684\u7236\u8FDB\u7A0B\u6807\u8BC6\u7B26\uFF08PPID\uFF09\uFF0C\u4EE5\u89C4\u907F\u8FDB\u7A0B\u76D1\u63A7\u9632\u5FA1\u63AA\u65BD\u6216\u63D0\u5347\u6743\u9650\u3002\u65B0\u8FDB\u7A0B\u901A\u5E38\u76F4\u63A5\u7531\u5176\u7236\u8FDB\u7A0B\u6216\u8C03\u7528\u8FDB\u7A0B\u751F\u6210\uFF0C\u9664\u975E\u6709\u660E\u786E\u6307\u5B9A\u3002\u660E\u786E\u5206\u914D\u65B0\u8FDB\u7A0BPPID\u7684\u4E00\u79CD\u65B9\u5F0F\u662F\u901A\u8FC7CreateProcess API\u8C03\u7528\uFF0C\u8BE5\u8C03\u7528\u652F\u6301\u4E00\u4E2A\u5B9A\u4E49\u8981\u4F7F\u7528\u7684PPID\u7684\u53C2\u6570\u3002Windows\u529F\u80FD\uFF08\u5982\u7528\u6237\u8D26\u6237\u63A7\u5236\uFF08UAC\uFF09\uFF09\u5229\u7528\u6B64\u529F\u80FD\uFF0C\u5728\u8BF7\u6C42\u7684\u63D0\u5347\u6743\u9650\u8FDB\u7A0B\u7531SYSTEM\uFF08\u901A\u5E38\u901A\u8FC7svchost.exe\u6216consent.exe\uFF09\u751F\u6210\u540E\uFF0C\u6B63\u786E\u8BBE\u7F6EPPID\uFF0C\u800C\u4E0D\u662F\u5F53\u524D\u7528\u6237\u4E0A\u4E0B\u6587\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/004\/"},{"id":"T1134.005","name":"SID\u5386\u53F2\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528SID\u5386\u53F2\u6CE8\u5165\u6280\u672F\u6765\u63D0\u5347\u6743\u9650\u5E76\u7ED5\u8FC7\u8BBF\u95EE\u63A7\u5236\u3002Windows\u5B89\u5168\u6807\u8BC6\u7B26\uFF08SID\uFF09\u662F\u7528\u4E8E\u552F\u4E00\u8BC6\u522B\u7528\u6237\u6216\u7EC4\u8D26\u6237\u7684\u6570\u503C\uFF0C\u5728\u5B89\u5168\u63CF\u8FF0\u7B26\u548C\u8BBF\u95EE\u4EE4\u724C\u4E2D\u5747\u88ABWindows\u5B89\u5168\u7CFB\u7EDF\u6240\u4F7F\u7528\u3002\u8D26\u6237\u53EF\u5728SID\u5386\u53F2Active Directory\u5C5E\u6027\u4E2D\u6301\u6709\u989D\u5916\u7684SID\uFF0C\u4ECE\u800C\u5B9E\u73B0\u8DE8\u57DF\u7684\u53EF\u4E92\u64CD\u4F5C\u8D26\u6237\u8FC1\u79FB\uFF08\u4F8B\u5982\uFF0C\u8BBF\u95EE\u4EE4\u724C\u4F1A\u5305\u542BSID\u5386\u53F2\u4E2D\u7684\u6240\u6709\u503C\uFF09\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/005\/"},{"id":"T1134","name":"\u8BBF\u95EE\u4EE4\u724C\u64CD\u7EB5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u8BBF\u95EE\u4EE4\u724C\uFF0C\u4EE5\u4FBF\u5728\u4E0D\u540C\u7684\u7528\u6237\u6216\u7CFB\u7EDF\u5B89\u5168\u4E0A\u4E0B\u6587\u4E2D\u64CD\u4F5C\uFF0C\u4ECE\u800C\u6267\u884C\u64CD\u4F5C\u5E76\u7ED5\u8FC7\u8BBF\u95EE\u63A7\u5236\u3002Windows\u7CFB\u7EDF\u5229\u7528\u8BBF\u95EE\u4EE4\u724C\u6765\u786E\u5B9A\u8FD0\u884C\u8FDB\u7A0B\u7684\u6240\u6709\u6743\u3002\u7528\u6237\u53EF\u901A\u8FC7\u64CD\u7EB5\u8BBF\u95EE\u4EE4\u724C\uFF0C\u4F7F\u6B63\u5728\u8FD0\u884C\u7684\u8FDB\u7A0B\u770B\u4F3C\u662F\u53E6\u4E00\u8FDB\u7A0B\u7684\u5B50\u8FDB\u7A0B\uFF0C\u6216\u5C5E\u4E8E\u975E\u542F\u52A8\u8BE5\u8FDB\u7A0B\u7684\u7528\u6237\u3002\u4E00\u65E6\u53D1\u751F\u8FD9\u79CD\u60C5\u51B5\uFF0C\u8BE5\u8FDB\u7A0B\u8FD8\u5C06\u7EE7\u627F\u4E0E\u65B0\u4EE4\u724C\u76F8\u5173\u8054\u7684\u5B89\u5168\u4E0A\u4E0B\u6587\u3002","sub-techniques":"T1134.001, T1134.002, T1134.003, T1134.004, T1134.005","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1134\/"},{"id":"T1135","name":"\u7F51\u7EDC\u5171\u4EAB\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5BFB\u627E\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u5171\u4EAB\u7684\u6587\u4EF6\u5939\u548C\u9A71\u52A8\u5668\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u8BC6\u522B\u4FE1\u606F\u6536\u96C6\u6765\u6E90\u7684\u624B\u6BB5\uFF0C\u4E3A\u540E\u7EED\u7684\u6570\u636E\u6536\u96C6\u505A\u51C6\u5907\uFF0C\u5E76\u8BC6\u522B\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u7684\u76EE\u6807\u7CFB\u7EDF\u3002\u7F51\u7EDC\u73AF\u5883\u4E2D\u901A\u5E38\u5305\u542B\u5171\u4EAB\u7684\u7F51\u7EDC\u9A71\u52A8\u5668\u548C\u6587\u4EF6\u5939\uFF0C\u8FD9\u4E9B\u5171\u4EAB\u8D44\u6E90\u5141\u8BB8\u7528\u6237\u8BBF\u95EE\u7F51\u7EDC\u4E2D\u4E0D\u540C\u7CFB\u7EDF\u4E0A\u7684\u6587\u4EF6\u76EE\u5F55\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1135\/"},{"id":"T1136.001","name":"\u672C\u5730\u8D26\u6237","description":"\u5BF9\u624B\u53EF\u80FD\u521B\u5EFA\u672C\u5730\u8D26\u6237\u4EE5\u7EF4\u6301\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u3002\u672C\u5730\u8D26\u6237\u662F\u7531\u7EC4\u7EC7\u914D\u7F6E\uFF0C\u4F9B\u7528\u6237\u3001\u8FDC\u7A0B\u652F\u6301\u3001\u670D\u52A1\u6216\u5728\u5355\u4E2A\u7CFB\u7EDF\u6216\u670D\u52A1\u4E0A\u8FDB\u884C\u7BA1\u7406\u4F7F\u7528\u7684\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u5BB9\u5668,ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1136\/001\/"},{"id":"T1136.002","name":"\u57DF\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u57DF\u8D26\u6237\u4EE5\u7EF4\u6301\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u57DF\u8D26\u6237\u7531Active Directory\u57DF\u670D\u52A1\u7BA1\u7406\uFF0C\u5176\u8BBF\u95EE\u6743\u9650\u548C\u914D\u7F6E\u9002\u7528\u4E8E\u8BE5\u57DF\u5185\u7684\u6240\u6709\u7CFB\u7EDF\u548C\u670D\u52A1\u3002\u57DF\u8D26\u6237\u53EF\u6DB5\u76D6\u7528\u6237\u3001\u7BA1\u7406\u5458\u53CA\u670D\u52A1\u8D26\u6237\u3002\u5728\u5177\u5907\u8DB3\u591F\u8BBF\u95EE\u6743\u9650\u7684\u60C5\u51B5\u4E0B\uFF0C\u53EF\u4F7F\u7528net user \/add \/domain\u547D\u4EE4\u6765\u521B\u5EFA\u57DF\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1136\/002\/"},{"id":"T1136.003","name":"\u4E91\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u4E91\u8D26\u6237\u4EE5\u7EF4\u6301\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u3002\u4E00\u65E6\u83B7\u5F97\u8DB3\u591F\u6743\u9650\uFF0C\u6B64\u7C7B\u8D26\u6237\u53EF\u7528\u4E8E\u5EFA\u7ACB\u4E8C\u6B21\u51ED\u8BC1\u8BBF\u95EE\uFF0C\u4ECE\u800C\u65E0\u9700\u5728\u7CFB\u7EDF\u4E0A\u90E8\u7F72\u6301\u4E45\u7684\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1136\/003\/"},{"id":"T1136","name":"\u521B\u5EFA\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u8D26\u6237\u4EE5\u7EF4\u6301\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u4E00\u65E6\u83B7\u5F97\u8DB3\u591F\u6743\u9650\uFF0C\u521B\u5EFA\u6B64\u7C7B\u8D26\u6237\u53EF\u7528\u4E8E\u5EFA\u7ACB\u6B21\u7EA7\u51ED\u8BC1\u8BBF\u95EE\uFF0C\u4ECE\u800C\u65E0\u9700\u5728\u7CFB\u7EDF\u4E0A\u90E8\u7F72\u6301\u4E45\u7684\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u3002","sub-techniques":"T1136.001, T1136.002, T1136.003","tactic":"\u575A\u6301","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1136\/"},{"id":"T1137.001","name":"Office \u6A21\u677F\u5B8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Office\u6A21\u677F\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u83B7\u53D6\u6301\u4E45\u6027\u3002Microsoft Office\u5305\u542B\u4F5C\u4E3A\u5E38\u89C1Office\u5E94\u7528\u7A0B\u5E8F\u4E00\u90E8\u5206\u7684\u6A21\u677F\uFF0C\u7528\u4E8E\u81EA\u5B9A\u4E49\u6837\u5F0F\u3002\u6BCF\u6B21\u5E94\u7528\u7A0B\u5E8F\u542F\u52A8\u65F6\uFF0C\u90FD\u4F1A\u4F7F\u7528\u8FD9\u4E9B\u57FA\u7840\u6A21\u677F\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/001\/"},{"id":"T1137.002","name":"\u529E\u516C\u5BA4\u6D4B\u8BD5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Office\u7684\"Office Test\"\u6CE8\u518C\u8868\u9879\uFF0C\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u5B9E\u73B0\u6301\u4E45\u5316\u3002\u5B58\u5728\u4E00\u4E2AOffice Test\u6CE8\u518C\u8868\u4F4D\u7F6E\uFF0C\u5141\u8BB8\u7528\u6237\u6307\u5B9A\u4EFB\u610FDLL\uFF0C\u8BE5DLL\u5C06\u5728\u6BCF\u6B21\u542F\u52A8Office\u5E94\u7528\u7A0B\u5E8F\u65F6\u6267\u884C\u3002\u8BE5\u6CE8\u518C\u8868\u9879\u88AB\u8BA4\u4E3A\u662F\u5FAE\u8F6F\u5728\u5F00\u53D1Office\u5E94\u7528\u7A0B\u5E8F\u65F6\uFF0C\u7528\u4E8E\u52A0\u8F7D\u6D4B\u8BD5\u548C\u8C03\u8BD5\u76EE\u7684DLL\u800C\u8BBE\u7F6E\u7684\u3002\u6B64\u6CE8\u518C\u8868\u9879\u5728Office\u5B89\u88C5\u8FC7\u7A0B\u4E2D\u9ED8\u8BA4\u4E0D\u4F1A\u521B\u5EFA\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/002\/"},{"id":"T1137.003","name":"Outlook \u8868\u5355","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Outlook\u8868\u5355\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u83B7\u53D6\u6301\u4E45\u6027\u3002Outlook\u8868\u5355\u7528\u4F5COutlook\u90AE\u4EF6\u4E2D\u5448\u73B0\u548C\u529F\u80FD\u7684\u6A21\u677F\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u521B\u5EFA\u81EA\u5B9A\u4E49Outlook\u8868\u5355\uFF0C\u5F53\u5229\u7528\u76F8\u540C\u81EA\u5B9A\u4E49\u8868\u5355\u53D1\u9001\u7279\u5236\u90AE\u4EF6\u65F6\uFF0C\u8FD9\u4E9B\u8868\u5355\u4F1A\u6267\u884C\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/003\/"},{"id":"T1137.004","name":"Outlook \u4E3B\u9875","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Outlook\u7684\u201C\u4E3B\u9875\u201D\u529F\u80FD\uFF0C\u4EE5\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u83B7\u53D6\u6301\u4E45\u6027\u3002Outlook\u4E3B\u9875\u662F\u4E00\u9879\u7528\u4E8E\u81EA\u5B9A\u4E49Outlook\u6587\u4EF6\u5939\u5C55\u793A\u65B9\u5F0F\u7684\u65E7\u6709\u529F\u80FD\u3002\u8BE5\u529F\u80FD\u5141\u8BB8\u5728\u6253\u5F00\u6587\u4EF6\u5939\u65F6\u52A0\u8F7D\u5E76\u663E\u793A\u5185\u90E8\u6216\u5916\u90E8URL\u3002\u653B\u51FB\u8005\u53EF\u5236\u4F5C\u6076\u610FHTML\u9875\u9762\uFF0C\u5F53Outlook\u4E3B\u9875\u52A0\u8F7D\u8BE5\u9875\u9762\u65F6\uFF0C\u4FBF\u4F1A\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/004\/"},{"id":"T1137.005","name":"Outlook \u89C4\u5219","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Outlook\u89C4\u5219\uFF0C\u4EE5\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u5B9E\u73B0\u6301\u4E45\u5316\u3002Outlook\u89C4\u5219\u5141\u8BB8\u7528\u6237\u5B9A\u4E49\u81EA\u52A8\u5316\u884C\u4E3A\u6765\u7BA1\u7406\u7535\u5B50\u90AE\u4EF6\u3002\u4F8B\u5982\uFF0C\u4E00\u4E2A\u826F\u6027\u89C4\u5219\u53EF\u80FD\u4F1A\u5728\u6536\u5230\u7279\u5B9A\u53D1\u4EF6\u4EBA\u5305\u542B\u7279\u5B9A\u8BCD\u8BED\u7684\u90AE\u4EF6\u65F6\uFF0C\u81EA\u52A8\u5C06\u5176\u79FB\u52A8\u5230Outlook\u7684\u7279\u5B9A\u6587\u4EF6\u5939\u4E2D\u3002\u800C\u6076\u610FOutlook\u89C4\u5219\u5219\u53EF\u5728\u653B\u51FB\u8005\u5411\u8BE5\u7528\u6237\u53D1\u9001\u7CBE\u5FC3\u6784\u9020\u7684\u90AE\u4EF6\u65F6\u89E6\u53D1\u4EE3\u7801\u6267\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/005\/"},{"id":"T1137.006","name":"\u52A0\u8F7D\u9879","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Microsoft Office\u52A0\u8F7D\u9879\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u83B7\u53D6\u6301\u4E45\u6027\u3002Office\u52A0\u8F7D\u9879\u53EF\u7528\u4E8E\u589E\u5F3AOffice\u7A0B\u5E8F\u7684\u529F\u80FD\u3002\u5404\u7C7BOffice\u4EA7\u54C1\u53EF\u4F7F\u7528\u4E0D\u540C\u7C7B\u578B\u7684\u52A0\u8F7D\u9879\uFF0C\u5305\u62ECWord\/Excel\u52A0\u8F7D\u9879\u5E93\uFF08WLL\/XLL\uFF09\u3001VBA\u52A0\u8F7D\u9879\u3001Office\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08COM\uFF09\u52A0\u8F7D\u9879\u3001\u81EA\u52A8\u5316\u52A0\u8F7D\u9879\u3001VBA\u7F16\u8F91\u5668\uFF08VBE\uFF09\u3001Visual Studio Tools for Office\uFF08VSTO\uFF09\u52A0\u8F7D\u9879\u4EE5\u53CAOutlook\u52A0\u8F7D\u9879\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/006\/"},{"id":"T1137","name":"\u529E\u516C\u5E94\u7528\u542F\u52A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u57FA\u4E8EMicrosoft Office\u7684\u5E94\u7528\u7A0B\u5E8F\u5728\u7CFB\u7EDF\u542F\u52A8\u4E4B\u95F4\u5B9E\u73B0\u6301\u4E45\u5316\u3002Microsoft Office\u662F\u4F01\u4E1A\u7F51\u7EDC\u4E2D\u57FA\u4E8EWindows\u64CD\u4F5C\u7CFB\u7EDF\u4E0A\u76F8\u5F53\u5E38\u89C1\u7684\u5E94\u7528\u5957\u4EF6\u3002\u5F53\u57FA\u4E8EOffice\u7684\u5E94\u7528\u7A0B\u5E8F\u542F\u52A8\u65F6\uFF0C\u5B58\u5728\u591A\u79CD\u53EF\u5229\u7528Office\u5B9E\u73B0\u6301\u4E45\u5316\u7684\u673A\u5236\uFF1B\u8FD9\u53EF\u80FD\u5305\u62EC\u4F7F\u7528Office\u6A21\u677F\u5B8F\u548C\u52A0\u8F7D\u9879\u3002","sub-techniques":"T1137.001, T1137.002, T1137.003, T1137.004, T1137.005, T1137.006","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1137\/"},{"id":"T1140","name":"\u53CD\u6DF7\u6DC6\/\u89E3\u7801\u6587\u4EF6\u6216\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u6DF7\u6DC6\u7684\u6587\u4EF6\u6216\u4FE1\u606F\u6765\u9690\u85CF\u5165\u4FB5\u75D5\u8FF9\uFF0C\u4EE5\u907F\u514D\u88AB\u5206\u6790\u53D1\u73B0\u3002\u6839\u636E\u5176\u4F7F\u7528\u610F\u56FE\uFF0C\u4ED6\u4EEC\u53EF\u80FD\u9700\u8981\u5355\u72EC\u7684\u673A\u5236\u6765\u89E3\u7801\u6216\u89E3\u6DF7\u6DC6\u8FD9\u4E9B\u4FE1\u606F\u3002\u5B9E\u73B0\u8FD9\u4E00\u76EE\u7684\u7684\u65B9\u6CD5\u5305\u62EC\u5229\u7528\u6076\u610F\u8F6F\u4EF6\u7684\u5185\u7F6E\u529F\u80FD\uFF0C\u6216\u4F7F\u7528\u7CFB\u7EDF\u4E2D\u5DF2\u6709\u7684\u5B9E\u7528\u5DE5\u5177\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1140\/"},{"id":"T1176.001","name":"\u6D4F\u89C8\u5668\u6269\u5C55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u4E92\u8054\u7F51\u6D4F\u89C8\u5668\u6269\u5C55\u7A0B\u5E8F\u6765\u5EFA\u7ACB\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u6D4F\u89C8\u5668\u6269\u5C55\u6216\u63D2\u4EF6\u662F\u4E00\u79CD\u5C0F\u578B\u7A0B\u5E8F\uFF0C\u80FD\u591F\u4E3A\u4E92\u8054\u7F51\u6D4F\u89C8\u5668\u589E\u52A0\u529F\u80FD\u5E76\u5B9A\u5236\u5176\u5404\u4E2A\u65B9\u9762\u3002\u5B83\u4EEC\u53EF\u4EE5\u901A\u8FC7\u672C\u5730\u6587\u4EF6\u3001\u81EA\u5B9A\u4E49URL\u6216\u6D4F\u89C8\u5668\u7684\u5E94\u7528\u5546\u5E97\u76F4\u63A5\u5B89\u88C5\u2014\u2014\u5E94\u7528\u5546\u5E97\u662F\u4E00\u4E2A\u5B98\u65B9\u5728\u7EBF\u5E73\u53F0\uFF0C\u7528\u6237\u53EF\u4EE5\u5728\u5176\u4E2D\u6D4F\u89C8\u3001\u5B89\u88C5\u548C\u7BA1\u7406\u7279\u5B9A\u7F51\u9875\u6D4F\u89C8\u5668\u7684\u6269\u5C55\u7A0B\u5E8F\u3002\u6269\u5C55\u7A0B\u5E8F\u901A\u5E38\u7EE7\u627F\u5148\u524D\u6388\u4E88\u7F51\u9875\u6D4F\u89C8\u5668\u7684\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1176\/001\/"},{"id":"T1176.002","name":"IDE\u6269\u5C55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u96C6\u6210\u5F00\u53D1\u73AF\u5883\uFF08IDE\uFF09\u6269\u5C55\u7A0B\u5E8F\uFF0C\u5728\u53D7\u5BB3\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u6301\u4E45\u6027\u8BBF\u95EE\u3002\u8BF8\u5982Visual Studio Code\u3001IntelliJ IDEA\u548CEclipse\u7B49IDE\u652F\u6301\u6269\u5C55\u2014\u2014\u8FD9\u4E9B\u8F6F\u4EF6\u7EC4\u4EF6\u53EF\u6DFB\u52A0\u4EE3\u7801\u68C0\u67E5\u3001\u81EA\u52A8\u8865\u5168\u3001\u4EFB\u52A1\u81EA\u52A8\u5316\u6216\u4E0EGit\u3001Docker\u7B49\u5DE5\u5177\u96C6\u6210\u7684\u529F\u80FD\u3002\u6076\u610F\u6269\u5C55\u53EF\u901A\u8FC7\u6269\u5C55\u5E02\u573A\uFF08\u5373\u901A\u8FC7\u7834\u574F\u8F6F\u4EF6\u4F9D\u8D56\u9879\u548C\u5F00\u53D1\u5DE5\u5177\uFF09\u5B89\u88C5\uFF0C\u6216\u76F4\u63A5\u65C1\u52A0\u8F7D\u5230IDE\u4E2D\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1176\/002\/"},{"id":"T1176","name":"\u8F6F\u4EF6\u6269\u5C55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8F6F\u4EF6\u6269\u5C55\u7A0B\u5E8F\u5728\u53D7\u5BB3\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u6301\u4E45\u6027\u8BBF\u95EE\u3002\u8F6F\u4EF6\u6269\u5C55\u662F\u6A21\u5757\u5316\u7EC4\u4EF6\uFF0C\u7528\u4E8E\u589E\u5F3A\u6216\u5B9A\u5236\u8F6F\u4EF6\u5E94\u7528\u7684\u529F\u80FD\uFF0C\u5305\u62EC\u7F51\u9875\u6D4F\u89C8\u5668\u3001\u96C6\u6210\u5F00\u53D1\u73AF\u5883\uFF08IDE\uFF09\u53CA\u5176\u4ED6\u5E73\u53F0\u3002\u6269\u5C55\u901A\u5E38\u901A\u8FC7\u5B98\u65B9\u5E02\u573A\u3001\u5E94\u7528\u5546\u5E97\u5B89\u88C5\uFF0C\u6216\u7531\u7528\u6237\u624B\u52A8\u52A0\u8F7D\uFF0C\u5E76\u5E38\u7EE7\u627F\u5BBF\u4E3B\u5E94\u7528\u7684\u6743\u9650\u548C\u8BBF\u95EE\u7EA7\u522B\u3002","sub-techniques":"T1176.001, T1176.002","tactic":"\u575A\u6301","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1176\/"},{"id":"T1185","name":"\u6D4F\u89C8\u5668\u4F1A\u8BDD\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6D4F\u89C8\u5668\u8F6F\u4EF6\u4E2D\u7684\u5B89\u5168\u6F0F\u6D1E\u548C\u56FA\u6709\u529F\u80FD\uFF0C\u4F5C\u4E3A\u591A\u79CD\u6D4F\u89C8\u5668\u4F1A\u8BDD\u52AB\u6301\u6280\u672F\u7684\u4E00\u90E8\u5206\uFF0C\u6765\u7BE1\u6539\u5185\u5BB9\u3001\u6539\u53D8\u7528\u6237\u884C\u4E3A\u5E76\u622A\u53D6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1185\/"},{"id":"T1187","name":"\u5F3A\u5236\u8EAB\u4EFD\u9A8C\u8BC1","description":"\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u8C03\u7528\u6216\u5F3A\u5236\u7528\u6237\u81EA\u52A8\u63D0\u4F9B\u8BA4\u8BC1\u4FE1\u606F\u7684\u673A\u5236\u6765\u6536\u96C6\u51ED\u8BC1\u6750\u6599\uFF0C\u4ECE\u800C\u80FD\u591F\u62E6\u622A\u8FD9\u4E9B\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1187\/"},{"id":"T1189","name":"\u8DEF\u8FC7\u5F0F\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7528\u6237\u6B63\u5E38\u6D4F\u89C8\u7F51\u9875\u7684\u65B9\u5F0F\u8BBF\u95EE\u7CFB\u7EDF\u3002\u5411\u6D4F\u89C8\u5668\u4F20\u9012\u6F0F\u6D1E\u5229\u7528\u4EE3\u7801\u5B58\u5728\u591A\u79CD\u9014\u5F84\uFF08\u4F8B\u5982\uFF0C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u653B\u51FB\uFF09\uFF0C\u5305\u62EC\uFF1A","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1189\/"},{"id":"T1190","name":"\u5229\u7528\u9762\u5411\u516C\u4F17\u7684\u5E94\u7528\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5229\u7528\u9762\u5411\u4E92\u8054\u7F51\u7684\u4E3B\u673A\u6216\u7CFB\u7EDF\u4E2D\u7684\u5F31\u70B9\u6765\u521D\u6B65\u8BBF\u95EE\u7F51\u7EDC\u3002\u7CFB\u7EDF\u4E2D\u7684\u5F31\u70B9\u53EF\u80FD\u662F\u8F6F\u4EF6\u6F0F\u6D1E\u3001\u4E34\u65F6\u6545\u969C\u6216\u914D\u7F6E\u9519\u8BEF\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1190\/"},{"id":"T1195.001","name":"\u8F6F\u4EF6\u4F9D\u8D56\u9879\u4E0E\u5F00\u53D1\u5DE5\u5177\u59A5\u534F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u8F6F\u4EF6\u4F9D\u8D56\u9879\u548C\u5F00\u53D1\u5DE5\u5177\u5230\u8FBE\u6700\u7EC8\u7528\u6237\u4E4B\u524D\u5BF9\u5176\u8FDB\u884C\u7BE1\u6539\uFF0C\u76EE\u7684\u662F\u7834\u574F\u6570\u636E\u6216\u7CFB\u7EDF\u3002\u5E94\u7528\u7A0B\u5E8F\u901A\u5E38\u4F9D\u8D56\u5916\u90E8\u8F6F\u4EF6\u624D\u80FD\u6B63\u5E38\u8FD0\u884C\u3002\u8BB8\u591A\u5E94\u7528\u7A0B\u5E8F\u4E2D\u4F7F\u7528\u7684\u6D41\u884C\u5F00\u6E90\u9879\u76EE\uFF0C\u5982pip\u548CNPM\u5305\uFF0C\u53EF\u80FD\u6210\u4E3A\u653B\u51FB\u76EE\u6807\uFF0C\u4EE5\u6B64\u5411\u4F9D\u8D56\u9879\u7684\u7528\u6237\u6DFB\u52A0\u6076\u610F\u4EE3\u7801\u3002\u8FD9\u4E5F\u53EF\u80FD\u5305\u62EC\u88AB\u9057\u5F03\u7684\u8F6F\u4EF6\u5305\uFF0C\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u8FD9\u4E9B\u5305\u5728\u88AB\u653B\u51FB\u8005\u79FB\u9664\u540E\u53EF\u80FD\u88AB\u5A01\u80C1\u884C\u4E3A\u8005\u91CD\u65B0\u6CE8\u518C\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u91C7\u7528\u201C\u8BEF\u690D\u57DF\u540D\u201D\u6216\u540D\u79F0\u6DF7\u6DC6\u7684\u7B56\u7565\uFF0C\u9009\u62E9\u4E0E\u73B0\u6709\u6D41\u884C\u5E93\u6216\u5305\u76F8\u4F3C\u7684\u540D\u79F0\u6765\u6B3A\u9A97\u7528\u6237\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1195\/001\/"},{"id":"T1195.002","name":"\u59A5\u534F\u8F6F\u4EF6\u4F9B\u5E94\u94FE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6700\u7EC8\u7528\u6237\u63A5\u6536\u5E94\u7528\u8F6F\u4EF6\u4E4B\u524D\u5BF9\u5176\u8FDB\u884C\u7BE1\u6539\uFF0C\u4EE5\u8FBE\u5230\u7834\u574F\u6570\u636E\u6216\u7CFB\u7EDF\u7684\u76EE\u7684\u3002\u8F6F\u4EF6\u4F9B\u5E94\u94FE\u7684\u7834\u574F\u53EF\u4EE5\u901A\u8FC7\u591A\u79CD\u65B9\u5F0F\u5B9E\u73B0\uFF0C\u5305\u62EC\u7BE1\u6539\u5E94\u7528\u7A0B\u5E8F\u6E90\u4EE3\u7801\u3001\u64CD\u7EB5\u8BE5\u8F6F\u4EF6\u7684\u66F4\u65B0\/\u5206\u53D1\u673A\u5236\uFF0C\u6216\u7528\u4FEE\u6539\u540E\u7684\u7248\u672C\u66FF\u6362\u5DF2\u7F16\u8BD1\u7684\u53D1\u5E03\u7248\u672C\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1195\/002\/"},{"id":"T1195.003","name":"\u59A5\u534F\u786C\u4EF6\u4F9B\u5E94\u94FE","description":"\u5BF9\u624B\u53EF\u80FD\u5728\u4EA7\u54C1\u5230\u8FBE\u6700\u7EC8\u6D88\u8D39\u8005\u4E4B\u524D\uFF0C\u901A\u8FC7\u64CD\u7EB5\u786C\u4EF6\u7EC4\u4EF6\u6765\u8FBE\u5230\u7834\u574F\u6570\u636E\u6216\u7CFB\u7EDF\u7684\u76EE\u7684\u3002\u901A\u8FC7\u5728\u4F9B\u5E94\u94FE\u4E2D\u4FEE\u6539\u786C\u4EF6\u6216\u56FA\u4EF6\uFF0C\u5BF9\u624B\u80FD\u591F\u5728\u6D88\u8D39\u8005\u7F51\u7EDC\u4E2D\u690D\u5165\u540E\u95E8\uFF0C\u8FD9\u79CD\u540E\u95E8\u5F80\u5F80\u96BE\u4EE5\u68C0\u6D4B\uFF0C\u5E76\u8D4B\u4E88\u5BF9\u624B\u5BF9\u7CFB\u7EDF\u7684\u9AD8\u5EA6\u63A7\u5236\u6743\u3002\u786C\u4EF6\u540E\u95E8\u53EF\u80FD\u88AB\u690D\u5165\u591A\u79CD\u8BBE\u5907\u4E2D\uFF0C\u4F8B\u5982\u670D\u52A1\u5668\u3001\u5DE5\u4F5C\u7AD9\u3001\u7F51\u7EDC\u57FA\u7840\u8BBE\u65BD\u6216\u5916\u56F4\u8BBE\u5907\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1195\/003\/"},{"id":"T1195","name":"\u4F9B\u5E94\u94FE\u653B\u51FB","description":"\u5BF9\u624B\u53EF\u80FD\u5728\u4EA7\u54C1\u9001\u8FBE\u6700\u7EC8\u6D88\u8D39\u8005\u4E4B\u524D\uFF0C\u64CD\u7EB5\u4EA7\u54C1\u6216\u4EA7\u54C1\u4EA4\u4ED8\u673A\u5236\uFF0C\u4EE5\u8FBE\u5230\u7834\u574F\u6570\u636E\u6216\u7CFB\u7EDF\u7684\u76EE\u7684\u3002","sub-techniques":"T1195.001, T1195.002, T1195.003","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1195\/"},{"id":"T1197","name":"BITS\u62DB\u8058","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528BITS\u4F5C\u4E1A\u6765\u6301\u4E45\u6267\u884C\u4EE3\u7801\u5E76\u6267\u884C\u5404\u79CD\u540E\u53F0\u4EFB\u52A1\u3002Windows\u540E\u53F0\u667A\u80FD\u4F20\u8F93\u670D\u52A1\uFF08BITS\uFF09\u662F\u4E00\u79CD\u901A\u8FC7\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08COM\uFF09\u516C\u5F00\u7684\u4F4E\u5E26\u5BBD\u3001\u5F02\u6B65\u6587\u4EF6\u4F20\u8F93\u673A\u5236\u3002BITS\u901A\u5E38\u88AB\u66F4\u65B0\u7A0B\u5E8F\u3001\u5373\u65F6\u901A\u8BAF\u5DE5\u5177\u53CA\u5176\u4ED6\u503E\u5411\u4E8E\u5728\u540E\u53F0\u8FD0\u884C\uFF08\u5229\u7528\u53EF\u7528\u7A7A\u95F2\u5E26\u5BBD\uFF09\u4E14\u4E0D\u5E72\u6270\u5176\u4ED6\u7F51\u7EDC\u5E94\u7528\u7A0B\u5E8F\u7684\u7A0B\u5E8F\u6240\u4F7F\u7528\u3002\u6587\u4EF6\u4F20\u8F93\u4EFB\u52A1\u4EE5BITS\u4F5C\u4E1A\u7684\u5F62\u5F0F\u5B9E\u73B0\uFF0C\u8FD9\u4E9B\u4F5C\u4E1A\u5305\u542B\u4E00\u4E2A\u6216\u591A\u4E2A\u6587\u4EF6\u64CD\u4F5C\u961F\u5217\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1197\/"},{"id":"T1199","name":"\u53EF\u4FE1\u8D56\u7684\u5173\u7CFB","description":"\u5BF9\u624B\u53EF\u80FD\u5165\u4FB5\u6216\u5229\u7528\u90A3\u4E9B\u80FD\u591F\u63A5\u89E6\u5230\u76EE\u6807\u53D7\u5BB3\u8005\u7684\u7EC4\u7EC7\u3002\u901A\u8FC7\u6EE5\u7528\u53EF\u4FE1\u7B2C\u4E09\u65B9\u5173\u7CFB\u83B7\u53D6\u8BBF\u95EE\u6743\u9650\uFF0C\u8FD9\u79CD\u65B9\u5F0F\u5229\u7528\u4E86\u73B0\u6709\u8FDE\u63A5\uFF0C\u8FD9\u4E9B\u8FDE\u63A5\u53EF\u80FD\u672A\u53D7\u4FDD\u62A4\uFF0C\u6216\u8005\u53D7\u5230\u7684\u5BA1\u67E5\u6BD4\u6807\u51C6\u7684\u7F51\u7EDC\u8BBF\u95EE\u673A\u5236\u8981\u5C11\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1199\/"},{"id":"T1200","name":"\u786C\u4EF6\u65B0\u589E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u8BA1\u7B97\u673A\u914D\u4EF6\u3001\u7F51\u7EDC\u786C\u4EF6\u6216\u5176\u4ED6\u8BA1\u7B97\u8BBE\u5907\u7269\u7406\u5F15\u5165\u7CFB\u7EDF\u6216\u7F51\u7EDC\uFF0C\u8FD9\u4E9B\u8BBE\u5907\u53EF\u4F5C\u4E3A\u83B7\u53D6\u8BBF\u95EE\u6743\u9650\u7684\u5A92\u4ECB\u3002\u4E0E\u4EC5\u901A\u8FC7\u53EF\u79FB\u52A8\u5B58\u50A8\u8BBE\u5907\u8FDE\u63A5\u548C\u5206\u53D1\u6709\u6548\u8D1F\u8F7D\uFF08\u5373\u901A\u8FC7\u53EF\u79FB\u52A8\u4ECB\u8D28\u590D\u5236\uFF09\u4E0D\u540C\uFF0C\u66F4\u590D\u6742\u7684\u786C\u4EF6\u6DFB\u52A0\u53EF\u7528\u4E8E\u5411\u7CFB\u7EDF\u5F15\u5165\u65B0\u7684\u529F\u80FD\u548C\/\u6216\u7279\u6027\uFF0C\u968F\u540E\u8FD9\u4E9B\u529F\u80FD\u53EF\u80FD\u88AB\u6EE5\u7528\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1200\/"},{"id":"T1201","name":"\u5BC6\u7801\u7B56\u7565\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u4F01\u4E1A\u7F51\u7EDC\u6216\u4E91\u73AF\u5883\u4E2D\u4F7F\u7528\u7684\u5BC6\u7801\u7B56\u7565\u7684\u8BE6\u7EC6\u4FE1\u606F\u3002\u5BC6\u7801\u7B56\u7565\u65E8\u5728\u5F3A\u5236\u4F7F\u7528\u96BE\u4EE5\u731C\u6D4B\u6216\u901A\u8FC7\u66B4\u529B\u7834\u89E3\u7684\u590D\u6742\u5BC6\u7801\u3002\u6B64\u7C7B\u4FE1\u606F\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u521B\u5EFA\u5E38\u89C1\u5BC6\u7801\u5217\u8868\uFF0C\u5E76\u53D1\u52A8\u7B26\u5408\u8BE5\u7B56\u7565\u7684\u5B57\u5178\u653B\u51FB\u548C\/\u6216\u66B4\u529B\u653B\u51FB\uFF08\u4F8B\u5982\uFF0C\u82E5\u6700\u5C0F\u5BC6\u7801\u957F\u5EA6\u8981\u6C42\u4E3A8\u4F4D\uFF0C\u5219\u4E0D\u4F1A\u5C1D\u8BD5\u5982\u201Cpass123\u201D\u8FD9\u7C7B\u5BC6\u7801\uFF1B\u82E5\u8D26\u6237\u9501\u5B9A\u9608\u503C\u8BBE\u4E3A6\u6B21\uFF0C\u5219\u6BCF\u4E2A\u8D26\u6237\u7684\u5C1D\u8BD5\u6B21\u6570\u4E0D\u4F1A\u8D85\u8FC73-4\u6B21\uFF0C\u4EE5\u907F\u514D\u89E6\u53D1\u8D26\u6237\u9501\u5B9A\uFF09\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1201\/"},{"id":"T1202","name":"\u95F4\u63A5\u547D\u4EE4\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5141\u8BB8\u6267\u884C\u547D\u4EE4\u7684\u5B9E\u7528\u7A0B\u5E8F\uFF0C\u4EE5\u7ED5\u8FC7\u9650\u5236\u547D\u4EE4\u884C\u89E3\u91CA\u5668\u4F7F\u7528\u7684\u5B89\u5168\u9650\u5236\u3002\u5404\u79CDWindows\u5B9E\u7528\u7A0B\u5E8F\u53EF\u7528\u4E8E\u6267\u884C\u547D\u4EE4\uFF0C\u53EF\u80FD\u65E0\u9700\u8C03\u7528cmd\u3002\u4F8B\u5982\uFF0CForfiles\u3001\u7A0B\u5E8F\u517C\u5BB9\u6027\u52A9\u624B\uFF08pcalua.exe\uFF09\u3001Windows\u5B50\u7CFB\u7EDFLinux\uFF08WSL\uFF09\u7EC4\u4EF6\u3001Scriptrunner.exe\u4EE5\u53CA\u5176\u4ED6\u5B9E\u7528\u7A0B\u5E8F\uFF0C\u53EF\u4EE5\u4ECE\u547D\u4EE4\u548C\u811A\u672C\u89E3\u91CA\u5668\u3001\u8FD0\u884C\u7A97\u53E3\u6216\u901A\u8FC7\u811A\u672C\u8C03\u7528\u7A0B\u5E8F\u548C\u547D\u4EE4\u7684\u6267\u884C\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u6EE5\u7528ssh.exe\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF0C\u901A\u8FC7ProxyCommand\u548CLocalCommand\u9009\u9879\u6267\u884C\u6076\u610F\u547D\u4EE4\uFF0C\u8FD9\u4E9B\u9009\u9879\u53EF\u4EE5\u901A\u8FC7-o\u6807\u5FD7\u6216\u4FEE\u6539SSH\u914D\u7F6E\u6587\u4EF6\u6765\u8C03\u7528\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1202\/"},{"id":"T1203","name":"\u5BA2\u6237\u7AEF\u6267\u884C\u5229\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5BA2\u6237\u7AEF\u5E94\u7528\u7A0B\u5E8F\u4E2D\u7684\u8F6F\u4EF6\u6F0F\u6D1E\u6765\u6267\u884C\u4EE3\u7801\u3002\u7531\u4E8E\u4E0D\u5B89\u5168\u7684\u7F16\u7801\u5B9E\u8DF5\uFF0C\u8F6F\u4EF6\u4E2D\u53EF\u80FD\u5B58\u5728\u6F0F\u6D1E\uFF0C\u5BFC\u81F4\u610F\u5916\u884C\u4E3A\u3002\u653B\u51FB\u8005\u53EF\u901A\u8FC7\u9488\u5BF9\u6027\u5229\u7528\u67D0\u4E9B\u6F0F\u6D1E\u5B9E\u73B0\u4EFB\u610F\u4EE3\u7801\u6267\u884C\u3002\u901A\u5E38\uFF0C\u5BF9\u4E8E\u653B\u51FB\u5DE5\u5177\u5305\u800C\u8A00\uFF0C\u6700\u6709\u4EF7\u503C\u7684\u6F0F\u6D1E\u5229\u7528\u662F\u90A3\u4E9B\u80FD\u591F\u5728\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u6267\u884C\u4EE3\u7801\u7684\uFF0C\u56E0\u4E3A\u5B83\u4EEC\u53EF\u7528\u4E8E\u83B7\u53D6\u5BF9\u8BE5\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u7528\u6237\u901A\u5E38\u4F1A\u770B\u5230\u4E0E\u4ED6\u4EEC\u65E5\u5E38\u5DE5\u4F5C\u5E38\u7528\u5E94\u7528\u7A0B\u5E8F\u76F8\u5173\u7684\u6587\u4EF6\uFF0C\u56E0\u6B64\u8FD9\u4E9B\u5E94\u7528\u7A0B\u5E8F\u56E0\u5176\u9AD8\u5B9E\u7528\u6027\u800C\u6210\u4E3A\u6F0F\u6D1E\u7814\u7A76\u4E0E\u5F00\u53D1\u7684\u6709\u7528\u76EE\u6807\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1203\/"},{"id":"T1204.001","name":"\u6076\u610F\u94FE\u63A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u70B9\u51FB\u6076\u610F\u94FE\u63A5\u6765\u83B7\u53D6\u6267\u884C\u6743\u9650\u3002\u901A\u8FC7\u793E\u4F1A\u5DE5\u7A0B\u624B\u6BB5\uFF0C\u7528\u6237\u53EF\u80FD\u88AB\u8BF1\u5BFC\u70B9\u51FB\u5BFC\u81F4\u4EE3\u7801\u6267\u884C\u7684\u94FE\u63A5\u3002\u6B64\u7C7B\u7528\u6237\u884C\u4E3A\u901A\u5E38\u88AB\u89C6\u4E3A\u9C7C\u53C9\u5F0F\u9493\u9C7C\u94FE\u63A5\u7684\u540E\u7EED\u884C\u4E3A\u3002\u70B9\u51FB\u94FE\u63A5\u8FD8\u53EF\u80FD\u5F15\u53D1\u5176\u4ED6\u6267\u884C\u6280\u672F\uFF0C\u4F8B\u5982\u901A\u8FC7\u5BA2\u6237\u7AEF\u6267\u884C\u6F0F\u6D1E\u5229\u7528\u6D4F\u89C8\u5668\u6216\u5E94\u7528\u7A0B\u5E8F\u7684\u5F31\u70B9\u3002\u6B64\u5916\uFF0C\u94FE\u63A5\u4E5F\u53EF\u80FD\u5F15\u5BFC\u7528\u6237\u4E0B\u8F7D\u9700\u8981\u901A\u8FC7\u6076\u610F\u6587\u4EF6\u6267\u884C\u7684\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/001\/"},{"id":"T1204.002","name":"\u6076\u610F\u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u6253\u5F00\u6076\u610F\u6587\u4EF6\u6765\u83B7\u53D6\u6267\u884C\u6743\u9650\u3002\u901A\u8FC7\u793E\u4F1A\u5DE5\u7A0B\u624B\u6BB5\uFF0C\u7528\u6237\u53EF\u80FD\u88AB\u8BF1\u9A97\u6253\u5F00\u5BFC\u81F4\u4EE3\u7801\u6267\u884C\u7684\u6587\u4EF6\u3002\u6B64\u7C7B\u7528\u6237\u884C\u4E3A\u901A\u5E38\u88AB\u89C6\u4E3A\u9C7C\u53C9\u5F0F\u9493\u9C7C\u9644\u4EF6\u7684\u540E\u7EED\u884C\u4E3A\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u591A\u79CD\u9700\u8981\u7528\u6237\u6267\u884C\u7684\u6587\u4EF6\u7C7B\u578B\uFF0C\u5305\u62EC.doc\u3001.pdf\u3001.xls\u3001.rtf\u3001.scr\u3001.exe\u3001.lnk\u3001.pif\u3001.cpl\u3001.reg\u548C.iso\u7B49\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/002\/"},{"id":"T1204.003","name":"\u6076\u610F\u56FE\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u8FD0\u884C\u6076\u610F\u955C\u50CF\u6765\u8F85\u52A9\u6267\u884C\u3002\u4E9A\u9A6C\u900A\u7F51\u7EDC\u670D\u52A1\uFF08AWS\uFF09\u7684\u4E9A\u9A6C\u900A\u673A\u5668\u955C\u50CF\uFF08AMIs\uFF09\u3001\u8C37\u6B4C\u4E91\u5E73\u53F0\uFF08GCP\uFF09\u955C\u50CF\u3001Azure\u955C\u50CF\u4EE5\u53CA\u5982Docker\u7B49\u6D41\u884C\u7684\u5BB9\u5668\u8FD0\u884C\u65F6\u5747\u53EF\u88AB\u690D\u5165\u540E\u95E8\u3002\u8FD9\u4E9B\u88AB\u540E\u95E8\u5316\u7684\u955C\u50CF\u53EF\u80FD\u901A\u8FC7\u4E0A\u4F20\u6076\u610F\u8F6F\u4EF6\u7684\u65B9\u5F0F\u88AB\u4F20\u81F3\u516C\u5171\u4ED3\u5E93\uFF0C\u968F\u540E\u7528\u6237\u5728\u4E0D\u77E5\u60C5\u7684\u60C5\u51B5\u4E0B\u4E0B\u8F7D\u5E76\u90E8\u7F72\u57FA\u4E8E\u8BE5\u955C\u50CF\u7684\u5B9E\u4F8B\u6216\u5BB9\u5668\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u4E13\u95E8\u7528\u4E8E\u5B9E\u73B0\u521D\u59CB\u8BBF\u95EE\u7684\u6280\u672F\u624B\u6BB5\u3002\u8FD9\u53EF\u80FD\u5BFC\u81F4\u5728\u5B9E\u4F8B\u6216\u5BB9\u5668\u4E2D\u6267\u884C\u6076\u610F\u4EE3\u7801\uFF0C\u4F8B\u5982\u8FDB\u884C\u52A0\u5BC6\u8D27\u5E01\u6316\u77FF\u7684\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/003\/"},{"id":"T1204.004","name":"\u6076\u610F\u590D\u5236\u7C98\u8D34","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u590D\u5236\u548C\u7C98\u8D34\u4EE3\u7801\u6765\u83B7\u53D6\u6267\u884C\u6743\u9650\u3002\u7528\u6237\u53EF\u80FD\u53D7\u5230\u793E\u4F1A\u5DE5\u7A0B\u5B66\u624B\u6BB5\u7684\u5F71\u54CD\uFF0C\u88AB\u8BF1\u5BFC\u5C06\u4EE3\u7801\u76F4\u63A5\u590D\u5236\u7C98\u8D34\u5230\u547D\u4EE4\u548C\u811A\u672C\u89E3\u91CA\u5668\u4E2D\u3002\u5176\u4E2D\u4E00\u79CD\u7B56\u7565\u662F\u201C\u70B9\u51FB\u4FEE\u590D\u201D\uFF0C\u653B\u51FB\u8005\u5411\u7528\u6237\u5C55\u793A\u770B\u4F3C\u6709\u7528\u7684\u89E3\u51B3\u65B9\u6848\u2014\u2014\u4F8B\u5982\u63D0\u793A\u4FEE\u590D\u9519\u8BEF\u6216\u5B8C\u6210\u9A8C\u8BC1\u7801\u2014\u2014\u5B9E\u9645\u4E0A\u5374\u6307\u793A\u7528\u6237\u590D\u5236\u7C98\u8D34\u6076\u610F\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/004\/"},{"id":"T1204.005","name":"\u6076\u610F\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u5B89\u88C5\u6076\u610F\u5E93\u6765\u8F85\u52A9\u6267\u884C\u3002\u5A01\u80C1\u884C\u4E3A\u8005\u53EF\u80FD\u4F1A\u5C06\u6076\u610F\u8F6F\u4EF6\u4E0A\u4F20\u81F3NPM\u548CPyPI\u7B49\u5305\u7BA1\u7406\u5668\uFF0C\u4EE5\u53CAGitHub\u7B49\u516C\u5171\u4EE3\u7801\u4ED3\u5E93\u3002\u7528\u6237\u53EF\u80FD\u5728\u672A\u610F\u8BC6\u5230\u5176\u6076\u610F\u6027\u8D28\u7684\u60C5\u51B5\u4E0B\u5B89\u88C5\u8FD9\u4E9B\u5E93\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u4E13\u95E8\u7528\u4E8E\u5B9E\u73B0\u521D\u59CB\u8BBF\u95EE\u7684\u6280\u672F\u624B\u6BB5\u3002\u8FD9\u53EF\u80FD\u5BFC\u81F4\u6076\u610F\u4EE3\u7801\u7684\u6267\u884C\uFF0C\u4F8B\u5982\u5EFA\u7ACB\u6301\u4E45\u5316\u3001\u7A83\u53D6\u6570\u636E\u6216\u6316\u6398\u52A0\u5BC6\u8D27\u5E01\u7684\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/005\/"},{"id":"T1204","name":"\u7528\u6237\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u7684\u7279\u5B9A\u64CD\u4F5C\u6765\u83B7\u53D6\u6267\u884C\u6743\u9650\u3002\u901A\u8FC7\u793E\u4F1A\u5DE5\u7A0B\u5B66\u624B\u6BB5\uFF0C\u7528\u6237\u53EF\u80FD\u88AB\u8BF1\u4F7F\u6267\u884C\u6076\u610F\u4EE3\u7801\uFF0C\u4F8B\u5982\u6253\u5F00\u6076\u610F\u6587\u6863\u6587\u4EF6\u6216\u94FE\u63A5\u3002\u8FD9\u4E9B\u7528\u6237\u884C\u4E3A\u901A\u5E38\u8868\u73B0\u4E3A\u9493\u9C7C\u653B\u51FB\u7684\u540E\u7EED\u884C\u4E3A\u3002","sub-techniques":"T1204.001, T1204.002, T1204.003, T1204.004, T1204.005","tactic":"\u6267\u884C","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1204\/"},{"id":"T1205.001","name":"\u7AEF\u53E3\u6572\u95E8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7AEF\u53E3\u6572\u95E8\u6280\u672F\u6765\u9690\u85CF\u7528\u4E8E\u6301\u4E45\u5316\u6216\u547D\u4EE4\u4E0E\u63A7\u5236\u7684\u5F00\u653E\u7AEF\u53E3\u3002\u4E3A\u4E86\u542F\u7528\u67D0\u4E2A\u7AEF\u53E3\uFF0C\u653B\u51FB\u8005\u4F1A\u5411\u4E00\u7CFB\u5217\u9884\u5B9A\u4E49\u7684\u5173\u95ED\u7AEF\u53E3\u53D1\u9001\u8FDE\u63A5\u5C1D\u8BD5\u5E8F\u5217\u3002\u5F53\u8BE5\u5E8F\u5217\u5B8C\u6210\u540E\uFF0C\u901A\u5E38\u7531\u57FA\u4E8E\u4E3B\u673A\u7684\u9632\u706B\u5899\u6765\u5F00\u653E\u7AEF\u53E3\uFF0C\u4F46\u4E5F\u53EF\u4EE5\u901A\u8FC7\u81EA\u5B9A\u4E49\u8F6F\u4EF6\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1205\/001\/"},{"id":"T1205.002","name":"\u5957\u63A5\u5B57\u8FC7\u6EE4\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7F51\u7EDC\u5957\u63A5\u5B57\u4E0A\u9644\u52A0\u8FC7\u6EE4\u5668\uFF0C\u4EE5\u76D1\u63A7\u5E76\u968F\u540E\u6FC0\u6D3B\u7528\u4E8E\u6301\u4E45\u5316\u6216\u547D\u4EE4\u4E0E\u63A7\u5236\u7684\u9690\u853D\u540E\u95E8\u3002\u901A\u8FC7\u63D0\u5347\u6743\u9650\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u5982libpcap\u5E93\u7B49\u529F\u80FD\u6253\u5F00\u5957\u63A5\u5B57\u5E76\u5B89\u88C5\u8FC7\u6EE4\u5668\uFF0C\u4EE5\u5141\u8BB8\u6216\u963B\u6B62\u7279\u5B9A\u7C7B\u578B\u7684\u6570\u636E\u901A\u8FC7\u8BE5\u5957\u63A5\u5B57\u3002\u6B64\u8FC7\u6EE4\u5668\u53EF\u5E94\u7528\u4E8E\u901A\u8FC7\u6307\u5B9A\u7F51\u7EDC\u63A5\u53E3\uFF08\u82E5\u672A\u6307\u5B9A\u5219\u9002\u7528\u4E8E\u6240\u6709\u63A5\u53E3\uFF09\u7684\u6240\u6709\u6D41\u91CF\u3002\u5F53\u7F51\u7EDC\u63A5\u53E3\u63A5\u6536\u5230\u7B26\u5408\u8FC7\u6EE4\u6761\u4EF6\u7684\u6570\u636E\u5305\u65F6\uFF0C\u53EF\u5728\u4E3B\u673A\u4E0A\u89E6\u53D1\u989D\u5916\u64CD\u4F5C\uFF0C\u4F8B\u5982\u6FC0\u6D3B\u53CD\u5411shell\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1205\/002\/"},{"id":"T1205","name":"\u4EA4\u901A\u4FE1\u53F7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6D41\u91CF\u4FE1\u53F7\u6765\u9690\u85CF\u5F00\u653E\u7AEF\u53E3\u6216\u5176\u4ED6\u7528\u4E8E\u6301\u4E45\u5316\u6216\u547D\u4EE4\u4E0E\u63A7\u5236\u7684\u6076\u610F\u529F\u80FD\u3002\u6D41\u91CF\u4FE1\u53F7\u6D89\u53CA\u4F7F\u7528\u4E00\u4E2A\u5FC5\u987B\u53D1\u9001\u7ED9\u7CFB\u7EDF\u7684\u7279\u5B9A\u503C\u6216\u5E8F\u5217\uFF0C\u4EE5\u89E6\u53D1\u7279\u6B8A\u54CD\u5E94\uFF0C\u4F8B\u5982\u6253\u5F00\u4E00\u4E2A\u5173\u95ED\u7684\u7AEF\u53E3\u6216\u6267\u884C\u6076\u610F\u4EFB\u52A1\u3002\u8FD9\u53EF\u80FD\u8868\u73B0\u4E3A\u5728\u7AEF\u53E3\u5F00\u653E\u4E4B\u524D\u53D1\u9001\u4E00\u7CFB\u5217\u5177\u6709\u7279\u5B9A\u7279\u5F81\u7684\u6570\u636E\u5305\uFF0C\u653B\u51FB\u8005\u968F\u540E\u53EF\u5229\u7528\u8BE5\u7AEF\u53E3\u8FDB\u884C\u547D\u4EE4\u4E0E\u63A7\u5236\u3002\u901A\u5E38\uFF0C\u8FD9\u4E00\u7CFB\u5217\u6570\u636E\u5305\u5305\u62EC\u5C1D\u8BD5\u8FDE\u63A5\u5230\u9884\u5B9A\u4E49\u5E8F\u5217\u7684\u5173\u95ED\u7AEF\u53E3\uFF08\u5373\u7AEF\u53E3\u6572\u95E8\uFF09\uFF0C\u4F46\u4E5F\u53EF\u80FD\u6D89\u53CA\u5F02\u5E38\u6807\u5FD7\u3001\u7279\u5B9A\u5B57\u7B26\u4E32\u6216\u5176\u4ED6\u72EC\u7279\u7279\u5F81\u3002\u5E8F\u5217\u5B8C\u6210\u540E\uFF0C\u5F00\u653E\u7AEF\u53E3\u53EF\u80FD\u7531\u57FA\u4E8E\u4E3B\u673A\u7684\u9632\u706B\u5899\u5B8C\u6210\uFF0C\u4F46\u4E5F\u53EF\u80FD\u901A\u8FC7\u5B9A\u5236\u8F6F\u4EF6\u5B9E\u73B0\u3002","sub-techniques":"T1205.001, T1205.002","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1205\/"},{"id":"T1207","name":"\u6D41\u6C13\u57DF\u63A7\u5236\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6CE8\u518C\u4E00\u4E2A\u6076\u610F\u57DF\u63A7\u5236\u5668\uFF0C\u4EE5\u4FBF\u64CD\u7EB5\u6D3B\u52A8\u76EE\u5F55\u6570\u636E\u3002DCShadow\u53EF\u7528\u4E8E\u521B\u5EFA\u6076\u610F\u57DF\u63A7\u5236\u5668\uFF08DC\uFF09\u3002DCShadow\u662F\u4E00\u79CD\u901A\u8FC7\u6CE8\u518C\uFF08\u6216\u91CD\u65B0\u4F7F\u7528\u975E\u6D3B\u52A8\u6CE8\u518C\uFF09\u5E76\u6A21\u62DF\u57DF\u63A7\u5236\u5668\u884C\u4E3A\u6765\u64CD\u7EB5\u6D3B\u52A8\u76EE\u5F55\uFF08AD\uFF09\u6570\u636E\uFF08\u5305\u62EC\u5BF9\u8C61\u548C\u67B6\u6784\uFF09\u7684\u65B9\u6CD5\u3002\u4E00\u65E6\u6CE8\u518C\u6210\u529F\uFF0C\u6076\u610F\u57DF\u63A7\u5236\u5668\u4FBF\u80FD\u591F\u5411AD\u57FA\u7840\u8BBE\u65BD\u4E2D\u6CE8\u5165\u5E76\u590D\u5236\u9488\u5BF9\u4EFB\u4F55\u57DF\u5BF9\u8C61\uFF08\u5305\u62EC\u51ED\u636E\u548C\u5BC6\u94A5\uFF09\u7684\u66F4\u6539\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1207\/"},{"id":"T1210","name":"\u8FDC\u7A0B\u670D\u52A1\u5229\u7528","description":"\u4E00\u65E6\u8FDB\u5165\u7F51\u7EDC\u5185\u90E8\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8FDC\u7A0B\u670D\u52A1\u6765\u83B7\u53D6\u5BF9\u5185\u90E8\u7CFB\u7EDF\u7684\u672A\u6388\u6743\u8BBF\u95EE\u3002\u5F53\u653B\u51FB\u8005\u5229\u7528\u7A0B\u5E8F\u3001\u670D\u52A1\u6216\u64CD\u4F5C\u7CFB\u7EDF\u8F6F\u4EF6\u4E43\u81F3\u5185\u6838\u672C\u8EAB\u7684\u7F16\u7A0B\u9519\u8BEF\u6765\u6267\u884C\u5176\u63A7\u5236\u7684\u4EE3\u7801\u65F6\uFF0C\u5373\u53D1\u751F\u4E86\u8F6F\u4EF6\u6F0F\u6D1E\u7684\u5229\u7528\u3002\u5165\u4FB5\u540E\u5229\u7528\u8FDC\u7A0B\u670D\u52A1\u7684\u4E00\u4E2A\u5E38\u89C1\u76EE\u6807\u662F\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\uFF0C\u4EE5\u83B7\u53D6\u5BF9\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1210\/"},{"id":"T1211","name":"\u9632\u5FA1\u89C4\u907F\u5229\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7CFB\u7EDF\u6216\u5E94\u7528\u7A0B\u5E8F\u7684\u6F0F\u6D1E\u6765\u7ED5\u8FC7\u5B89\u5168\u9632\u62A4\u63AA\u65BD\u3002\u5F53\u653B\u51FB\u8005\u5229\u7528\u7A0B\u5E8F\u3001\u670D\u52A1\u6216\u64CD\u4F5C\u7CFB\u7EDF\u8F6F\u4EF6\u4E43\u81F3\u5185\u6838\u672C\u8EAB\u7684\u7F16\u7A0B\u9519\u8BEF\uFF0C\u6267\u884C\u5176\u63A7\u5236\u7684\u4EE3\u7801\u65F6\uFF0C\u5C31\u53D1\u751F\u4E86\u6F0F\u6D1E\u5229\u7528\u3002\u9632\u5FA1\u6027\u5B89\u5168\u8F6F\u4EF6\u4E2D\u4E5F\u53EF\u80FD\u5B58\u5728\u6F0F\u6D1E\uFF0C\u8FD9\u4E9B\u6F0F\u6D1E\u53EF\u88AB\u7528\u4E8E\u7981\u7528\u6216\u89C4\u907F\u5B89\u5168\u9632\u62A4\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1211\/"},{"id":"T1212","name":"\u5229\u7528\u51ED\u8BC1\u8BBF\u95EE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8F6F\u4EF6\u6F0F\u6D1E\u6765\u5C1D\u8BD5\u6536\u96C6\u51ED\u8BC1\u3002\u5F53\u653B\u51FB\u8005\u5229\u7528\u7A0B\u5E8F\u3001\u670D\u52A1\u6216\u64CD\u4F5C\u7CFB\u7EDF\u8F6F\u4EF6\u53CA\u5185\u6838\u672C\u8EAB\u7684\u7F16\u7A0B\u9519\u8BEF\uFF0C\u6267\u884C\u7531\u653B\u51FB\u8005\u63A7\u5236\u7684\u4EE3\u7801\u65F6\uFF0C\u5373\u53D1\u751F\u4E86\u8F6F\u4EF6\u6F0F\u6D1E\u7684\u5229\u7528\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1212\/"},{"id":"T1213.001","name":"\u6C47\u6D41","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Confluence\u5B58\u50A8\u5E93\u6765\u6316\u6398\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002Confluence\u901A\u5E38\u4E0EAtlassian JIRA\u4E00\u540C\u51FA\u73B0\u5728\u5F00\u53D1\u73AF\u5883\u4E2D\uFF0C\u4E3B\u8981\u7528\u4E8E\u5B58\u50A8\u5F00\u53D1\u76F8\u5173\u6587\u6863\uFF0C\u4F46\u901A\u5E38\u4E5F\u53EF\u80FD\u5305\u542B\u66F4\u591A\u6837\u5316\u7684\u6709\u7528\u4FE1\u606F\u7C7B\u522B\uFF0C\u4F8B\u5982\uFF1A","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/001\/"},{"id":"T1213.002","name":"Sharepoint","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528SharePoint\u5B58\u50A8\u5E93\u4F5C\u4E3A\u6316\u6398\u6709\u4EF7\u503C\u4FE1\u606F\u7684\u6765\u6E90\u3002SharePoint\u901A\u5E38\u5305\u542B\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u4E86\u89E3\u5185\u90E8\u7F51\u7EDC\u548C\u7CFB\u7EDF\u7ED3\u6784\u4E0E\u529F\u80FD\u7684\u6709\u7528\u4FE1\u606F\u3002\u4F8B\u5982\uFF0C\u4EE5\u4E0B\u5217\u8868\u5C55\u793A\u4E86\u53EF\u80FD\u5BF9\u653B\u51FB\u8005\u5177\u6709\u6F5C\u5728\u4EF7\u503C\u4E14\u53EF\u80FD\u5728SharePoint\u4E0A\u627E\u5230\u7684\u793A\u4F8B\u4FE1\u606F\uFF1A","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u529E\u516C\u5957\u4EF6,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/002\/"},{"id":"T1213.003","name":"\u4EE3\u7801\u4ED3\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4EE3\u7801\u4ED3\u5E93\u6536\u96C6\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002\u4EE3\u7801\u4ED3\u5E93\u662F\u5B58\u50A8\u6E90\u4EE3\u7801\u5E76\u81EA\u52A8\u5316\u8F6F\u4EF6\u6784\u5EFA\u7684\u5DE5\u5177\u6216\u670D\u52A1\u3002\u5B83\u4EEC\u53EF\u80FD\u6258\u7BA1\u5728\u5185\u90E8\uFF0C\u6216\u901A\u8FC7\u7B2C\u4E09\u65B9\u7F51\u7AD9\u5982GitHub\u3001GitLab\u3001SourceForge\u548CBitBucket\u8FDB\u884C\u79C1\u6709\u6258\u7BA1\u3002\u7528\u6237\u901A\u5E38\u901A\u8FC7Web\u5E94\u7528\u7A0B\u5E8F\u6216\u547D\u4EE4\u884C\u5DE5\u5177\uFF08\u5982git\uFF09\u4E0E\u4EE3\u7801\u4ED3\u5E93\u8FDB\u884C\u4EA4\u4E92\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/003\/"},{"id":"T1213.004","name":"\u5BA2\u6237\u5173\u7CFB\u7BA1\u7406\u8F6F\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u5BA2\u6237\u5173\u7CFB\u7BA1\u7406\uFF08CRM\uFF09\u8F6F\u4EF6\u6765\u6316\u6398\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002CRM\u8F6F\u4EF6\u7528\u4E8E\u5E2E\u52A9\u7EC4\u7EC7\u8DDF\u8E2A\u548C\u7BA1\u7406\u5BA2\u6237\u4E92\u52A8\uFF0C\u4EE5\u53CA\u5B58\u50A8\u5BA2\u6237\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/004\/"},{"id":"T1213.005","name":"\u5373\u65F6\u901A\u8BAF\u5E94\u7528","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u804A\u5929\u548C\u5373\u65F6\u901A\u8BAF\u5E94\u7528\uFF0C\u5982Microsoft Teams\u3001Google Chat\u548CSlack\uFF0C\u6765\u6316\u6398\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/005\/"},{"id":"T1213.006","name":"\u6570\u636E\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6570\u636E\u5E93\u6316\u6398\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002\u8FD9\u4E9B\u6570\u636E\u5E93\u53EF\u80FD\u90E8\u7F72\u5728\u672C\u5730\u6216\u4E91\u7AEF\uFF08\u5305\u62EC\u5E73\u53F0\u5373\u670D\u52A1\u548C\u8F6F\u4EF6\u5373\u670D\u52A1\u73AF\u5883\uFF09\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/006\/"},{"id":"T1213","name":"\u4FE1\u606F\u5E93\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u4FE1\u606F\u5B58\u50A8\u5E93\u6765\u6316\u6398\u6709\u4EF7\u503C\u7684\u4FE1\u606F\u3002\u4FE1\u606F\u5B58\u50A8\u5E93\u662F\u7528\u4E8E\u5B58\u50A8\u4FE1\u606F\u7684\u5DE5\u5177\uFF0C\u901A\u5E38\u65E8\u5728\u4FC3\u8FDB\u7528\u6237\u95F4\u7684\u534F\u4F5C\u6216\u4FE1\u606F\u5171\u4EAB\uFF0C\u5E76\u80FD\u5B58\u50A8\u591A\u79CD\u7C7B\u578B\u7684\u6570\u636E\uFF0C\u8FD9\u4E9B\u6570\u636E\u53EF\u80FD\u5E2E\u52A9\u653B\u51FB\u8005\u5B9E\u73B0\u8FDB\u4E00\u6B65\u7684\u76EE\u6807\uFF0C\u4F8B\u5982\u51ED\u8BC1\u8BBF\u95EE\u3001\u6A2A\u5411\u79FB\u52A8\u6216\u9632\u5FA1\u89C4\u907F\uFF0C\u751A\u81F3\u76F4\u63A5\u83B7\u53D6\u76EE\u6807\u4FE1\u606F\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u6EE5\u7528\u5916\u90E8\u5171\u4EAB\u529F\u80FD\uFF0C\u5C06\u654F\u611F\u6587\u6863\u5206\u4EAB\u7ED9\u7EC4\u7EC7\u5916\u7684\u63A5\u6536\u8005\uFF08\u5373\uFF0C\u5C06\u6570\u636E\u4F20\u8F93\u81F3\u4E91\u8D26\u6237\uFF09\u3002","sub-techniques":"T1213.001, T1213.002, T1213.003, T1213.004, T1213.005, T1213.006","tactic":"\u6536\u85CF","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1213\/"},{"id":"T1216.001","name":"\u51FA\u7248\u5370\u5237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528PubPrn\u4EE3\u7406\u6267\u884C\u6076\u610F\u8FDC\u7A0B\u6587\u4EF6\u3002PubPrn.vbs\u662F\u4E00\u79CDVisual Basic\u811A\u672C\uFF0C\u7528\u4E8E\u5C06\u6253\u5370\u673A\u53D1\u5E03\u5230Active Directory\u57DF\u670D\u52A1\u3002\u8BE5\u811A\u672C\u53EF\u80FD\u7531\u5FAE\u8F6F\u7B7E\u540D\uFF0C\u901A\u5E38\u901A\u8FC7Windows\u547D\u4EE4\u5916\u58F3\u501F\u52A9Cscript.exe\u6267\u884C\u3002\u4F8B\u5982\uFF0C\u4EE5\u4E0B\u4EE3\u7801\u5728\u6307\u5B9A\u57DF\u5185\u53D1\u5E03\u6253\u5370\u673A\uFF1Acscript pubprn Printer1 LDAP:\/\/CN=Container1,DC=Domain1,DC=Com\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1216\/001\/"},{"id":"T1216.002","name":"\u540C\u6B65Appv\u53D1\u5E03\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528SyncAppvPublishingServer.vbs\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u7684PowerShell\u547D\u4EE4\u3002SyncAppvPublishingServer.vbs\u662F\u4E00\u4E2A\u4E0EWindows\u865A\u62DF\u5316\u5E94\u7528\u7A0B\u5E8F\uFF08Microsoft Application Virtualization\uFF0C\u7B80\u79F0App-V\uFF09\u76F8\u5173\u7684Visual Basic\u811A\u672C\u3002\u4F8B\u5982\uFF0CWindows\u53EF\u80FD\u5C06Win32\u5E94\u7528\u7A0B\u5E8F\u4F5C\u4E3A\u865A\u62DF\u5E94\u7528\u7A0B\u5E8F\u5448\u73B0\u7ED9\u7528\u6237\uFF0C\u4F7F\u7528\u6237\u80FD\u591F\u50CF\u672C\u5730\u5B89\u88C5\u4E00\u6837\u542F\u52A8\u548C\u4EA4\u4E92\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1216\/002\/"},{"id":"T1216","name":"\u7CFB\u7EDF\u811A\u672C\u4EE3\u7406\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u53D7\u4FE1\u4EFB\u7684\u811A\u672C\uFF08\u901A\u5E38\u5E26\u6709\u8BC1\u4E66\u7B7E\u540D\uFF09\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u6587\u4EF6\u3002\u4E00\u4E9B\u4ECE\u5FAE\u8F6F\u4E0B\u8F7D\u6216Windows\u7CFB\u7EDF\u9ED8\u8BA4\u5B89\u88C5\u7684\u5FAE\u8F6F\u7B7E\u540D\u811A\u672C\uFF0C\u53EF\u88AB\u7528\u4E8E\u4EE3\u7406\u6267\u884C\u5176\u4ED6\u6587\u4EF6\u3002\u8FD9\u79CD\u884C\u4E3A\u53EF\u80FD\u88AB\u653B\u51FB\u8005\u6EE5\u7528\uFF0C\u4EE5\u6267\u884C\u80FD\u591F\u7ED5\u8FC7\u7CFB\u7EDF\u5E94\u7528\u63A7\u5236\u548C\u7B7E\u540D\u9A8C\u8BC1\u7684\u6076\u610F\u6587\u4EF6\u3002","sub-techniques":"T1216.001, T1216.002","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1216\/"},{"id":"T1217","name":"\u6D4F\u89C8\u5668\u4FE1\u606F\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u679A\u4E3E\u6D4F\u89C8\u5668\u4FE1\u606F\u6765\u6DF1\u5165\u4E86\u89E3\u53D7\u611F\u67D3\u73AF\u5883\u3002\u6D4F\u89C8\u5668\u4FDD\u5B58\u7684\u6570\u636E\uFF08\u5982\u4E66\u7B7E\u3001\u8D26\u6237\u4FE1\u606F\u548C\u6D4F\u89C8\u5386\u53F2\uFF09\u53EF\u80FD\u6CC4\u9732\u7528\u6237\u7684\u591A\u79CD\u4E2A\u4EBA\u4FE1\u606F\uFF08\u4F8B\u5982\u94F6\u884C\u7F51\u7AD9\u3001\u4EBA\u9645\u5173\u7CFB\/\u5174\u8DA3\u7231\u597D\u3001\u793E\u4EA4\u5A92\u4F53\u7B49\uFF09\uFF0C\u4EE5\u53CA\u5185\u90E8\u7F51\u7EDC\u8D44\u6E90\u7684\u8BE6\u7EC6\u4FE1\u606F\uFF0C\u5982\u670D\u52A1\u5668\u3001\u5DE5\u5177\/\u4EEA\u8868\u677F\u6216\u5176\u4ED6\u76F8\u5173\u57FA\u7840\u8BBE\u65BD\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1217\/"},{"id":"T1218.001","name":"\u5DF2\u7F16\u8BD1\u7684HTML\u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5DF2\u7F16\u8BD1\u7684HTML\u6587\u4EF6\uFF08.chm\uFF09\u6765\u9690\u85CF\u6076\u610F\u4EE3\u7801\u3002CHM\u6587\u4EF6\u901A\u5E38\u4F5C\u4E3AMicrosoft HTML\u5E2E\u52A9\u7CFB\u7EDF\u7684\u4E00\u90E8\u5206\u5206\u53D1\u3002\u8FD9\u4E9B\u6587\u4EF6\u662F\u591A\u79CD\u5185\u5BB9\u7684\u538B\u7F29\u7F16\u8BD1\uFF0C\u5305\u62ECHTML\u6587\u6863\u3001\u56FE\u50CF\u4EE5\u53CA\u811A\u672C\/\u7F51\u7EDC\u76F8\u5173\u7F16\u7A0B\u8BED\u8A00\uFF0C\u5982VBA\u3001JScript\u3001Java\u548CActiveX\u3002CHM\u5185\u5BB9\u901A\u8FC7HTML\u5E2E\u52A9\u53EF\u6267\u884C\u7A0B\u5E8F\uFF08hh.exe\uFF09\u52A0\u8F7D\u7684Internet Explorer\u6D4F\u89C8\u5668\u5E95\u5C42\u7EC4\u4EF6\u663E\u793A\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/001\/"},{"id":"T1218.002","name":"\u63A7\u5236\u9762\u677F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528control.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u3002Windows\u63A7\u5236\u9762\u677F\u8FDB\u7A0B\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF08control.exe\uFF09\u8D1F\u8D23\u5904\u7406\u63A7\u5236\u9762\u677F\u9879\u76EE\u7684\u6267\u884C\uFF0C\u8FD9\u4E9B\u5B9E\u7528\u7A0B\u5E8F\u5141\u8BB8\u7528\u6237\u67E5\u770B\u548C\u8C03\u6574\u8BA1\u7B97\u673A\u8BBE\u7F6E\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/002\/"},{"id":"T1218.003","name":"\u8FDE\u63A5\u7BA1\u7406\u5668\u914D\u7F6E\u6587\u4EF6\u5B89\u88C5\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528CMSTP\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002Microsoft\u8FDE\u63A5\u7BA1\u7406\u5668\u914D\u7F6E\u6587\u4EF6\u5B89\u88C5\u7A0B\u5E8F\uFF08CMSTP.exe\uFF09\u662F\u4E00\u4E2A\u7528\u4E8E\u5B89\u88C5\u8FDE\u63A5\u7BA1\u7406\u5668\u670D\u52A1\u914D\u7F6E\u6587\u4EF6\u7684\u547D\u4EE4\u884C\u7A0B\u5E8F\u3002CMSTP.exe\u63A5\u53D7\u5B89\u88C5\u4FE1\u606F\u6587\u4EF6\uFF08INF\uFF09\u4F5C\u4E3A\u53C2\u6570\uFF0C\u5E76\u5B89\u88C5\u7528\u4E8E\u8FDC\u7A0B\u8BBF\u95EE\u8FDE\u63A5\u7684\u670D\u52A1\u914D\u7F6E\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/003\/"},{"id":"T1218.004","name":"InstallUtil","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528InstallUtil\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684Windows\u5DE5\u5177\u4EE3\u7406\u6267\u884C\u4EE3\u7801\u3002InstallUtil\u662F\u4E00\u79CD\u547D\u4EE4\u884C\u5DE5\u5177\uFF0C\u53EF\u901A\u8FC7\u6267\u884C.NET\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E2D\u6307\u5B9A\u7684\u7279\u5B9A\u5B89\u88C5\u7A0B\u5E8F\u7EC4\u4EF6\u6765\u5B89\u88C5\u548C\u5378\u8F7D\u8D44\u6E90\u3002InstallUtil\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E5F\u53EF\u80FD\u7531\u5FAE\u8F6F\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\uFF0C\u5E76\u4F4D\u4E8EWindows\u7CFB\u7EDF\u7684.NET\u76EE\u5F55\u4E2D\uFF1AC:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe \u548C C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/004\/"},{"id":"T1218.005","name":"Mshta","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528mshta.exe\uFF0C\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684Windows\u5B9E\u7528\u7A0B\u5E8F\u4EE3\u7406\u6267\u884C\u6076\u610F\u7684.hta\u6587\u4EF6\u4EE5\u53CAJavascript\u6216VBScript\u811A\u672C\u3002\u5728\u521D\u59CB\u5165\u4FB5\u548C\u4EE3\u7801\u6267\u884C\u9636\u6BB5\uFF0C\u5B58\u5728\u591A\u79CD\u5229\u7528mshta.exe\u7684\u4E0D\u540C\u7C7B\u578B\u5A01\u80C1\u5B9E\u4F8B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/005\/"},{"id":"T1218.007","name":"Msiexec","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528msiexec.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u3002Msiexec.exe\u662FWindows Installer\u7684\u547D\u4EE4\u884C\u5DE5\u5177\uFF0C\u56E0\u6B64\u901A\u5E38\u4E0E\u6267\u884C\u5B89\u88C5\u5305\uFF08.msi\uFF09\u76F8\u5173\u8054\u3002Msiexec.exe\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E5F\u53EF\u80FD\u7531\u5FAE\u8F6F\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/007\/"},{"id":"T1218.008","name":"ODBC\u914D\u7F6E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528odbcconf.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u8F7D\u8377\u3002Odbcconf.exe\u662F\u4E00\u6B3EWindows\u5B9E\u7528\u5DE5\u5177\uFF0C\u7528\u4E8E\u914D\u7F6E\u5F00\u653E\u6570\u636E\u5E93\u8FDE\u63A5\uFF08ODBC\uFF09\u9A71\u52A8\u7A0B\u5E8F\u548C\u6570\u636E\u6E90\u540D\u79F0\u3002\u8BE5\u4E8C\u8FDB\u5236\u6587\u4EF6\u53EF\u80FD\u7531\u5FAE\u8F6F\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/008\/"},{"id":"T1218.009","name":"Regsvcs\/Regasm","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Regsvcs\u548CRegasm\u5DE5\u5177\uFF0C\u901A\u8FC7\u53D7\u4FE1\u4EFB\u7684Windows\u5B9E\u7528\u7A0B\u5E8F\u4EE3\u7406\u6267\u884C\u4EE3\u7801\u3002Regsvcs\u548CRegasm\u662FWindows\u547D\u4EE4\u884C\u5B9E\u7528\u7A0B\u5E8F\uFF0C\u7528\u4E8E\u6CE8\u518C.NET\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08COM\uFF09\u7A0B\u5E8F\u96C6\u3002\u8FD9\u4E24\u8005\u90FD\u662F\u53EF\u80FD\u7531\u5FAE\u8F6F\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/009\/"},{"id":"T1218.010","name":"\u6CE8\u518C\u52A8\u6001\u94FE\u63A5\u5E93\u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Regsvr32.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002Regsvr32.exe\u662F\u4E00\u4E2A\u547D\u4EE4\u884C\u7A0B\u5E8F\uFF0C\u7528\u4E8E\u5728Windows\u7CFB\u7EDF\u4E0A\u6CE8\u518C\u548C\u6CE8\u9500\u5BF9\u8C61\u94FE\u63A5\u4E0E\u5D4C\u5165\u63A7\u4EF6\uFF0C\u5305\u62EC\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\u3002Regsvr32.exe\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E5F\u53EF\u80FD\u7531\u5FAE\u8F6F\u7B7E\u540D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/010\/"},{"id":"T1218.011","name":"Rundll32","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528rundll32.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002\u901A\u8FC7\u4F7F\u7528rundll32.exe\u800C\u975E\u76F4\u63A5\u6267\u884C\uFF08\u4F8B\u5982\u901A\u8FC7\u5171\u4EAB\u6A21\u5757\uFF09\uFF0C\u53EF\u4EE5\u907F\u514D\u89E6\u53D1\u5B89\u5168\u5DE5\u5177\u7684\u8B66\u62A5\uFF0C\u56E0\u4E3A\u8FD9\u4E9B\u5DE5\u5177\u53EF\u80FD\u7531\u4E8E\u767D\u540D\u5355\u673A\u5236\u6216\u6B63\u5E38\u64CD\u4F5C\u4EA7\u751F\u7684\u8BEF\u62A5\u800C\u672A\u76D1\u63A7rundll32.exe\u8FDB\u7A0B\u7684\u6267\u884C\u3002Rundll32.exe\u901A\u5E38\u7528\u4E8E\u6267\u884CDLL\u8D1F\u8F7D\uFF08\u4F8B\u5982\uFF1Arundll32.exe {DLL\u540D\u79F0, DLL\u51FD\u6570}\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/011\/"},{"id":"T1218.012","name":"Verclsid","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528verclsid.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002Verclsid.exe\u88AB\u79F0\u4E3A\u6269\u5C55CLSID\u9A8C\u8BC1\u4E3B\u673A\uFF0C\u8D1F\u8D23\u5728Windows\u8D44\u6E90\u7BA1\u7406\u5668\u6216Windows Shell\u4F7F\u7528\u6BCF\u4E2AShell\u6269\u5C55\u4E4B\u524D\u5BF9\u5176\u8FDB\u884C\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/012\/"},{"id":"T1218.013","name":"Mavinject","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528mavinject.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002Mavinject.exe\u662F\u5FAE\u8F6F\u5E94\u7528\u7A0B\u5E8F\u865A\u62DF\u5316\u6CE8\u5165\u5668\uFF0C\u4F5C\u4E3A\u5FAE\u8F6F\u5E94\u7528\u7A0B\u5E8F\u865A\u62DF\u5316\uFF08App-V\uFF09\u7684\u4E00\u90E8\u5206\uFF0C\u8BE5Windows\u5B9E\u7528\u7A0B\u5E8F\u80FD\u591F\u5C06\u4EE3\u7801\u6CE8\u5165\u5916\u90E8\u8FDB\u7A0B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/013\/"},{"id":"T1218.014","name":"\u591A\u5A92\u4F53\u5361","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528mmc.exe\u6765\u4EE3\u7406\u6267\u884C\u6076\u610F\u7684.msc\u6587\u4EF6\u3002Microsoft\u7BA1\u7406\u63A7\u5236\u53F0\uFF08MMC\uFF09\u662F\u4E00\u4E2A\u53EF\u80FD\u7531\u5FAE\u8F6F\u7B7E\u540D\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF0C\u53EF\u901A\u8FC7\u56FE\u5F62\u7528\u6237\u754C\u9762\u6216\u547D\u4EE4\u63D0\u793A\u7B26\u4EE5\u591A\u79CD\u65B9\u5F0F\u4F7F\u7528\u3002MMC\u53EF\u7528\u4E8E\u521B\u5EFA\u3001\u6253\u5F00\u548C\u4FDD\u5B58\u5305\u542B\u7531\u5FAE\u8F6F\u521B\u5EFA\u7684\u7BA1\u7406\u5DE5\u5177\uFF08\u79F0\u4E3A\u7BA1\u7406\u5355\u5143\uFF09\u7684\u81EA\u5B9A\u4E49\u63A7\u5236\u53F0\u3002\u8FD9\u4E9B\u7BA1\u7406\u5355\u5143\u53EF\u7528\u4E8E\u672C\u5730\u6216\u8FDC\u7A0B\u7BA1\u7406Windows\u7CFB\u7EDF\u3002MMC\u8FD8\u53EF\u7528\u4E8E\u6253\u5F00\u5FAE\u8F6F\u521B\u5EFA\u7684.msc\u6587\u4EF6\u4EE5\u7BA1\u7406\u7CFB\u7EDF\u914D\u7F6E\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/014\/"},{"id":"T1218.015","name":"Electron \u5E94\u7528\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Electron\u6846\u67B6\u7684\u7EC4\u4EF6\u6765\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002Electron\u6846\u67B6\u627F\u8F7D\u4E86\u8BB8\u591A\u5E38\u89C1\u5E94\u7528\u7A0B\u5E8F\uFF0C\u5982Signal\u3001Slack\u548CMicrosoft Teams\u3002\u8BE5\u6846\u67B6\u6700\u521D\u7531GitHub\u5F00\u53D1\uFF0C\u662F\u4E00\u4E2A\u4F7F\u7528JavaScript\u3001HTML\u548CCSS\u7B49\u7F51\u7EDC\u6280\u672F\u7684\u8DE8\u5E73\u53F0\u684C\u9762\u5E94\u7528\u7A0B\u5E8F\u5F00\u53D1\u6846\u67B6\u3002\u5176\u91C7\u7528Chromium\u5F15\u64CE\u663E\u793A\u7F51\u9875\u5185\u5BB9\uFF0C\u5E76\u5229\u7528Node.js\u8FD0\u884C\u540E\u7AEF\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/015\/"},{"id":"T1218","name":"\u7CFB\u7EDF\u4E8C\u8FDB\u5236\u4EE3\u7406\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4F7F\u7528\u7ECF\u8FC7\u7B7E\u540D\u6216\u53D7\u4FE1\u4EFB\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4EE3\u7406\u6076\u610F\u5185\u5BB9\u7684\u6267\u884C\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u57FA\u4E8E\u8FDB\u7A0B\u548C\/\u6216\u7B7E\u540D\u7684\u9632\u5FA1\u673A\u5236\u3002\u6B64\u6280\u672F\u4E2D\u4F7F\u7528\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u901A\u5E38\u662F\u5FAE\u8F6F\u7B7E\u540D\u7684\u6587\u4EF6\uFF0C\u8868\u660E\u5B83\u4EEC\u8981\u4E48\u662F\u4ECE\u5FAE\u8F6F\u4E0B\u8F7D\u7684\uFF0C\u8981\u4E48\u662F\u64CD\u4F5C\u7CFB\u7EDF\u81EA\u5E26\u7684\u3002\u4F7F\u7528\u53D7\u4FE1\u4EFB\u6570\u5B57\u8BC1\u4E66\u7B7E\u540D\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u901A\u5E38\u53EF\u4EE5\u5728\u53D7\u6570\u5B57\u7B7E\u540D\u9A8C\u8BC1\u4FDD\u62A4\u7684Windows\u7CFB\u7EDF\u4E0A\u6267\u884C\u3002Windows\u5B89\u88C5\u4E2D\u9ED8\u8BA4\u5B58\u5728\u7684\u591A\u4E2A\u5FAE\u8F6F\u7B7E\u540D\u4E8C\u8FDB\u5236\u6587\u4EF6\u53EF\u7528\u4E8E\u4EE3\u7406\u5176\u4ED6\u6587\u4EF6\u6216\u547D\u4EE4\u7684\u6267\u884C\u3002","sub-techniques":"T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1218.012, T1218.013, T1218.014, T1218.015","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1218\/"},{"id":"T1219.001","name":"IDE \u96A7\u9053","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5177\u6709\u8FDC\u7A0B\u5F00\u53D1\u529F\u80FD\u7684\u96C6\u6210\u5F00\u53D1\u73AF\u5883\uFF08IDE\uFF09\u8F6F\u4EF6\uFF0C\u5728\u7F51\u7EDC\u5185\u7684\u76EE\u6807\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u4EA4\u4E92\u5F0F\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002IDE\u96A7\u9053\u6280\u672F\u5C06SSH\u3001\u7AEF\u53E3\u8F6C\u53D1\u3001\u6587\u4EF6\u5171\u4EAB\u548C\u8C03\u8BD5\u529F\u80FD\u6574\u5408\u5230\u5355\u4E00\u5B89\u5168\u8FDE\u63A5\u4E2D\uFF0C\u4F7F\u5F00\u53D1\u4EBA\u5458\u80FD\u591F\u50CF\u64CD\u4F5C\u672C\u5730\u7CFB\u7EDF\u4E00\u6837\u5904\u7406\u8FDC\u7A0B\u7CFB\u7EDF\u3002\u4E0ESSH\u548C\u7AEF\u53E3\u8F6C\u53D1\u4E0D\u540C\uFF0CIDE\u96A7\u9053\u5C01\u88C5\u6574\u4E2A\u4F1A\u8BDD\uFF0C\u5E76\u53EF\u80FD\u5728\u4F7F\u7528SSH\u7684\u540C\u65F6\u91C7\u7528\u4E13\u6709\u96A7\u9053\u534F\u8BAE\uFF0C\u8FD9\u4F7F\u5F97\u653B\u51FB\u8005\u80FD\u591F\u9690\u85CF\u5728\u5408\u6CD5\u7684\u5F00\u53D1\u5DE5\u4F5C\u6D41\u7A0B\u4E2D\u3002\u67D0\u4E9BIDE\uFF08\u5982Visual Studio Code\uFF09\u8FD8\u63D0\u4F9B\u547D\u4EE4\u884C\u5DE5\u5177\uFF08\u4F8B\u5982code tunnel\uFF09\uFF0C\u653B\u51FB\u8005\u53EF\u5229\u7528\u8FD9\u4E9B\u5DE5\u5177\u4EE5\u7F16\u7A0B\u65B9\u5F0F\u5EFA\u7ACB\u96A7\u9053\uFF0C\u5E76\u751F\u6210\u53EF\u901A\u8FC7\u7F51\u7EDC\u8BBF\u95EE\u7684URL\u5B9E\u73B0\u8FDC\u7A0B\u63A5\u5165\u3002\u8FD9\u4E9B\u96A7\u9053\u53EF\u901A\u8FC7GitHub\u7B49\u8D26\u6237\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\uFF0C\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u901A\u8FC7\u5408\u6CD5\u7684\u5F00\u53D1\u8005\u95E8\u6237\u63A7\u5236\u53D7\u5165\u4FB5\u7CFB\u7EDF\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1219\/001\/"},{"id":"T1219.002","name":"\u8FDC\u7A0B\u684C\u9762\u8F6F\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5408\u6CD5\u7684\u684C\u9762\u652F\u6301\u8F6F\u4EF6\u5728\u7F51\u7EDC\u5185\u90E8\u7684\u76EE\u6807\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u4EA4\u4E92\u5F0F\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FD9\u7C7B\u8F6F\u4EF6\u901A\u8FC7\u56FE\u5F62\u754C\u9762\u5B9E\u73B0\u8FDC\u7A0B\u63A7\u5236\uFF0C\u5229\u7528\u591A\u79CD\u534F\u8BAE\u5728\u8BBE\u5907\u95F4\u4F20\u8F93\u5C4F\u5E55\u8F93\u51FA\u3001\u952E\u76D8\u8F93\u5165\u53CA\u9F20\u6807\u63A7\u5236\u4FE1\u53F7\u3002\u8BF8\u5982VNC\u3001TeamViewer\u3001AnyDesk\u3001ScreenConnect\u3001LogMein\u3001AmmyyAdmin\u7B49\u8FDC\u7A0B\u76D1\u63A7\u7BA1\u7406\u5DE5\u5177\uFF0C\u901A\u5E38\u4F5C\u4E3A\u6B63\u89C4\u6280\u672F\u652F\u6301\u8F6F\u4EF6\u4F7F\u7528\uFF0C\u4E14\u53EF\u80FD\u88AB\u76EE\u6807\u73AF\u5883\u7684\u5E94\u7528\u63A7\u5236\u7B56\u7565\u6240\u5141\u8BB8\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1219\/002\/"},{"id":"T1219.003","name":"\u8FDC\u7A0B\u8BBF\u95EE\u786C\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5408\u6CD5\u7684\u8FDC\u7A0B\u8BBF\u95EE\u786C\u4EF6\uFF0C\u5728\u7F51\u7EDC\u5185\u90E8\u7684\u76EE\u6807\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u4EA4\u4E92\u5F0F\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FD9\u4E9B\u670D\u52A1\u5305\u62EC\u57FA\u4E8EIP\u7684\u952E\u76D8\u3001\u89C6\u9891\u6216\u9F20\u6807\uFF08KVM\uFF09\u8BBE\u5907\uFF0C\u4F8B\u5982TinyPilot\u548CPiKVM\uFF0C\u5B83\u4EEC\u901A\u5E38\u4F5C\u4E3A\u5408\u6CD5\u5DE5\u5177\u4F7F\u7528\uFF0C\u5E76\u4E14\u53EF\u80FD\u88AB\u76EE\u6807\u73AF\u5883\u7684\u5916\u56F4\u8BBE\u5907\u7B56\u7565\u6240\u5141\u8BB8\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1219\/003\/"},{"id":"T1219","name":"\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5408\u6CD5\u7684\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u5728\u7F51\u7EDC\u5185\u5EFA\u7ACB\u4EA4\u4E92\u5F0F\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u8FDC\u7A0B\u8BBF\u95EE\u5DE5\u5177\u901A\u8FC7\u56FE\u5F62\u754C\u9762\u3001\u547D\u4EE4\u884C\u4EA4\u4E92\u3001\u5F00\u53D1\u6216\u7BA1\u7406\u8F6F\u4EF6\u5EFA\u7ACB\u7684\u534F\u8BAE\u96A7\u9053\uFF0C\u6216\u57FA\u4E8EIP\u7684KVM\uFF08\u952E\u76D8\u3001\u89C6\u9891\u3001\u9F20\u6807\uFF09\u7B49\u786C\u4EF6\u7EA7\u8BBF\u95EE\u65B9\u6848\uFF0C\u5728\u4E24\u4E2A\u53D7\u4FE1\u4EFB\u4E3B\u673A\u95F4\u521B\u5EFA\u4F1A\u8BDD\u3002\u684C\u9762\u652F\u6301\u8F6F\u4EF6\uFF08\u901A\u5E38\u4E3A\u56FE\u5F62\u754C\u9762\uFF09\u548C\u8FDC\u7A0B\u7BA1\u7406\u8F6F\u4EF6\uFF08\u901A\u5E38\u4E3A\u547D\u4EE4\u884C\u754C\u9762\uFF09\u5141\u8BB8\u7528\u6237\u50CF\u672C\u5730\u7528\u6237\u4E00\u6837\u8FDC\u7A0B\u63A7\u5236\u8BA1\u7B97\u673A\uFF0C\u5E76\u7EE7\u627F\u7528\u6237\u6216\u8F6F\u4EF6\u6743\u9650\u3002\u6B64\u7C7B\u8F6F\u4EF6\u901A\u5E38\u7528\u4E8E\u6545\u969C\u6392\u9664\u3001\u8F6F\u4EF6\u5B89\u88C5\u548C\u7CFB\u7EDF\u7BA1\u7406\u3002\u540C\u6837\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7EC8\u7AEF\u68C0\u6D4B\u4E0E\u54CD\u5E94\uFF08EDR\uFF09\u7B49\u9632\u5FA1\u5DE5\u5177\u4E2D\u5185\u7F6E\u7684\u8FDC\u7A0B\u8BBF\u95EE\u54CD\u5E94\u529F\u80FD\u3002","sub-techniques":"T1219.001, T1219.002, T1219.003","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1219\/"},{"id":"T1220","name":"XSL\u811A\u672C\u5904\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5728XSL\u6587\u4EF6\u4E2D\u5D4C\u5165\u811A\u672C\u6765\u7ED5\u8FC7\u5E94\u7528\u7A0B\u5E8F\u63A7\u5236\u5E76\u9690\u85CF\u4EE3\u7801\u6267\u884C\u3002\u53EF\u6269\u5C55\u6837\u5F0F\u8868\u8BED\u8A00\uFF08XSL\uFF09\u6587\u4EF6\u901A\u5E38\u7528\u4E8E\u63CF\u8FF0XML\u6587\u4EF6\u5185\u6570\u636E\u7684\u5904\u7406\u548C\u6E32\u67D3\u3002\u4E3A\u4E86\u652F\u6301\u590D\u6742\u64CD\u4F5C\uFF0CXSL\u6807\u51C6\u5305\u542B\u4E86\u5BF9\u591A\u79CD\u5D4C\u5165\u5F0F\u811A\u672C\u8BED\u8A00\u7684\u652F\u6301\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1220\/"},{"id":"T1221","name":"\u6A21\u677F\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7528\u6237\u6587\u6863\u6A21\u677F\u4E2D\u521B\u5EFA\u6216\u4FEE\u6539\u5F15\u7528\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u4EE3\u7801\u6216\u5F3A\u5236\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u5C1D\u8BD5\u3002\u4F8B\u5982\uFF0C\u5FAE\u8F6F\u7684Office Open XML\uFF08OOXML\uFF09\u89C4\u8303\u5B9A\u4E49\u4E86\u4E00\u79CD\u57FA\u4E8EXML\u7684Office\u6587\u6863\u683C\u5F0F\uFF08.docx\u3001.xlsx\u3001.pptx\uFF09\uFF0C\u7528\u4EE5\u53D6\u4EE3\u65E7\u7684\u4E8C\u8FDB\u5236\u683C\u5F0F\uFF08.doc\u3001.xls\u3001.ppt\uFF09\u3002OOXML\u6587\u4EF6\u5B9E\u9645\u4E0A\u662F\u6253\u5305\u5728\u4E00\u8D77\u7684ZIP\u538B\u7F29\u5305\uFF0C\u5176\u4E2D\u5305\u542B\u591A\u4E2AXML\u6587\u4EF6\uFF08\u79F0\u4E3A\u90E8\u4EF6\uFF09\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u5305\u542B\u7684\u5C5E\u6027\u5171\u540C\u5B9A\u4E49\u4E86\u6587\u6863\u7684\u5448\u73B0\u65B9\u5F0F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1221\/"},{"id":"T1222.001","name":"Windows \u6587\u4EF6\u4E0E\u76EE\u5F55\u6743\u9650\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u6587\u4EF6\u6216\u76EE\u5F55\u7684\u6743\u9650\/\u5C5E\u6027\uFF0C\u4EE5\u89C4\u907F\u8BBF\u95EE\u63A7\u5236\u5217\u8868\uFF08ACLs\uFF09\u5E76\u8BBF\u95EE\u53D7\u4FDD\u62A4\u7684\u6587\u4EF6\u3002\u6587\u4EF6\u548C\u76EE\u5F55\u6743\u9650\u901A\u5E38\u7531\u6587\u4EF6\u6216\u76EE\u5F55\u6240\u6709\u8005\uFF0C\u6216\u5177\u6709\u9002\u5F53\u6743\u9650\u7684\u7528\u6237\u914D\u7F6E\u7684ACLs\u7BA1\u7406\u3002\u6587\u4EF6\u548C\u76EE\u5F55ACL\u7684\u5B9E\u73B0\u56E0\u5E73\u53F0\u800C\u5F02\uFF0C\u4F46\u901A\u5E38\u660E\u786E\u6307\u5B9A\u54EA\u4E9B\u7528\u6237\u6216\u7EC4\u53EF\u4EE5\u6267\u884C\u54EA\u4E9B\u64CD\u4F5C\uFF08\u8BFB\u53D6\u3001\u5199\u5165\u3001\u6267\u884C\u7B49\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1222\/001\/"},{"id":"T1222.002","name":"Linux\u4E0EMac\u6587\u4EF6\u53CA\u76EE\u5F55\u6743\u9650\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u6587\u4EF6\u6216\u76EE\u5F55\u7684\u6743\u9650\/\u5C5E\u6027\uFF0C\u4EE5\u89C4\u907F\u8BBF\u95EE\u63A7\u5236\u5217\u8868\uFF08ACLs\uFF09\u5E76\u8BBF\u95EE\u53D7\u4FDD\u62A4\u7684\u6587\u4EF6\u3002\u6587\u4EF6\u548C\u76EE\u5F55\u6743\u9650\u901A\u5E38\u7531\u6587\u4EF6\u6216\u76EE\u5F55\u6240\u6709\u8005\uFF0C\u6216\u5177\u6709\u9002\u5F53\u6743\u9650\u7684\u7528\u6237\u914D\u7F6E\u7684ACLs\u7BA1\u7406\u3002\u6587\u4EF6\u548C\u76EE\u5F55ACL\u7684\u5B9E\u73B0\u56E0\u5E73\u53F0\u800C\u5F02\uFF0C\u4F46\u901A\u5E38\u660E\u786E\u6307\u5B9A\u54EA\u4E9B\u7528\u6237\u6216\u7EC4\u53EF\u4EE5\u6267\u884C\u54EA\u4E9B\u64CD\u4F5C\uFF08\u8BFB\u53D6\u3001\u5199\u5165\u3001\u6267\u884C\u7B49\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1222\/002\/"},{"id":"T1222","name":"\u6587\u4EF6\u548C\u76EE\u5F55\u6743\u9650\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u6587\u4EF6\u6216\u76EE\u5F55\u7684\u6743\u9650\/\u5C5E\u6027\uFF0C\u4EE5\u89C4\u907F\u8BBF\u95EE\u63A7\u5236\u5217\u8868\uFF08ACLs\uFF09\u5E76\u8BBF\u95EE\u53D7\u4FDD\u62A4\u7684\u6587\u4EF6\u3002\u6587\u4EF6\u548C\u76EE\u5F55\u6743\u9650\u901A\u5E38\u7531\u6587\u4EF6\u6216\u76EE\u5F55\u6240\u6709\u8005\uFF0C\u6216\u5177\u6709\u9002\u5F53\u6743\u9650\u7684\u7528\u6237\u914D\u7F6E\u7684ACLs\u7BA1\u7406\u3002\u6587\u4EF6\u548C\u76EE\u5F55ACL\u7684\u5B9E\u73B0\u56E0\u5E73\u53F0\u800C\u5F02\uFF0C\u4F46\u901A\u5E38\u660E\u786E\u6307\u5B9A\u54EA\u4E9B\u7528\u6237\u6216\u7EC4\u53EF\u4EE5\u6267\u884C\u54EA\u4E9B\u64CD\u4F5C\uFF08\u8BFB\u53D6\u3001\u5199\u5165\u3001\u6267\u884C\u7B49\uFF09\u3002","sub-techniques":"T1222.001, T1222.002","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1222\/"},{"id":"T1480.001","name":"\u73AF\u5883\u5BC6\u94A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u73AF\u5883\u5BC6\u94A5\u5316\u6076\u610F\u8F6F\u4EF6\u7684\u6709\u6548\u8F7D\u8377\u6216\u5176\u4ED6\u529F\u80FD\uFF0C\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\uFF0C\u5E76\u5C06\u6267\u884C\u9650\u5236\u5728\u7279\u5B9A\u7684\u76EE\u6807\u73AF\u5883\u4E2D\u3002\u73AF\u5883\u5BC6\u94A5\u5316\u5229\u7528\u5BC6\u7801\u5B66\u6280\u672F\uFF0C\u6839\u636E\u653B\u51FB\u8005\u63D0\u4F9B\u7684\u9884\u671F\u5B58\u5728\u4E8E\u76EE\u6807\u73AF\u5883\u4E2D\u7684\u7279\u5B9A\u6761\u4EF6\uFF0C\u6765\u9650\u5236\u6267\u884C\u6216\u884C\u52A8\u3002\u73AF\u5883\u5BC6\u94A5\u5316\u662F\u6267\u884C\u62A4\u680F\u7684\u4E00\u79CD\u5B9E\u73B0\u65B9\u5F0F\uFF0C\u5B83\u5229\u7528\u5BC6\u7801\u5B66\u6280\u672F\u4ECE\u7ED9\u5B9A\u8BA1\u7B97\u73AF\u5883\u4E2D\u7684\u7279\u5B9A\u7C7B\u578B\u503C\u4E2D\u6D3E\u751F\u51FA\u52A0\u5BC6\/\u89E3\u5BC6\u5BC6\u94A5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1480\/001\/"},{"id":"T1480.002","name":"\u4E92\u65A5","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6839\u636E\u4E0E\u6076\u610F\u8F6F\u4EF6\u76F8\u5173\u7684\u4E92\u65A5\u4F53\u662F\u5426\u5B58\u5728\u6765\u9650\u5236\u6267\u884C\u6216\u884C\u52A8\u3002\u4E92\u65A5\u4F53\u662F\u4E00\u79CD\u7528\u4E8E\u540C\u6B65\u8D44\u6E90\u8BBF\u95EE\u7684\u9501\u5B9A\u673A\u5236\u3002\u5728\u4EFB\u610F\u7ED9\u5B9A\u65F6\u95F4\uFF0C\u53EA\u6709\u4E00\u4E2A\u7EBF\u7A0B\u6216\u8FDB\u7A0B\u80FD\u591F\u83B7\u53D6\u4E92\u65A5\u4F53\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1480\/002\/"},{"id":"T1480","name":"\u6267\u884C\u62A4\u680F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6267\u884C\u62A4\u680F\u6765\u9650\u5236\u6267\u884C\u6216\u884C\u52A8\uFF0C\u8FD9\u4E9B\u9650\u5236\u57FA\u4E8E\u653B\u51FB\u8005\u63D0\u4F9B\u7684\u3001\u9884\u671F\u5B58\u5728\u4E8E\u76EE\u6807\u4E0A\u7684\u73AF\u5883\u7279\u5B9A\u6761\u4EF6\u3002\u62A4\u680F\u786E\u4FDD\u6709\u6548\u8F7D\u8377\u4EC5\u9488\u5BF9\u9884\u5B9A\u76EE\u6807\u6267\u884C\uFF0C\u4ECE\u800C\u51CF\u5C11\u653B\u51FB\u6D3B\u52A8\u5E26\u6765\u7684\u9644\u5E26\u635F\u5BB3\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u63D0\u4F9B\u7684\u5173\u4E8E\u76EE\u6807\u7CFB\u7EDF\u6216\u73AF\u5883\u7684\u503C\uFF0C\u7528\u4F5C\u62A4\u680F\u7684\u5305\u62EC\u7279\u5B9A\u7684\u7F51\u7EDC\u5171\u4EAB\u540D\u79F0\u3001\u8FDE\u63A5\u7684\u7269\u7406\u8BBE\u5907\u3001\u6587\u4EF6\u3001\u52A0\u5165\u7684Active Directory\uFF08AD\uFF09\u57DF\u4EE5\u53CA\u672C\u5730\/\u5916\u90E8IP\u5730\u5740\u3002","sub-techniques":"T1480.001, T1480.002","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1480\/"},{"id":"T1482","name":"\u57DF\u4FE1\u4EFB\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u6536\u96C6\u6709\u5173\u57DF\u4FE1\u4EFB\u5173\u7CFB\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u8BC6\u522BWindows\u591A\u57DF\/\u6797\u73AF\u5883\u4E2D\u7684\u6A2A\u5411\u79FB\u52A8\u673A\u4F1A\u3002\u57DF\u4FE1\u4EFB\u63D0\u4F9B\u4E86\u4E00\u79CD\u673A\u5236\uFF0C\u5141\u8BB8\u4E00\u4E2A\u57DF\u57FA\u4E8E\u53E6\u4E00\u4E2A\u57DF\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u7A0B\u5E8F\u6765\u8BBF\u95EE\u8D44\u6E90\u3002\u57DF\u4FE1\u4EFB\u4F7F\u5F97\u53D7\u4FE1\u4EFB\u57DF\u7684\u7528\u6237\u80FD\u591F\u8BBF\u95EE\u4FE1\u4EFB\u57DF\u4E2D\u7684\u8D44\u6E90\u3002\u6240\u53D1\u73B0\u7684\u4FE1\u606F\u53EF\u80FD\u5E2E\u52A9\u653B\u51FB\u8005\u5B9E\u65BDSID\u5386\u53F2\u6CE8\u5165\u3001\u7968\u636E\u4F20\u9012\u548CKerberoasting\u653B\u51FB\u3002\u57DF\u4FE1\u4EFB\u53EF\u4EE5\u901A\u8FC7DSEnumerateDomainTrusts() Win32 API\u8C03\u7528\u3001.NET\u65B9\u6CD5\u4EE5\u53CALDAP\u8FDB\u884C\u679A\u4E3E\u3002\u5DF2\u77E5\u653B\u51FB\u8005\u4F1A\u4F7F\u7528Windows\u5B9E\u7528\u5DE5\u5177Nltest\u6765\u679A\u4E3E\u57DF\u4FE1\u4EFB\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1482\/"},{"id":"T1484.001","name":"\u7EC4\u7B56\u7565\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u7EC4\u7B56\u7565\u5BF9\u8C61\uFF08GPO\uFF09\u4EE5\u7834\u574F\u57DF\u5185\u9884\u8BBE\u7684\u81EA\u4E3B\u8BBF\u95EE\u63A7\u5236\u673A\u5236\uFF0C\u901A\u5E38\u65E8\u5728\u63D0\u5347\u57DF\u5185\u6743\u9650\u3002\u7EC4\u7B56\u7565\u652F\u6301\u5728Active Directory\uFF08AD\uFF09\u4E2D\u96C6\u4E2D\u7BA1\u7406\u7528\u6237\u548C\u8BA1\u7B97\u673A\u8BBE\u7F6E\u3002GPO\u4F5C\u4E3A\u7EC4\u7B56\u7565\u8BBE\u7F6E\u7684\u5BB9\u5668\uFF0C\u7531\u5B58\u50A8\u5728\u56FA\u5B9A\u7F51\u7EDC\u8DEF\u5F84&lt;\u57DF\u540D&gt;\\SYSVOL\\&lt;\u57DF\u540D&gt;\\Policies\\\u4E2D\u7684\u6587\u4EF6\u6784\u6210\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1484\/001\/"},{"id":"T1484.002","name":"\u4FE1\u4EFB\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6DFB\u52A0\u65B0\u7684\u57DF\u4FE1\u4EFB\u5173\u7CFB\u3001\u4FEE\u6539\u73B0\u6709\u57DF\u4FE1\u4EFB\u5173\u7CFB\u7684\u5C5E\u6027\uFF0C\u6216\u4EE5\u5176\u4ED6\u65B9\u5F0F\u66F4\u6539\u57DF\u4E0E\u79DF\u6237\u95F4\u4FE1\u4EFB\u5173\u7CFB\u7684\u914D\u7F6E\uFF0C\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u548C\/\u6216\u63D0\u5347\u6743\u9650\u3002\u4FE1\u4EFB\u5173\u7CFB\u7684\u8BE6\u7EC6\u4FE1\u606F\uFF08\u4F8B\u5982\u7528\u6237\u8EAB\u4EFD\u662F\u5426\u5DF2\u8054\u5408\uFF09\u5141\u8BB8\u5728\u57DF\u6216\u79DF\u6237\u4E4B\u95F4\u5E94\u7528\u8EAB\u4EFD\u9A8C\u8BC1\u548C\u6388\u6743\u5C5E\u6027\uFF0C\u4EE5\u5B9E\u73B0\u5BF9\u5171\u4EAB\u8D44\u6E90\u7684\u8BBF\u95EE\u3002\u8FD9\u4E9B\u4FE1\u4EFB\u5BF9\u8C61\u53EF\u80FD\u5305\u62EC\u5E94\u7528\u4E8E\u670D\u52A1\u5668\u3001\u4EE4\u724C\u548C\u57DF\u7684\u8D26\u6237\u3001\u51ED\u636E\u53CA\u5176\u4ED6\u8EAB\u4EFD\u9A8C\u8BC1\u6750\u6599\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1484\/002\/"},{"id":"T1484","name":"\u57DF\u6216\u79DF\u6237\u7B56\u7565\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4FEE\u6539\u57DF\u6216\u8EAB\u4EFD\u79DF\u6237\u7684\u914D\u7F6E\u8BBE\u7F6E\uFF0C\u4EE5\u5728\u96C6\u4E2D\u7BA1\u7406\u7684\u73AF\u5883\u4E2D\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u548C\/\u6216\u63D0\u5347\u6743\u9650\u3002\u6B64\u7C7B\u670D\u52A1\u63D0\u4F9B\u4E86\u96C6\u4E2D\u7BA1\u7406\u8EAB\u4EFD\u8D44\u6E90\uFF08\u5982\u8BBE\u5907\u548C\u8D26\u6237\uFF09\u7684\u624B\u6BB5\uFF0C\u901A\u5E38\u5305\u542B\u9002\u7528\u4E8E\u57DF\u6216\u79DF\u6237\u4E4B\u95F4\u7684\u914D\u7F6E\u8BBE\u7F6E\uFF0C\u4F8B\u5982\u4FE1\u4EFB\u5173\u7CFB\u3001\u8EAB\u4EFD\u540C\u6B65\u6216\u8EAB\u4EFD\u8054\u5408\u3002","sub-techniques":"T1484.001, T1484.002","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1484\/"},{"id":"T1485.001","name":"\u751F\u547D\u5468\u671F\u89E6\u53D1\u7684\u5220\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u4E91\u5B58\u50A8\u6876\u7684\u751F\u547D\u5468\u671F\u7B56\u7565\uFF0C\u4EE5\u9500\u6BC1\u5176\u4E2D\u5B58\u50A8\u7684\u6240\u6709\u5BF9\u8C61\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1485\/001\/"},{"id":"T1485","name":"\u6570\u636E\u9500\u6BC1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7834\u574F\u7279\u5B9A\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E0A\u5927\u91CF\u6570\u636E\u4E0E\u6587\u4EF6\uFF0C\u4EE5\u4E2D\u65AD\u7CFB\u7EDF\u3001\u670D\u52A1\u53CA\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002\u6570\u636E\u9500\u6BC1\u884C\u4E3A\u901A\u5E38\u4F1A\u8986\u76D6\u672C\u5730\u53CA\u8FDC\u7A0B\u9A71\u52A8\u5668\u4E0A\u7684\u6587\u4EF6\u6216\u6570\u636E\uFF0C\u4F7F\u5F97\u53D6\u8BC1\u6280\u672F\u96BE\u4EE5\u6062\u590D\u5B58\u50A8\u4FE1\u606F\u3002\u5E38\u89C1\u7684\u64CD\u4F5C\u7CFB\u7EDF\u6587\u4EF6\u5220\u9664\u547D\u4EE4\uFF08\u5982del\u548Crm\uFF09\u901A\u5E38\u4EC5\u79FB\u9664\u6587\u4EF6\u6307\u9488\u800C\u4E0D\u6E05\u9664\u6587\u4EF6\u5B9E\u9645\u5185\u5BB9\uFF0C\u901A\u8FC7\u4E13\u4E1A\u53D6\u8BC1\u65B9\u6CD5\u4ECD\u53EF\u6062\u590D\u6587\u4EF6\u3002\u6B64\u884C\u4E3A\u533A\u522B\u4E8E\u78C1\u76D8\u5185\u5BB9\u64E6\u9664\u4E0E\u78C1\u76D8\u7ED3\u6784\u64E6\u9664\uFF0C\u56E0\u5176\u9488\u5BF9\u5355\u4E2A\u6587\u4EF6\u8FDB\u884C\u7834\u574F\uFF0C\u800C\u975E\u9488\u5BF9\u5B58\u50A8\u78C1\u76D8\u7684\u7269\u7406\u6247\u533A\u6216\u903B\u8F91\u7ED3\u6784\u3002","sub-techniques":"T1485.001","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1485\/"},{"id":"T1486","name":"\u6570\u636E\u52A0\u5BC6\u4EE5\u65BD\u52A0\u5F71\u54CD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5BF9\u76EE\u6807\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E2D\u7684\u5927\u91CF\u7CFB\u7EDF\u8FDB\u884C\u6570\u636E\u52A0\u5BC6\uFF0C\u4EE5\u4E2D\u65AD\u7CFB\u7EDF\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002\u4ED6\u4EEC\u8BD5\u56FE\u901A\u8FC7\u52A0\u5BC6\u672C\u5730\u548C\u8FDC\u7A0B\u9A71\u52A8\u5668\u4E0A\u7684\u6587\u4EF6\u6216\u6570\u636E\uFF0C\u5E76\u62D2\u7EDD\u63D0\u4F9B\u89E3\u5BC6\u5BC6\u94A5\uFF0C\u4F7F\u5B58\u50A8\u7684\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002\u6B64\u4E3E\u53EF\u80FD\u662F\u4E3A\u4E86\u5411\u53D7\u5BB3\u8005\u52D2\u7D22\u91D1\u94B1\u4EE5\u6362\u53D6\u89E3\u5BC6\u6216\u89E3\u5BC6\u5BC6\u94A5\uFF08\u52D2\u7D22\u8F6F\u4EF6\uFF09\uFF0C\u6216\u5728\u5BC6\u94A5\u672A\u4FDD\u5B58\u6216\u4F20\u8F93\u7684\u60C5\u51B5\u4E0B\uFF0C\u4F7F\u6570\u636E\u6C38\u4E45\u65E0\u6CD5\u8BBF\u95EE\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1486\/"},{"id":"T1489","name":"\u670D\u52A1\u505C\u6B62","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u505C\u6B62\u6216\u7981\u7528\u7CFB\u7EDF\u4E0A\u7684\u670D\u52A1\uFF0C\u4EE5\u4F7F\u5408\u6CD5\u7528\u6237\u65E0\u6CD5\u4F7F\u7528\u8FD9\u4E9B\u670D\u52A1\u3002\u505C\u6B62\u5173\u952E\u670D\u52A1\u6216\u8FDB\u7A0B\u53EF\u80FD\u4F1A\u963B\u788D\u6216\u4E2D\u65AD\u5BF9\u4E8B\u4EF6\u7684\u54CD\u5E94\uFF0C\u6216\u6709\u52A9\u4E8E\u653B\u51FB\u8005\u5B9E\u73B0\u5176\u7834\u574F\u73AF\u5883\u7684\u603B\u4F53\u76EE\u6807\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1489\/"},{"id":"T1490","name":"\u6291\u5236\u7CFB\u7EDF\u6062\u590D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5220\u9664\u6216\u79FB\u9664\u5185\u7F6E\u6570\u636E\uFF0C\u5E76\u5173\u95ED\u65E8\u5728\u5E2E\u52A9\u6062\u590D\u53D7\u635F\u7CFB\u7EDF\u7684\u670D\u52A1\uFF0C\u4EE5\u963B\u6B62\u7CFB\u7EDF\u6062\u590D\u3002\u8FD9\u53EF\u80FD\u5BFC\u81F4\u65E0\u6CD5\u8BBF\u95EE\u53EF\u7528\u7684\u5907\u4EFD\u548C\u6062\u590D\u9009\u9879\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1490\/"},{"id":"T1491.001","name":"\u5185\u90E8\u7BE1\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5BF9\u7EC4\u7EC7\u5185\u90E8\u7CFB\u7EDF\u8FDB\u884C\u7BE1\u6539\uFF0C\u8BD5\u56FE\u6050\u5413\u6216\u8BEF\u5BFC\u7528\u6237\uFF0C\u4ECE\u800C\u7834\u574F\u7CFB\u7EDF\u7684\u53EF\u4FE1\u5EA6\u3002\u8FD9\u53EF\u80FD\u8868\u73B0\u4E3A\u4FEE\u6539\u5185\u90E8\u7F51\u7AD9\u6216\u670D\u52A1\u5668\u767B\u5F55\u4FE1\u606F\uFF0C\u6216\u76F4\u63A5\u66FF\u6362\u7528\u6237\u7CFB\u7EDF\u7684\u684C\u9762\u58C1\u7EB8\u3002\u4EE4\u4EBA\u4E0D\u5B89\u6216\u5192\u72AF\u6027\u7684\u56FE\u50CF\u53EF\u80FD\u88AB\u7528\u4F5C\u5185\u90E8\u7BE1\u6539\u7684\u4E00\u90E8\u5206\uFF0C\u4EE5\u5F15\u8D77\u7528\u6237\u4E0D\u9002\uFF0C\u6216\u8FEB\u4F7F\u5176\u9075\u4ECE\u9644\u5E26\u4FE1\u606F\u7684\u8981\u6C42\u3002\u7531\u4E8E\u5185\u90E8\u7BE1\u6539\u7CFB\u7EDF\u4F1A\u66B4\u9732\u653B\u51FB\u8005\u7684\u5B58\u5728\uFF0C\u8FD9\u901A\u5E38\u5728\u5176\u4ED6\u5165\u4FB5\u76EE\u6807\u8FBE\u6210\u540E\u624D\u53D1\u751F\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1491\/001\/"},{"id":"T1491.002","name":"\u5916\u90E8\u7BE1\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7BE1\u6539\u7EC4\u7EC7\u5916\u90E8\u7684\u7CFB\u7EDF\u6765\u4F20\u9012\u4FE1\u606F\u3001\u8FDB\u884C\u6050\u5413\u6216\u8BEF\u5BFC\u7EC4\u7EC7\u53CA\u7528\u6237\u3002\u5916\u90E8\u7BE1\u6539\u6700\u7EC8\u53EF\u80FD\u5BFC\u81F4\u7528\u6237\u5BF9\u7CFB\u7EDF\u5931\u53BB\u4FE1\u4EFB\uFF0C\u8D28\u7591\u6216\u5426\u5B9A\u7CFB\u7EDF\u7684\u5B8C\u6574\u6027\u3002\u9762\u5411\u5916\u90E8\u7684\u7F51\u7AD9\u5E38\u6210\u4E3A\u7BE1\u6539\u7684\u76EE\u6807\uFF0C\u901A\u5E38\u88AB\u5BF9\u624B\u548C\u9ED1\u5BA2\u6D3B\u52A8\u56E2\u4F53\u653B\u51FB\uFF0C\u4EE5\u63A8\u52A8\u653F\u6CBB\u8BAE\u7A0B\u6216\u4F20\u64AD\u5BA3\u4F20\u3002\u5916\u90E8\u7BE1\u6539\u53EF\u7528\u4F5C\u89E6\u53D1\u4E8B\u4EF6\u7684\u50AC\u5316\u5242\uFF0C\u6216\u4F5C\u4E3A\u5BF9\u7EC4\u7EC7\u6216\u653F\u5E9C\u884C\u52A8\u7684\u56DE\u5E94\u3002\u540C\u6837\uFF0C\u7F51\u7AD9\u7BE1\u6539\u4E5F\u53EF\u80FD\u88AB\u7528\u4F5C\u672A\u6765\u653B\u51FB\uFF08\u5982\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u653B\u51FB\uFF09\u7684\u94FA\u57AB\u6216\u524D\u5146\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1491\/002\/"},{"id":"T1491","name":"\u6C61\u635F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u4F01\u4E1A\u5185\u90E8\u6216\u5916\u90E8\u7F51\u7EDC\u4E0A\u7684\u89C6\u89C9\u5185\u5BB9\uFF0C\u4ECE\u800C\u5F71\u54CD\u539F\u59CB\u5185\u5BB9\u7684\u5B8C\u6574\u6027\u3002\u7BE1\u6539\u7F51\u9875\u7684\u76EE\u7684\u5305\u62EC\u4F20\u9012\u4FE1\u606F\u3001\u8FDB\u884C\u6050\u5413\u6216\u5BA3\u79F0\uFF08\u53EF\u80FD\u662F\u865A\u5047\u7684\uFF09\u5165\u4FB5\u529F\u52B3\u3002\u4EE4\u4EBA\u4E0D\u5B89\u6216\u5192\u72AF\u6027\u7684\u56FE\u50CF\u53EF\u80FD\u88AB\u7528\u4F5C\u7BE1\u6539\u7684\u4E00\u90E8\u5206\uFF0C\u4EE5\u5F15\u8D77\u7528\u6237\u4E0D\u9002\uFF0C\u6216\u8FEB\u4F7F\u7528\u6237\u9075\u4ECE\u9644\u5E26\u4FE1\u606F\u7684\u8981\u6C42\u3002","sub-techniques":"T1491.001, T1491.002","tactic":"\u5F71\u54CD","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1491\/"},{"id":"T1495","name":"\u56FA\u4EF6\u635F\u574F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8986\u76D6\u6216\u635F\u574F\u7CFB\u7EDFBIOS\u6216\u5176\u4ED6\u8BBE\u5907\u56FA\u4EF6\u7684\u95EA\u5B58\u5185\u5BB9\uFF0C\u4F7F\u5176\u65E0\u6CD5\u8FD0\u884C\u6216\u65E0\u6CD5\u542F\u52A8\uFF0C\u4ECE\u800C\u5265\u593A\u7528\u6237\u4F7F\u7528\u8FD9\u4E9B\u8BBE\u5907\u548C\/\u6216\u7CFB\u7EDF\u7684\u80FD\u529B\u3002\u56FA\u4EF6\u662F\u4E00\u79CD\u4ECE\u786C\u4EF6\u8BBE\u5907\u7684\u975E\u6613\u5931\u6027\u5B58\u50A8\u5668\u52A0\u8F7D\u5E76\u6267\u884C\u7684\u8F6F\u4EF6\uFF0C\u7528\u4E8E\u521D\u59CB\u5316\u548C\u7BA1\u7406\u8BBE\u5907\u529F\u80FD\u3002\u8FD9\u4E9B\u8BBE\u5907\u53EF\u80FD\u5305\u62EC\u4E3B\u677F\u3001\u786C\u76D8\u9A71\u52A8\u5668\u6216\u663E\u5361\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1495\/"},{"id":"T1496.001","name":"\u8BA1\u7B97\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u88AB\u63A7\u5236\u7684\u7CFB\u7EDF\u7684\u8BA1\u7B97\u8D44\u6E90\u6765\u5B8C\u6210\u8D44\u6E90\u5BC6\u96C6\u578B\u4EFB\u52A1\uFF0C\u8FD9\u53EF\u80FD\u4F1A\u5F71\u54CD\u7CFB\u7EDF\u548C\/\u6216\u6258\u7BA1\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1496\/001\/"},{"id":"T1496.002","name":"\u5E26\u5BBD\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u88AB\u64CD\u63A7\u7CFB\u7EDF\u7684\u7F51\u7EDC\u5E26\u5BBD\u8D44\u6E90\u6765\u5B8C\u6210\u8D44\u6E90\u5BC6\u96C6\u578B\u4EFB\u52A1\uFF0C\u8FD9\u53EF\u80FD\u4F1A\u5F71\u54CD\u7CFB\u7EDF\u548C\/\u6216\u6258\u7BA1\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1496\/002\/"},{"id":"T1496.003","name":"\u77ED\u4FE1\u8F70\u70B8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6D88\u606F\u670D\u52A1\u8FDB\u884C\u77ED\u4FE1\u8F70\u70B8\uFF0C\u8FD9\u53EF\u80FD\u5F71\u54CD\u7CFB\u7EDF\u548C\/\u6216\u6258\u7BA1\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002\u77ED\u4FE1\u8F70\u70B8\u662F\u4E00\u79CD\u7535\u4FE1\u6B3A\u8BC8\u624B\u6BB5\uFF0C\u5A01\u80C1\u884C\u4E3A\u8005\u9996\u5148\u4ECE\u7535\u4FE1\u670D\u52A1\u63D0\u4F9B\u5546\u5904\u83B7\u53D6\u4E00\u7EC4\u7535\u8BDD\u53F7\u7801\uFF0C\u7136\u540E\u5229\u7528\u53D7\u5BB3\u8005\u7684\u6D88\u606F\u57FA\u7840\u8BBE\u65BD\u5411\u8BE5\u7EC4\u53F7\u7801\u53D1\u9001\u5927\u91CF\u77ED\u4FE1\u3002\u901A\u8FC7\u5411\u81EA\u5DF1\u7684\u7535\u8BDD\u53F7\u7801\u7EC4\u751F\u6210\u77ED\u4FE1\u6D41\u91CF\uFF0C\u5A01\u80C1\u884C\u4E3A\u8005\u53EF\u80FD\u4ECE\u7535\u4FE1\u670D\u52A1\u63D0\u4F9B\u5546\u5904\u83B7\u5F97\u62A5\u916C\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1496\/003\/"},{"id":"T1496.004","name":"\u4E91\u670D\u52A1\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u88AB\u5165\u4FB5\u7684\u8F6F\u4EF6\u5373\u670D\u52A1\uFF08SaaS\uFF09\u5E94\u7528\u7A0B\u5E8F\u6765\u6267\u884C\u8D44\u6E90\u5BC6\u96C6\u578B\u4EFB\u52A1\uFF0C\u8FD9\u53EF\u80FD\u5F71\u54CD\u6258\u7BA1\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1496\/004\/"},{"id":"T1496","name":"\u8D44\u6E90\u52AB\u6301","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u88AB\u64CD\u63A7\u7CFB\u7EDF\u7684\u8D44\u6E90\u6765\u5B8C\u6210\u8D44\u6E90\u5BC6\u96C6\u578B\u4EFB\u52A1\uFF0C\u8FD9\u53EF\u80FD\u4F1A\u5F71\u54CD\u7CFB\u7EDF\u548C\/\u6216\u6258\u7BA1\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"T1496.001, T1496.002, T1496.003, T1496.004","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1496\/"},{"id":"T1497.001","name":"\u7CFB\u7EDF\u68C0\u67E5","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u591A\u79CD\u7CFB\u7EDF\u68C0\u67E5\u624B\u6BB5\u6765\u63A2\u6D4B\u5E76\u89C4\u907F\u865A\u62DF\u5316\u548C\u5206\u6790\u73AF\u5883\u3002\u8FD9\u5305\u62EC\u6839\u636E\u68C0\u6D4B\u865A\u62DF\u673A\u73AF\u5883\uFF08VME\uFF09\u6216\u6C99\u7BB1\u7279\u5F81\u7684\u7ED3\u679C\u6765\u8C03\u6574\u884C\u4E3A\u3002\u82E5\u5BF9\u624B\u68C0\u6D4B\u5230VME\uFF0C\u53EF\u80FD\u4F1A\u4FEE\u6539\u5176\u6076\u610F\u8F6F\u4EF6\u4EE5\u8131\u79BB\u53D7\u5BB3\u8005\u6216\u9690\u85CF\u690D\u5165\u7269\u7684\u6838\u5FC3\u529F\u80FD\u3002\u5728\u91CA\u653E\u6B21\u8981\u6216\u989D\u5916\u8F7D\u8377\u524D\uFF0C\u4ED6\u4EEC\u4E5F\u53EF\u80FD\u5148\u641C\u5BFBVME\u75D5\u8FF9\u3002\u5BF9\u624B\u53EF\u5229\u7528\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u4ECE\u865A\u62DF\u5316\/\u6C99\u7BB1\u89C4\u907F\u4E2D\u5B66\u5230\u7684\u4FE1\u606F\uFF0C\u6765\u8C03\u6574\u540E\u7EED\u884C\u4E3A\u7B56\u7565\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1497\/001\/"},{"id":"T1497.002","name":"\u57FA\u4E8E\u7528\u6237\u6D3B\u52A8\u7684\u68C0\u67E5","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u591A\u79CD\u7528\u6237\u6D3B\u52A8\u68C0\u67E5\u624B\u6BB5\uFF0C\u4EE5\u63A2\u6D4B\u5E76\u89C4\u907F\u865A\u62DF\u5316\u4E0E\u5206\u6790\u73AF\u5883\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u6839\u636E\u68C0\u6D4B\u865A\u62DF\u673A\u73AF\u5883\uFF08VME\uFF09\u6216\u6C99\u7BB1\u5B58\u5728\u8FF9\u8C61\u7684\u7ED3\u679C\u6765\u6539\u53D8\u884C\u4E3A\u6A21\u5F0F\u3002\u4E00\u65E6\u5BF9\u624B\u68C0\u6D4B\u5230\u865A\u62DF\u673A\u73AF\u5883\uFF0C\u4ED6\u4EEC\u53EF\u80FD\u4F1A\u4FEE\u6539\u6076\u610F\u8F6F\u4EF6\uFF0C\u4F7F\u5176\u8131\u79BB\u53D7\u5BB3\u8005\u6216\u9690\u85CF\u690D\u5165\u7269\u7684\u6838\u5FC3\u529F\u80FD\u3002\u5728\u91CA\u653E\u6B21\u8981\u6216\u989D\u5916\u8F7D\u8377\u4E4B\u524D\uFF0C\u4ED6\u4EEC\u4E5F\u53EF\u80FD\u5148\u641C\u5BFB\u865A\u62DF\u673A\u73AF\u5883\u7684\u75D5\u8FF9\u3002\u5BF9\u624B\u53EF\u4EE5\u5229\u7528\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u4ECE\u865A\u62DF\u5316\/\u6C99\u7BB1\u89C4\u907F\u4E2D\u5B66\u5230\u7684\u4FE1\u606F\uFF0C\u6765\u8C03\u6574\u540E\u7EED\u7684\u884C\u4E3A\u7B56\u7565\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1497\/002\/"},{"id":"T1497.003","name":"\u57FA\u4E8E\u65F6\u95F4\u7684\u68C0\u67E5","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u591A\u79CD\u57FA\u4E8E\u65F6\u95F4\u7684\u65B9\u6CD5\u6765\u68C0\u6D4B\u865A\u62DF\u5316\u548C\u5206\u6790\u73AF\u5883\uFF0C\u5C24\u5176\u662F\u90A3\u4E9B\u8BD5\u56FE\u64CD\u7EB5\u65F6\u95F4\u673A\u5236\u4EE5\u6A21\u62DF\u66F4\u957F\u65F6\u95F4\u6D41\u901D\u7684\u73AF\u5883\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u679A\u4E3E\u57FA\u4E8E\u65F6\u95F4\u7684\u5C5E\u6027\uFF0C\u5982\u8FD0\u884C\u65F6\u95F4\u6216\u7CFB\u7EDF\u65F6\u949F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1497\/003\/"},{"id":"T1497","name":"\u865A\u62DF\u5316\/\u6C99\u7BB1\u9003\u9038","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u591A\u79CD\u624B\u6BB5\u6765\u68C0\u6D4B\u548C\u89C4\u907F\u865A\u62DF\u5316\u4E0E\u5206\u6790\u73AF\u5883\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u6839\u636E\u68C0\u67E5\u662F\u5426\u5B58\u5728\u865A\u62DF\u673A\u73AF\u5883\uFF08VME\uFF09\u6216\u6C99\u7BB1\u7684\u8FF9\u8C61\u6765\u6539\u53D8\u884C\u4E3A\u3002\u5982\u679C\u5BF9\u624B\u68C0\u6D4B\u5230VME\uFF0C\u4ED6\u4EEC\u53EF\u80FD\u4F1A\u4FEE\u6539\u5176\u6076\u610F\u8F6F\u4EF6\uFF0C\u4F7F\u5176\u8131\u79BB\u53D7\u5BB3\u8005\u6216\u9690\u85CF\u690D\u5165\u7269\u7684\u6838\u5FC3\u529F\u80FD\u3002\u4ED6\u4EEC\u4E5F\u53EF\u80FD\u5728\u91CA\u653E\u6B21\u8981\u6216\u989D\u5916\u6709\u6548\u8F7D\u8377\u4E4B\u524D\u641C\u7D22VME\u8FF9\u8C61\u3002\u5BF9\u624B\u53EF\u4EE5\u5229\u7528\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u4ECE\u865A\u62DF\u5316\/\u6C99\u7BB1\u89C4\u907F\u4E2D\u5B66\u5230\u7684\u4FE1\u606F\uFF0C\u6765\u8C03\u6574\u540E\u7EED\u7684\u884C\u4E3A\u6A21\u5F0F\u3002","sub-techniques":"T1497.001, T1497.002, T1497.003","tactic":"\u9632\u5FA1\u89C4\u907F,\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1497\/"},{"id":"T1498.001","name":"\u76F4\u63A5\u7F51\u7EDC\u6CDB\u6D2A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u76F4\u63A5\u5411\u76EE\u6807\u53D1\u9001\u5927\u91CF\u7F51\u7EDC\u6D41\u91CF\u6765\u5F15\u53D1\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u3002\u8FD9\u79CDDoS\u653B\u51FB\u8FD8\u53EF\u80FD\u964D\u4F4E\u76EE\u6807\u7CFB\u7EDF\u548C\u7F51\u7EDC\u7684\u53EF\u7528\u6027\u4E0E\u529F\u80FD\u3002\u76F4\u63A5\u7F51\u7EDC\u6D2A\u6CDB\u662F\u6307\u5229\u7528\u4E00\u4E2A\u6216\u591A\u4E2A\u7CFB\u7EDF\u5411\u76EE\u6807\u670D\u52A1\u7684\u7F51\u7EDC\u53D1\u9001\u5927\u91CF\u7F51\u7EDC\u6570\u636E\u5305\u3002\u51E0\u4E4E\u4EFB\u4F55\u7F51\u7EDC\u534F\u8BAE\u90FD\u53EF\u7528\u4E8E\u6D2A\u6CDB\u653B\u51FB\uFF0C\u65E0\u72B6\u6001\u534F\u8BAE\u5982UDP\u6216ICMP\u8F83\u4E3A\u5E38\u7528\uFF0C\u4F46TCP\u7B49\u6709\u72B6\u6001\u534F\u8BAE\u540C\u6837\u53EF\u80FD\u88AB\u5229\u7528\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1498\/001\/"},{"id":"T1498.002","name":"\u53CD\u5C04\u653E\u5927","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u5411\u76EE\u6807\u53CD\u5C04\u5927\u91CF\u7F51\u7EDC\u6D41\u91CF\u6765\u5F15\u53D1\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u3002\u8FD9\u79CD\u7F51\u7EDCDoS\u5229\u7528\u7B2C\u4E09\u65B9\u670D\u52A1\u5668\u4F5C\u4E3A\u4E2D\u4ECB\uFF0C\u8BE5\u670D\u52A1\u5668\u6258\u7BA1\u5E76\u4F1A\u54CD\u5E94\u7279\u5B9A\u7684\u4F2A\u9020\u6E90IP\u5730\u5740\u3002\u8FD9\u7C7B\u7B2C\u4E09\u65B9\u670D\u52A1\u5668\u901A\u5E38\u88AB\u79F0\u4E3A\u53CD\u5C04\u5668\u3002\u653B\u51FB\u8005\u901A\u8FC7\u5411\u53CD\u5C04\u5668\u53D1\u9001\u5E26\u6709\u53D7\u5BB3\u8005\u4F2A\u9020\u5730\u5740\u7684\u6570\u636E\u5305\u6765\u5B9E\u73B0\u53CD\u5C04\u653B\u51FB\u3002\u4E0E\u76F4\u63A5\u7F51\u7EDC\u6D2A\u6CDB\u7C7B\u4F3C\uFF0C\u653B\u51FB\u53EF\u80FD\u4F7F\u7528\u591A\u4E2A\u7CFB\u7EDF\u8FDB\u884C\uFF0C\u6216\u5229\u7528\u50F5\u5C38\u7F51\u7EDC\u3002\u540C\u6837\uFF0C\u53EF\u80FD\u4F7F\u7528\u4E00\u4E2A\u6216\u591A\u4E2A\u53CD\u5C04\u5668\u5C06\u6D41\u91CF\u96C6\u4E2D\u5230\u76EE\u6807\u4E0A\u3002\u8FD9\u79CD\u7F51\u7EDCDoS\u653B\u51FB\u8FD8\u53EF\u80FD\u964D\u4F4E\u76EE\u6807\u7CFB\u7EDF\u548C\u7F51\u7EDC\u7684\u53EF\u7528\u6027\u4E0E\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1498\/002\/"},{"id":"T1498","name":"\u7F51\u7EDC\u62D2\u7EDD\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5B9E\u65BD\u7F51\u7EDC\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u653B\u51FB\uFF0C\u4EE5\u964D\u4F4E\u6216\u963B\u65AD\u7528\u6237\u5BF9\u76EE\u6807\u8D44\u6E90\u7684\u8BBF\u95EE\u3002\u7F51\u7EDCDoS\u53EF\u901A\u8FC7\u8017\u5C3D\u670D\u52A1\u6240\u4F9D\u8D56\u7684\u7F51\u7EDC\u5E26\u5BBD\u6765\u5B9E\u73B0\u3002\u5178\u578B\u76EE\u6807\u8D44\u6E90\u5305\u62EC\u7279\u5B9A\u7F51\u7AD9\u3001\u7535\u5B50\u90AE\u4EF6\u670D\u52A1\u3001\u57DF\u540D\u7CFB\u7EDF\u53CA\u57FA\u4E8E\u7F51\u7EDC\u7684\u5E94\u7528\u7A0B\u5E8F\u3002\u636E\u89C2\u5BDF\uFF0C\u653B\u51FB\u8005\u51FA\u4E8E\u653F\u6CBB\u76EE\u7684\u6216\u4E3A\u652F\u6301\u5176\u4ED6\u6076\u610F\u6D3B\u52A8\uFF08\u5305\u62EC\u5E72\u6270\u8F6C\u79FB\u3001\u9ED1\u5BA2\u884C\u52A8\u4E3B\u4E49\u53CA\u6572\u8BC8\u52D2\u7D22\uFF09\u800C\u53D1\u8D77\u7F51\u7EDCDoS\u653B\u51FB\u3002","sub-techniques":"T1498.001, T1498.002","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1498\/"},{"id":"T1499.001","name":"\u64CD\u4F5C\u7CFB\u7EDF\u8D44\u6E90\u8017\u5C3D\u6D2A\u6C34\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u7EC8\u7AEF\u64CD\u4F5C\u7CFB\u7EDF\uFF08OS\uFF09\u53D1\u8D77\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u653B\u51FB\u3002\u64CD\u4F5C\u7CFB\u7EDF\u7684\u6838\u5FC3\u804C\u8D23\u5728\u4E8E\u7BA1\u7406\u6709\u9650\u8D44\u6E90\uFF0C\u5E76\u9632\u6B62\u6574\u4E2A\u7CFB\u7EDF\u56E0\u8D85\u51FA\u5176\u5904\u7406\u80FD\u529B\u7684\u8FC7\u5EA6\u9700\u6C42\u800C\u5D29\u6E83\u3002\u6B64\u7C7B\u653B\u51FB\u65E0\u9700\u8017\u5C3D\u7CFB\u7EDF\u7684\u5B9E\u9645\u8D44\u6E90\uFF1B\u4EC5\u9700\u8017\u5C3D\u64CD\u4F5C\u7CFB\u7EDF\u81EA\u8EAB\u8BBE\u5B9A\u7684\u9650\u5236\u4E0E\u53EF\u7528\u8D44\u6E90\u5373\u53EF\u8FBE\u6210\u76EE\u7684\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1499\/001\/"},{"id":"T1499.002","name":"\u670D\u52A1\u8017\u5C3D\u6CDB\u6EE5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u7CFB\u7EDF\u63D0\u4F9B\u7684\u4E0D\u540C\u7F51\u7EDC\u670D\u52A1\u53D1\u8D77\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u653B\u51FB\u3002\u4ED6\u4EEC\u5E38\u4EE5DNS\u548C\u7F51\u7EDC\u670D\u52A1\u7684\u53EF\u7528\u6027\u4E3A\u76EE\u6807\uFF0C\u4F46\u5176\u4ED6\u670D\u52A1\u540C\u6837\u53EF\u80FD\u906D\u53D7\u653B\u51FB\u3002\u7F51\u7EDC\u670D\u52A1\u5668\u8F6F\u4EF6\u53EF\u901A\u8FC7\u591A\u79CD\u65B9\u5F0F\u88AB\u653B\u51FB\uFF0C\u5176\u4E2D\u4E00\u4E9B\u653B\u51FB\u624B\u6BB5\u5177\u6709\u666E\u904D\u9002\u7528\u6027\uFF0C\u53E6\u4E00\u4E9B\u5219\u4E13\u95E8\u9488\u5BF9\u63D0\u4F9B\u670D\u52A1\u7684\u7279\u5B9A\u8F6F\u4EF6\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1499\/002\/"},{"id":"T1499.003","name":"\u5E94\u7528\u8D44\u6E90\u8017\u5C3D\u6CDB\u6EE5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u5E94\u7528\u7A0B\u5E8F\u4E2D\u8D44\u6E90\u5BC6\u96C6\u578B\u529F\u80FD\u53D1\u8D77\u653B\u51FB\uFF0C\u5BFC\u81F4\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\uFF0C\u4F7F\u8FD9\u4E9B\u5E94\u7528\u7A0B\u5E8F\u65E0\u6CD5\u6B63\u5E38\u4F7F\u7528\u3002\u4F8B\u5982\uFF0CWeb\u5E94\u7528\u7A0B\u5E8F\u4E2D\u7684\u67D0\u4E9B\u7279\u5B9A\u529F\u80FD\u53EF\u80FD\u5BF9\u8D44\u6E90\u6D88\u8017\u6781\u5927\u3002\u5BF9\u8FD9\u4E9B\u529F\u80FD\u53D1\u8D77\u91CD\u590D\u8BF7\u6C42\uFF0C\u53EF\u80FD\u5BFC\u81F4\u7CFB\u7EDF\u8D44\u6E90\u8017\u5C3D\uFF0C\u4ECE\u800C\u4F7F\u7528\u6237\u65E0\u6CD5\u8BBF\u95EE\u8BE5\u5E94\u7528\u7A0B\u5E8F\u6216\u670D\u52A1\u5668\u672C\u8EAB\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1499\/003\/"},{"id":"T1499.004","name":"\u5E94\u7528\u7A0B\u5E8F\u6216\u7CFB\u7EDF\u5229\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8F6F\u4EF6\u6F0F\u6D1E\u5BFC\u81F4\u5E94\u7528\u7A0B\u5E8F\u6216\u7CFB\u7EDF\u5D29\u6E83\uFF0C\u4ECE\u800C\u62D2\u7EDD\u5411\u7528\u6237\u63D0\u4F9B\u670D\u52A1\u3002\u5C3D\u7BA1\u67D0\u4E9B\u7CFB\u7EDF\u5728\u53D1\u751F\u5D29\u6E83\u65F6\u4F1A\u81EA\u52A8\u91CD\u542F\u5173\u952E\u5E94\u7528\u7A0B\u5E8F\u548C\u670D\u52A1\uFF0C\u4F46\u8FD9\u4E9B\u6F0F\u6D1E\u5F88\u53EF\u80FD\u88AB\u53CD\u590D\u5229\u7528\uFF0C\u4EE5\u9020\u6210\u6301\u7EED\u7684\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u72B6\u6001\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1499\/004\/"},{"id":"T1499","name":"\u7AEF\u70B9\u62D2\u7EDD\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7EC8\u7AEF\u62D2\u7EDD\u670D\u52A1\uFF08DoS\uFF09\u653B\u51FB\u6765\u964D\u4F4E\u6216\u963B\u65AD\u7528\u6237\u5BF9\u670D\u52A1\u7684\u53EF\u7528\u6027\u3002\u7EC8\u7AEFDoS\u653B\u51FB\u53EF\u901A\u8FC7\u8017\u5C3D\u6258\u7BA1\u670D\u52A1\u7684\u7CFB\u7EDF\u8D44\u6E90\uFF0C\u6216\u5229\u7528\u7CFB\u7EDF\u6F0F\u6D1E\u5F15\u53D1\u6301\u7EED\u5D29\u6E83\u72B6\u6001\u6765\u5B9E\u73B0\u3002\u6B64\u7C7B\u653B\u51FB\u7684\u76EE\u6807\u670D\u52A1\u5305\u62EC\u7F51\u7AD9\u3001\u7535\u5B50\u90AE\u4EF6\u670D\u52A1\u3001DNS\u4EE5\u53CA\u57FA\u4E8E\u7F51\u7EDC\u7684\u5E94\u7528\u7A0B\u5E8F\u3002\u636E\u89C2\u5BDF\uFF0C\u653B\u51FB\u8005\u51FA\u4E8E\u653F\u6CBB\u76EE\u7684\u6216\u4E3A\u652F\u6301\u5176\u4ED6\u6076\u610F\u6D3B\u52A8\uFF08\u5982\u5E72\u6270\u3001\u9ED1\u5BA2\u884C\u52A8\u4E3B\u4E49\u53CA\u6572\u8BC8\u52D2\u7D22\uFF09\u800C\u5B9E\u65BDDoS\u653B\u51FB\u3002","sub-techniques":"T1499.001, T1499.002, T1499.003, T1499.004","tactic":"\u5F71\u54CD","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1499\/"},{"id":"T1505.001","name":"SQL \u5B58\u50A8\u8FC7\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528SQL\u5B58\u50A8\u8FC7\u7A0B\u6765\u5EFA\u7ACB\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002SQL\u5B58\u50A8\u8FC7\u7A0B\u662F\u4E00\u79CD\u53EF\u4FDD\u5B58\u5E76\u91CD\u590D\u4F7F\u7528\u7684\u4EE3\u7801\uFF0C\u65E8\u5728\u5E2E\u52A9\u6570\u636E\u5E93\u7528\u6237\u907F\u514D\u91CD\u590D\u7F16\u5199\u5E38\u7528SQL\u67E5\u8BE2\u3002\u5B58\u50A8\u8FC7\u7A0B\u53EF\u901A\u8FC7\u5411\u6570\u636E\u5E93\u53D1\u9001\u5305\u542B\u8FC7\u7A0B\u540D\u7684SQL\u8BED\u53E5\u6765\u8C03\u7528\uFF0C\u6216\u901A\u8FC7\u9884\u5B9A\u4E49\u7684\u4E8B\u4EF6\uFF08\u4F8B\u5982SQL\u670D\u52A1\u5668\u5E94\u7528\u7A0B\u5E8F\u542F\u52A8\u6216\u91CD\u542F\u65F6\uFF09\u81EA\u52A8\u89E6\u53D1\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/001\/"},{"id":"T1505.002","name":"\u8FD0\u8F93\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5FAE\u8F6F\u4F20\u8F93\u4EE3\u7406\u6765\u5EFA\u7ACB\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u5FAE\u8F6FExchange\u4F20\u8F93\u4EE3\u7406\u80FD\u591F\u5728\u90AE\u4EF6\u901A\u8FC7\u4F20\u8F93\u7BA1\u9053\u65F6\u5BF9\u5176\u8FDB\u884C\u64CD\u4F5C\uFF0C\u6267\u884C\u591A\u79CD\u4EFB\u52A1\uFF0C\u5982\u8FC7\u6EE4\u5783\u573E\u90AE\u4EF6\u3001\u62E6\u622A\u6076\u610F\u9644\u4EF6\u3001\u8FDB\u884C\u90AE\u4EF6\u5F52\u6863\u6216\u5728\u6240\u6709\u5916\u53D1\u90AE\u4EF6\u672B\u5C3E\u6DFB\u52A0\u516C\u53F8\u7B7E\u540D\u3002\u5E94\u7528\u7A0B\u5E8F\u5F00\u53D1\u8005\u53EF\u4EE5\u7F16\u5199\u4F20\u8F93\u4EE3\u7406\uFF0C\u5E76\u5C06\u5176\u7F16\u8BD1\u4E3A.NET\u7A0B\u5E8F\u96C6\uFF0C\u968F\u540E\u5728Exchange\u670D\u52A1\u5668\u4E0A\u6CE8\u518C\u3002\u4F20\u8F93\u4EE3\u7406\u4F1A\u5728\u90AE\u4EF6\u5904\u7406\u7684\u7279\u5B9A\u9636\u6BB5\u88AB\u8C03\u7528\uFF0C\u5E76\u6267\u884C\u5F00\u53D1\u8005\u5B9A\u4E49\u7684\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/002\/"},{"id":"T1505.003","name":"Web Shell","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728Web\u670D\u52A1\u5668\u4E0A\u690D\u5165Web Shell\u540E\u95E8\uFF0C\u4EE5\u5EFA\u7ACB\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002Web Shell\u662F\u4E00\u79CD\u653E\u7F6E\u5728\u53EF\u516C\u5F00\u8BBF\u95EE\u7684Web\u670D\u52A1\u5668\u4E0A\u7684Web\u811A\u672C\uFF0C\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u4EE5\u8BE5Web\u670D\u52A1\u5668\u4E3A\u8DF3\u677F\u8FDB\u5165\u7F51\u7EDC\u3002Web Shell\u53EF\u80FD\u63D0\u4F9B\u4E00\u7CFB\u5217\u53EF\u6267\u884C\u529F\u80FD\uFF0C\u6216\u5728\u6258\u7BA1Web\u670D\u52A1\u5668\u7684\u7CFB\u7EDF\u4E0A\u63D0\u4F9B\u547D\u4EE4\u884C\u63A5\u53E3\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/003\/"},{"id":"T1505.004","name":"IIS \u7EC4\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u4E92\u8054\u7F51\u4FE1\u606F\u670D\u52A1\uFF08IIS\uFF09\u7F51\u7EDC\u670D\u52A1\u5668\u4E0A\u5B89\u88C5\u6076\u610F\u7EC4\u4EF6\u4EE5\u5EFA\u7ACB\u6301\u4E45\u6027\u3002IIS\u63D0\u4F9B\u4E86\u591A\u79CD\u673A\u5236\u6765\u6269\u5C55\u7F51\u7EDC\u670D\u52A1\u5668\u7684\u529F\u80FD\u3002\u4F8B\u5982\uFF0C\u53EF\u4EE5\u5B89\u88C5\u4E92\u8054\u7F51\u670D\u52A1\u5668\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08ISAPI\uFF09\u6269\u5C55\u548C\u8FC7\u6EE4\u5668\uFF0C\u4EE5\u68C0\u67E5\u53CA\/\u6216\u4FEE\u6539\u4F20\u5165\u548C\u4F20\u51FA\u7684IIS\u7F51\u7EDC\u8BF7\u6C42\u3002\u6269\u5C55\u548C\u8FC7\u6EE4\u5668\u4EE5DLL\u6587\u4EF6\u5F62\u5F0F\u90E8\u7F72\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u5BFC\u51FA\u4E09\u4E2A\u51FD\u6570\uFF1AGet{Extension\/Filter}Version\u3001Http{Extension\/Filter}Proc\u4EE5\u53CA\uFF08\u53EF\u9009\uFF09Terminate{Extension\/Filter}\u3002\u6B64\u5916\uFF0C\u8FD8\u53EF\u4EE5\u5B89\u88C5IIS\u6A21\u5757\u6765\u6269\u5C55IIS\u7F51\u7EDC\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/004\/"},{"id":"T1505.005","name":"\u7EC8\u7AEF\u670D\u52A1\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7EC8\u7AEF\u670D\u52A1\u7684\u7EC4\u4EF6\u6765\u5B9E\u73B0\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u5FAE\u8F6F\u7EC8\u7AEF\u670D\u52A1\uFF08\u81EA2022\u5E74\u8D77\u5728\u67D0\u4E9BWindows Server\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u66F4\u540D\u4E3A\u8FDC\u7A0B\u684C\u9762\u670D\u52A1\uFF09\u652F\u6301\u8FDC\u7A0B\u7EC8\u7AEF\u8FDE\u63A5\u5230\u4E3B\u673A\u3002\u7EC8\u7AEF\u670D\u52A1\u5141\u8BB8\u670D\u52A1\u5668\u901A\u8FC7RDP\u5411\u5BA2\u6237\u7AEF\u4F20\u8F93\u5B8C\u6574\u7684\u4EA4\u4E92\u5F0F\u56FE\u5F62\u7528\u6237\u754C\u9762\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/005\/"},{"id":"T1505.006","name":"vSphere \u5B89\u88C5\u6346\u7ED1\u5305","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528vSphere\u5B89\u88C5\u5305\uFF08VIB\uFF09\u6765\u5EFA\u7ACB\u5BF9ESXi\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u7684\u6301\u4E45\u8BBF\u95EE\u3002VIB\u662FVMware\u73AF\u5883\u4E2D\u7528\u4E8E\u8F6F\u4EF6\u5206\u53D1\u548C\u865A\u62DF\u7CFB\u7EDF\u7BA1\u7406\u7684\u6587\u4EF6\u96C6\u5408\u3002\u7531\u4E8EESXi\u4F7F\u7528\u5185\u5B58\u6587\u4EF6\u7CFB\u7EDF\uFF0C\u5BF9\u5927\u591A\u6570\u6587\u4EF6\u7684\u4FEE\u6539\u5B58\u50A8\u5728RAM\u800C\u975E\u6301\u4E45\u5B58\u50A8\u4E2D\uFF0C\u8FD9\u4E9B\u66F4\u6539\u5728\u91CD\u542F\u540E\u4F1A\u4E22\u5931\u3002\u7136\u800C\uFF0CVIB\u53EF\u7528\u4E8E\u521B\u5EFA\u542F\u52A8\u4EFB\u52A1\u3001\u5E94\u7528\u81EA\u5B9A\u4E49\u9632\u706B\u5899\u89C4\u5219\u6216\u90E8\u7F72\u5728\u91CD\u542F\u540E\u4ECD\u80FD\u4FDD\u7559\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002\u901A\u5E38\uFF0C\u7BA1\u7406\u5458\u4F7F\u7528VIB\u8FDB\u884C\u66F4\u65B0\u548C\u7CFB\u7EDF\u7EF4\u62A4\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"ESXi","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/006\/"},{"id":"T1505","name":"\u670D\u52A1\u5668\u8F6F\u4EF6\u7EC4\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u670D\u52A1\u5668\u5408\u6CD5\u7684\u53EF\u6269\u5C55\u5F00\u53D1\u7279\u6027\uFF0C\u4EE5\u5EFA\u7ACB\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u6743\u9650\u3002\u4F01\u4E1A\u7EA7\u670D\u52A1\u5668\u5E94\u7528\u7A0B\u5E8F\u901A\u5E38\u5305\u542B\u5141\u8BB8\u5F00\u53D1\u8005\u7F16\u5199\u5E76\u5B89\u88C5\u8F6F\u4EF6\u6216\u811A\u672C\u4EE5\u6269\u5C55\u4E3B\u5E94\u7528\u529F\u80FD\u7684\u8BBE\u8BA1\u3002\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5B89\u88C5\u6076\u610F\u7EC4\u4EF6\u6765\u6269\u5C55\u5E76\u6EE5\u7528\u8FD9\u4E9B\u670D\u52A1\u5668\u5E94\u7528\u7A0B\u5E8F\u3002","sub-techniques":"T1505.001, T1505.002, T1505.003, T1505.004, T1505.005, T1505.006","tactic":"\u575A\u6301","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1505\/"},{"id":"T1518.001","name":"\u5B89\u5168\u8F6F\u4EF6\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u5B89\u88C5\u5728\u7CFB\u7EDF\u6216\u4E91\u73AF\u5883\u4E2D\u7684\u5B89\u5168\u8F6F\u4EF6\u3001\u914D\u7F6E\u3001\u9632\u5FA1\u5DE5\u5177\u548C\u4F20\u611F\u5668\u7684\u6E05\u5355\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u4E91\u76D1\u63A7\u4EE3\u7406\u548C\u9632\u75C5\u6BD2\u8F6F\u4EF6\u7B49\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u5229\u7528\u5B89\u5168\u8F6F\u4EF6\u53D1\u73B0\u7684\u4FE1\u606F\uFF0C\u4EE5\u89C4\u5212\u540E\u7EED\u884C\u4E3A\uFF0C\u5305\u62EC\u662F\u5426\u5B8C\u5168\u611F\u67D3\u76EE\u6807\u7CFB\u7EDF\uFF0C\u4EE5\u53CA\u662F\u5426\u5C1D\u8BD5\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1518\/001\/"},{"id":"T1518.002","name":"\u5907\u4EFD\u8F6F\u4EF6\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u5B89\u88C5\u5728\u7CFB\u7EDF\u4E0A\u7684\u5907\u4EFD\u8F6F\u4EF6\u6216\u914D\u7F6E\u5217\u8868\u3002\u4ED6\u4EEC\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u4FE1\u606F\u6765\u89C4\u5212\u540E\u7EED\u884C\u4E3A\uFF0C\u4F8B\u5982\u6570\u636E\u9500\u6BC1\u3001\u963B\u6B62\u7CFB\u7EDF\u6062\u590D\u6216\u4E3A\u9020\u6210\u5F71\u54CD\u800C\u52A0\u5BC6\u6570\u636E\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1518\/002\/"},{"id":"T1518","name":"\u8F6F\u4EF6\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u83B7\u53D6\u7CFB\u7EDF\u6216\u4E91\u73AF\u5883\u4E2D\u5B89\u88C5\u7684\u8F6F\u4EF6\u53CA\u5176\u7248\u672C\u5217\u8868\u3002\u5728\u81EA\u52A8\u5316\u4FA6\u5BDF\u8FC7\u7A0B\u4E2D\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8F6F\u4EF6\u53D1\u73B0\u6240\u83B7\u5F97\u7684\u4FE1\u606F\u6765\u8C03\u6574\u540E\u7EED\u653B\u51FB\u884C\u4E3A\uFF0C\u5305\u62EC\u51B3\u5B9A\u662F\u5426\u5BF9\u76EE\u6807\u5B9E\u65BD\u5168\u9762\u611F\u67D3\uFF0C\u4EE5\u53CA\u662F\u5426\u5C1D\u8BD5\u6267\u884C\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"T1518.001, T1518.002","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1518\/"},{"id":"T1525","name":"\u690D\u5165\u5185\u90E8\u56FE\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u83B7\u53D6\u73AF\u5883\u8BBF\u95EE\u6743\u9650\u540E\uFF0C\u5C06\u6076\u610F\u4EE3\u7801\u690D\u5165\u4E91\u6216\u5BB9\u5668\u955C\u50CF\u4E2D\u4EE5\u5EFA\u7ACB\u6301\u4E45\u5316\u63A7\u5236\u3002\u65E0\u8BBA\u662F\u4E9A\u9A6C\u900A\u7F51\u7EDC\u670D\u52A1\uFF08AWS\uFF09\u7684\u4E9A\u9A6C\u900A\u673A\u5668\u955C\u50CF\uFF08AMI\uFF09\u3001\u8C37\u6B4C\u4E91\u5E73\u53F0\uFF08GCP\uFF09\u955C\u50CF\u3001Azure\u955C\u50CF\uFF0C\u8FD8\u662FDocker\u7B49\u4E3B\u6D41\u5BB9\u5668\u8FD0\u884C\u65F6\u73AF\u5883\uFF0C\u5747\u53EF\u80FD\u88AB\u690D\u5165\u540E\u95E8\u3002\u4E0E\u76F4\u63A5\u4E0A\u4F20\u6076\u610F\u8F6F\u4EF6\u4E0D\u540C\uFF0C\u6B64\u6280\u672F\u4FA7\u91CD\u4E8E\u653B\u51FB\u8005\u5728\u53D7\u5BB3\u8005\u7684\u73AF\u5883\u5185\u90E8\u6CE8\u518C\u8868\u4E2D\u690D\u5165\u955C\u50CF\u3002\u6839\u636E\u57FA\u7840\u8BBE\u65BD\u7684\u914D\u7F6E\u65B9\u5F0F\uFF0C\u5982\u679C\u57FA\u7840\u8BBE\u65BD\u914D\u7F6E\u5DE5\u5177\u88AB\u8BBE\u5B9A\u4E3A\u59CB\u7EC8\u4F7F\u7528\u6700\u65B0\u955C\u50CF\uFF0C\u8FD9\u5C06\u4E3A\u653B\u51FB\u8005\u63D0\u4F9B\u6301\u4E45\u8BBF\u95EE\u9014\u5F84\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1525\/"},{"id":"T1526","name":"\u4E91\u670D\u52A1\u53D1\u73B0","description":"\u653B\u51FB\u8005\u5728\u83B7\u53D6\u7CFB\u7EDF\u8BBF\u95EE\u6743\u9650\u540E\uFF0C\u53EF\u80FD\u4F1A\u5C1D\u8BD5\u679A\u4E3E\u5176\u4E0A\u8FD0\u884C\u7684\u4E91\u670D\u52A1\u3002\u8FD9\u4E9B\u65B9\u6CD5\u53EF\u80FD\u56E0\u5E73\u53F0\u5373\u670D\u52A1\uFF08PaaS\uFF09\u3001\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1\uFF08IaaS\uFF09\u6216\u8F6F\u4EF6\u5373\u670D\u52A1\uFF08SaaS\uFF09\u800C\u5F02\u3002\u5404\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u4E2D\u5B58\u5728\u591A\u79CD\u670D\u52A1\uFF0C\u5305\u62EC\u6301\u7EED\u96C6\u6210\u4E0E\u6301\u7EED\u4EA4\u4ED8\uFF08CI\/CD\uFF09\u3001Lambda\u51FD\u6570\u3001Entra ID\u7B49\u3002\u8FD8\u53EF\u80FD\u6D89\u53CA\u5B89\u5168\u670D\u52A1\uFF0C\u5982AWS GuardDuty\u548CMicrosoft Defender for Cloud\uFF0C\u4EE5\u53CA\u65E5\u5FD7\u670D\u52A1\uFF0C\u5982AWS CloudTrail\u548CGoogle Cloud\u5BA1\u8BA1\u65E5\u5FD7\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1526\/"},{"id":"T1528","name":"\u7A83\u53D6\u5E94\u7528\u7A0B\u5E8F\u8BBF\u95EE\u4EE4\u724C","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u901A\u8FC7\u7A83\u53D6\u5E94\u7528\u7A0B\u5E8F\u8BBF\u95EE\u4EE4\u724C\u6765\u83B7\u53D6\u51ED\u8BC1\uFF0C\u8FDB\u800C\u8BBF\u95EE\u8FDC\u7A0B\u7CFB\u7EDF\u548C\u8D44\u6E90\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1528\/"},{"id":"T1529","name":"\u7CFB\u7EDF\u5173\u673A\/\u91CD\u542F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5173\u95ED\u6216\u91CD\u542F\u7CFB\u7EDF\u6765\u4E2D\u65AD\u5BF9\u8FD9\u4E9B\u7CFB\u7EDF\u7684\u8BBF\u95EE\uFF0C\u6216\u534F\u52A9\u7834\u574F\u8FD9\u4E9B\u7CFB\u7EDF\u3002\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u5305\u542B\u7528\u4E8E\u542F\u52A8\u673A\u5668\u6216\u7F51\u7EDC\u8BBE\u5907\u5173\u673A\/\u91CD\u542F\u7684\u547D\u4EE4\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u8FD9\u4E9B\u547D\u4EE4\u4E5F\u53EF\u7528\u4E8E\u901A\u8FC7\u7F51\u7EDC\u8BBE\u5907\u547D\u4EE4\u884C\u754C\u9762\uFF08\u4F8B\u5982\u91CD\u65B0\u52A0\u8F7D\u547D\u4EE4\uFF09\u8FDC\u7A0B\u542F\u52A8\u8BA1\u7B97\u673A\u6216\u7F51\u7EDC\u8BBE\u5907\u7684\u5173\u673A\/\u91CD\u542F\u64CD\u4F5C\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u901A\u8FC7\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u3001\u4E91\u63A7\u5236\u53F0\u6216\u547D\u4EE4\u884C\u5DE5\u5177\u5BF9\u865A\u62DF\u673A\u6267\u884C\u5173\u673A\/\u91CD\u542F\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1529\/"},{"id":"T1530","name":"\u6765\u81EA\u4E91\u5B58\u50A8\u7684\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u4E91\u5B58\u50A8\u4E2D\u83B7\u53D6\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1530\/"},{"id":"T1531","name":"\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u79FB\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u963B\u6B62\u5408\u6CD5\u7528\u6237\u8BBF\u95EE\u5176\u8D26\u6237\u6765\u4E2D\u65AD\u7CFB\u7EDF\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002\u4ED6\u4EEC\u53EF\u80FD\u5220\u9664\u3001\u9501\u5B9A\u6216\u64CD\u7EB5\u8D26\u6237\uFF08\u4F8B\u5982\uFF1A\u66F4\u6539\u51ED\u8BC1\u3001\u64A4\u9500Sharepoint\u7B49SaaS\u5E73\u53F0\u7684\u6743\u9650\uFF09\u4EE5\u5265\u593A\u8D26\u6237\u8BBF\u95EE\u6743\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u968F\u540E\u6CE8\u9500\u548C\/\u6216\u6267\u884C\u7CFB\u7EDF\u5173\u673A\/\u91CD\u542F\uFF0C\u4EE5\u4F7F\u6076\u610F\u66F4\u6539\u751F\u6548\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1531\/"},{"id":"T1534","name":"\u5185\u90E8\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C","description":"\u5728\u5DF2\u7ECF\u83B7\u5F97\u73AF\u5883\u5185\u8D26\u6237\u6216\u7CFB\u7EDF\u8BBF\u95EE\u6743\u9650\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5185\u90E8\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u6765\u83B7\u53D6\u989D\u5916\u4FE1\u606F\uFF0C\u6216\u5371\u5BB3\u540C\u4E00\u7EC4\u7EC7\u5185\u7684\u5176\u4ED6\u7528\u6237\u3002\u5185\u90E8\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u662F\u4E00\u79CD\u591A\u9636\u6BB5\u653B\u51FB\u6D3B\u52A8\uFF0C\u653B\u51FB\u8005\u9996\u5148\u901A\u8FC7\u63A7\u5236\u7528\u6237\u8BBE\u5907\u6216\u7A83\u53D6\u7528\u6237\u8D26\u6237\u51ED\u8BC1\u6765\u5165\u4FB5\u5408\u6CD5\u8D26\u6237\u3002\u968F\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u53D7\u4FE1\u4EFB\u7684\u5185\u90E8\u8D26\u6237\uFF0C\u901A\u8FC7\u4F2A\u88C5\u8EAB\u4EFD\u7B49\u624B\u6BB5\u63D0\u9AD8\u9493\u9C7C\u653B\u51FB\u7684\u6210\u529F\u7387\uFF0C\u8BF1\u4F7F\u66F4\u591A\u53D7\u5BB3\u8005\u843D\u5165\u9677\u9631\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1534\/"},{"id":"T1535","name":"\u672A\u4F7F\u7528\/\u4E0D\u53D7\u652F\u6301\u7684\u4E91\u533A\u57DF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u672A\u4F7F\u7528\u7684\u5730\u7406\u670D\u52A1\u533A\u57DF\u521B\u5EFA\u4E91\u5B9E\u4F8B\uFF0C\u4EE5\u89C4\u907F\u68C0\u6D4B\u3002\u901A\u5E38\u901A\u8FC7\u5165\u4FB5\u7528\u4E8E\u7BA1\u7406\u4E91\u57FA\u7840\u8BBE\u65BD\u7684\u8D26\u6237\u6765\u83B7\u53D6\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1535\/"},{"id":"T1537","name":"\u5C06\u6570\u636E\u8F6C\u79FB\u81F3\u4E91\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u6570\u636E\uFF08\u5305\u62EC\u901A\u8FC7\u5171\u4EAB\/\u540C\u6B65\u4EE5\u53CA\u521B\u5EFA\u4E91\u73AF\u5883\u5907\u4EFD\u7684\u65B9\u5F0F\uFF09\u4F20\u8F93\u5230\u540C\u4E00\u670D\u52A1\u4E0A\u7531\u4ED6\u4EEC\u63A7\u5236\u7684\u53E6\u4E00\u4E2A\u4E91\u8D26\u6237\uFF0C\u6765\u5B9E\u73B0\u6570\u636E\u5916\u6CC4\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1537\/"},{"id":"T1538","name":"\u4E91\u670D\u52A1\u4EEA\u8868\u76D8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7A83\u53D6\u7684\u51ED\u8BC1\u901A\u8FC7\u4E91\u670D\u52A1\u4EEA\u8868\u677F\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF0C\u4ECE\u8FD0\u884C\u7684\u4E91\u73AF\u5883\u4E2D\u83B7\u53D6\u6709\u7528\u4FE1\u606F\uFF0C\u4F8B\u5982\u7279\u5B9A\u670D\u52A1\u3001\u8D44\u6E90\u548C\u529F\u80FD\u3002\u4F8B\u5982\uFF0CGCP Command Center\u53EF\u7528\u4E8E\u67E5\u770B\u6240\u6709\u8D44\u4EA7\u3001\u5BA1\u67E5\u6F5C\u5728\u5B89\u5168\u98CE\u9669\u7684\u53D1\u73B0\u7ED3\u679C\uFF0C\u5E76\u8FD0\u884C\u5176\u4ED6\u67E5\u8BE2\uFF0C\u5982\u67E5\u627E\u516C\u5171IP\u5730\u5740\u548C\u5F00\u653E\u7AEF\u53E3\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1538\/"},{"id":"T1539","name":"\u7A83\u53D6\u7F51\u7EDC\u4F1A\u8BDDCookie","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7A83\u53D6\u7F51\u7EDC\u5E94\u7528\u6216\u670D\u52A1\u7684\u4F1A\u8BDDcookie\uFF0C\u5E76\u5229\u7528\u8FD9\u4E9Bcookie\u5728\u65E0\u9700\u51ED\u8BC1\u7684\u60C5\u51B5\u4E0B\uFF0C\u4EE5\u5DF2\u8BA4\u8BC1\u7528\u6237\u7684\u8EAB\u4EFD\u8BBF\u95EE\u7F51\u7EDC\u5E94\u7528\u6216\u4E92\u8054\u7F51\u670D\u52A1\u3002\u7F51\u7EDC\u5E94\u7528\u548C\u670D\u52A1\u901A\u5E38\u5728\u7528\u6237\u5B8C\u6210\u7F51\u7AD9\u8BA4\u8BC1\u540E\uFF0C\u5C06\u4F1A\u8BDDcookie\u7528\u4F5C\u8EAB\u4EFD\u9A8C\u8BC1\u4EE4\u724C\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1539\/"},{"id":"T1542.001","name":"\u7CFB\u7EDF\u56FA\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u7CFB\u7EDF\u56FA\u4EF6\u5728\u7CFB\u7EDF\u4E2D\u5B9E\u73B0\u6301\u4E45\u5316\u9A7B\u7559\u3002\u57FA\u672C\u8F93\u5165\u8F93\u51FA\u7CFB\u7EDF\uFF08BIOS\uFF09\u4E0E\u7EDF\u4E00\u53EF\u6269\u5C55\u56FA\u4EF6\u63A5\u53E3\uFF08UEFI\uFF09\u6216\u53EF\u6269\u5C55\u56FA\u4EF6\u63A5\u53E3\uFF08EFI\uFF09\u4F5C\u4E3A\u8BA1\u7B97\u673A\u64CD\u4F5C\u7CFB\u7EDF\u4E0E\u786C\u4EF6\u95F4\u7684\u8F6F\u4EF6\u63A5\u53E3\uFF0C\u6B63\u662F\u6B64\u7C7B\u7CFB\u7EDF\u56FA\u4EF6\u7684\u5178\u578B\u4EE3\u8868\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/001\/"},{"id":"T1542.002","name":"\u7EC4\u4EF6\u56FA\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u7EC4\u4EF6\u56FA\u4EF6\u5728\u7CFB\u7EDF\u4E2D\u5B9E\u73B0\u6301\u4E45\u5316\u3002\u90E8\u5206\u653B\u51FB\u8005\u4F1A\u91C7\u7528\u590D\u6742\u624B\u6BB5\u5165\u4FB5\u8BA1\u7B97\u673A\u7EC4\u4EF6\uFF0C\u5B89\u88C5\u6076\u610F\u56FA\u4EF6\uFF0C\u4F7F\u5176\u80FD\u591F\u5728\u64CD\u4F5C\u7CFB\u7EDF\u53CA\u4E3B\u7CFB\u7EDF\u56FA\u4EF6\u6216BIOS\u4E4B\u5916\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002\u6B64\u624B\u6CD5\u53EF\u80FD\u4E0E\u7CFB\u7EDF\u56FA\u4EF6\u653B\u51FB\u7C7B\u4F3C\uFF0C\u4F46\u9488\u5BF9\u7684\u662F\u5176\u4ED6\u7CFB\u7EDF\u7EC4\u4EF6\/\u8BBE\u5907\uFF0C\u8FD9\u4E9B\u8BBE\u5907\u53EF\u80FD\u4E0D\u5177\u5907\u540C\u7B49\u7684\u5B89\u5168\u68C0\u6D4B\u80FD\u529B\u6216\u5B8C\u6574\u6027\u9A8C\u8BC1\u673A\u5236\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/002\/"},{"id":"T1542.003","name":"\u5F15\u5BFC\u5DE5\u5177\u5305","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5F15\u5BFC\u5DE5\u5177\u5305\u5728\u7CFB\u7EDF\u4E2D\u5B9E\u73B0\u6301\u4E45\u5316\u3002\u5F15\u5BFC\u5DE5\u5177\u5305\u662F\u4E00\u79CD\u6076\u610F\u8F6F\u4EF6\u53D8\u4F53\uFF0C\u5B83\u4F1A\u4FEE\u6539\u786C\u76D8\u7684\u5F15\u5BFC\u6247\u533A\uFF0C\u4F7F\u5F97\u6076\u610F\u4EE3\u7801\u80FD\u5728\u8BA1\u7B97\u673A\u64CD\u4F5C\u7CFB\u7EDF\u52A0\u8F7D\u4E4B\u524D\u6267\u884C\u3002\u5F15\u5BFC\u5DE5\u5177\u5305\u9A7B\u7559\u5728\u64CD\u4F5C\u7CFB\u7EDF\u4E4B\u4E0B\u7684\u5C42\u7EA7\uFF0C\u9664\u975E\u7EC4\u7EC7\u6000\u7591\u5176\u88AB\u4F7F\u7528\u5E76\u91C7\u53D6\u76F8\u5E94\u63AA\u65BD\uFF0C\u5426\u5219\u53EF\u80FD\u96BE\u4EE5\u8FDB\u884C\u5F7B\u5E95\u4FEE\u590D\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/003\/"},{"id":"T1542.004","name":"ROMMON\u5DE5\u5177\u5305","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528ROM\u76D1\u89C6\u5668\uFF08ROMMON\uFF09\uFF0C\u901A\u8FC7\u52A0\u8F7D\u5E26\u6709\u6076\u610F\u4EE3\u7801\u7684\u672A\u6388\u6743\u56FA\u4EF6\uFF0C\u4EE5\u63D0\u4F9B\u6301\u4E45\u8BBF\u95EE\u6743\u9650\u5E76\u64CD\u63A7\u8BBE\u5907\u884C\u4E3A\uFF0C\u8FD9\u79CD\u884C\u4E3A\u96BE\u4EE5\u88AB\u68C0\u6D4B\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/004\/"},{"id":"T1542.005","name":"TFTP\u542F\u52A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7F51\u7EDC\u5F15\u5BFC\u529F\u80FD\uFF0C\u4ECE\u7B80\u5355\u6587\u4EF6\u4F20\u8F93\u534F\u8BAE\uFF08TFTP\uFF09\u670D\u52A1\u5668\u52A0\u8F7D\u672A\u7ECF\u6388\u6743\u7684\u7F51\u7EDC\u8BBE\u5907\u64CD\u4F5C\u7CFB\u7EDF\u3002\u7F51\u7EDC\u7BA1\u7406\u5458\u901A\u5E38\u4F7F\u7528TFTP\u5F15\u5BFC\uFF08\u7F51\u7EDC\u5F15\u5BFC\uFF09\u4ECE\u96C6\u4E2D\u7BA1\u7406\u670D\u52A1\u5668\u52A0\u8F7D\u53D7\u914D\u7F6E\u63A7\u5236\u7684\u7F51\u7EDC\u8BBE\u5907\u955C\u50CF\u3002\u7F51\u7EDC\u5F15\u5BFC\u662F\u542F\u52A8\u5E8F\u5217\u4E2D\u7684\u4E00\u4E2A\u9009\u9879\uFF0C\u53EF\u7528\u4E8E\u96C6\u4E2D\u7BA1\u7406\u3001\u63A7\u5236\u548C\u5206\u53D1\u8BBE\u5907\u955C\u50CF\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/005\/"},{"id":"T1542","name":"\u9884\u64CD\u4F5C\u7CFB\u7EDF\u542F\u52A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u64CD\u4F5C\u7CFB\u7EDF\u542F\u52A8\u524D\u7684\u673A\u5236\uFF0C\u4EE5\u6B64\u5728\u7CFB\u7EDF\u4E0A\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u5728\u8BA1\u7B97\u673A\u542F\u52A8\u8FC7\u7A0B\u4E2D\uFF0C\u56FA\u4EF6\u548C\u5404\u79CD\u542F\u52A8\u670D\u52A1\u4F1A\u5728\u64CD\u4F5C\u7CFB\u7EDF\u52A0\u8F7D\u4E4B\u524D\u5148\u884C\u542F\u52A8\u3002\u8FD9\u4E9B\u7A0B\u5E8F\u5728\u64CD\u4F5C\u7CFB\u7EDF\u63A5\u7BA1\u63A7\u5236\u6743\u4E4B\u524D\uFF0C\u638C\u63A7\u7740\u6267\u884C\u6D41\u7A0B\u3002","sub-techniques":"T1542.001, T1542.002, T1542.003, T1542.004, T1542.005","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1542\/"},{"id":"T1543.001","name":"\u542F\u52A8\u4EE3\u7406","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\u542F\u52A8\u4EE3\u7406\uFF0C\u4F5C\u4E3A\u6301\u4E45\u5316\u673A\u5236\u7684\u4E00\u90E8\u5206\u53CD\u590D\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u3002\u5F53\u7528\u6237\u767B\u5F55\u65F6\uFF0C\u7CFB\u7EDF\u4F1A\u542F\u52A8\u4E00\u4E2A\u9488\u5BF9\u8BE5\u7528\u6237\u7684launchd\u8FDB\u7A0B\uFF0C\u8BE5\u8FDB\u7A0B\u4ECE\u4F4D\u4E8E`\/System\/Library\/LaunchAgents`\u3001`\/Library\/LaunchAgents`\u548C`~\/Library\/LaunchAgents`\u76EE\u5F55\u7684\u5C5E\u6027\u5217\u8868\uFF08.plist\uFF09\u6587\u4EF6\u4E2D\u52A0\u8F7D\u6BCF\u4E2A\u6309\u9700\u542F\u52A8\u7528\u6237\u4EE3\u7406\u7684\u53C2\u6570\u3002\u5C5E\u6027\u5217\u8868\u6587\u4EF6\u4F7F\u7528Label\u3001ProgramArguments\u548CRunAtLoad\u7B49\u952E\u6765\u6807\u8BC6\u542F\u52A8\u4EE3\u7406\u7684\u540D\u79F0\u3001\u53EF\u6267\u884C\u6587\u4EF6\u4F4D\u7F6E\u548C\u6267\u884C\u65F6\u95F4\u3002\u542F\u52A8\u4EE3\u7406\u901A\u5E38\u88AB\u5B89\u88C5\u7528\u4E8E\u6267\u884C\u7A0B\u5E8F\u66F4\u65B0\u3001\u5728\u767B\u5F55\u65F6\u542F\u52A8\u7528\u6237\u6307\u5B9A\u7A0B\u5E8F\u6216\u6267\u884C\u5176\u4ED6\u5F00\u53D1\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/001\/"},{"id":"T1543.002","name":"Systemd \u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539systemd\u670D\u52A1\uFF0C\u4EE5\u91CD\u590D\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u4F5C\u4E3A\u6301\u4E45\u5316\u624B\u6BB5\u3002Systemd\u662F\u4E00\u79CD\u7CFB\u7EDF\u548C\u670D\u52A1\u7BA1\u7406\u5668\uFF0C\u5E38\u7528\u4E8E\u7BA1\u7406\u540E\u53F0\u5B88\u62A4\u8FDB\u7A0B\uFF08\u4EA6\u79F0\u670D\u52A1\uFF09\u53CA\u5176\u4ED6\u7CFB\u7EDF\u8D44\u6E90\u3002\u4F5C\u4E3A\u8BB8\u591ALinux\u53D1\u884C\u7248\u7684\u9ED8\u8BA4\u521D\u59CB\u5316\uFF08init\uFF09\u7CFB\u7EDF\uFF0Csystemd\u5DF2\u53D6\u4EE3\u4F20\u7EDF\u7684SysVinit\u548CUpstart\u7B49\u521D\u59CB\u5316\u7CFB\u7EDF\uFF0C\u540C\u65F6\u4FDD\u6301\u5411\u540E\u517C\u5BB9\u6027\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/002\/"},{"id":"T1543.003","name":"Windows \u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539Windows\u670D\u52A1\uFF0C\u4EE5\u4FBF\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u91CD\u590D\u6267\u884C\u6076\u610F\u8D1F\u8F7D\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u6301\u4E45\u5316\u624B\u6BB5\u7684\u4E00\u90E8\u5206\u3002\u5F53Windows\u542F\u52A8\u65F6\uFF0C\u5B83\u4F1A\u8FD0\u884C\u79F0\u4E3A\u670D\u52A1\u7684\u7A0B\u5E8F\u6216\u5E94\u7528\u7A0B\u5E8F\uFF0C\u8FD9\u4E9B\u670D\u52A1\u6267\u884C\u540E\u53F0\u7CFB\u7EDF\u529F\u80FD\u3002Windows\u670D\u52A1\u7684\u914D\u7F6E\u4FE1\u606F\uFF0C\u5305\u62EC\u670D\u52A1\u53EF\u6267\u884C\u6587\u4EF6\u6216\u6062\u590D\u7A0B\u5E8F\/\u547D\u4EE4\u7684\u6587\u4EF6\u8DEF\u5F84\uFF0C\u5747\u5B58\u50A8\u5728Windows\u6CE8\u518C\u8868\u4E2D\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/003\/"},{"id":"T1543.004","name":"\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\uFF08Launch Daemons\uFF09\uFF0C\u4EE5\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u4F5C\u4E3A\u6301\u4E45\u5316\u624B\u6BB5\u7684\u4E00\u90E8\u5206\u3002\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\u662F\u7528\u4E8E\u4E0ELaunchd\u4EA4\u4E92\u7684plist\u6587\u4EF6\uFF0CLaunchd\u662FmacOS\u4F7F\u7528\u7684\u670D\u52A1\u7BA1\u7406\u6846\u67B6\u3002\u5B89\u88C5\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\u9700\u8981\u63D0\u5347\u6743\u9650\uFF0C\u5B83\u4EEC\u5728\u7CFB\u7EDF\u767B\u5F55\u524D\u4E3A\u6BCF\u4E2A\u7528\u6237\u6267\u884C\uFF0C\u5E76\u5728\u540E\u53F0\u8FD0\u884C\uFF0C\u65E0\u9700\u7528\u6237\u4EA4\u4E92\u3002\u5728macOS\u521D\u59CB\u5316\u542F\u52A8\u8FC7\u7A0B\u4E2D\uFF0Claunchd\u8FDB\u7A0B\u4ECE\u4F4D\u4E8E\/System\/Library\/LaunchDaemons\/\u548C\/Library\/LaunchDaemons\/\u76EE\u5F55\u4E0B\u7684plist\u6587\u4EF6\u4E2D\u52A0\u8F7D\u6309\u9700\u542F\u52A8\u7684\u7CFB\u7EDF\u7EA7\u5B88\u62A4\u8FDB\u7A0B\u53C2\u6570\u3002\u5FC5\u9700\u7684\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\u53C2\u6570\u5305\u62EC\u7528\u4E8E\u6807\u8BC6\u4EFB\u52A1\u7684Label\u3001\u63D0\u4F9B\u53EF\u6267\u884C\u6587\u4EF6\u8DEF\u5F84\u7684Program\uFF0C\u4EE5\u53CA\u6307\u5B9A\u4EFB\u52A1\u8FD0\u884C\u65F6\u95F4\u7684RunAtLoad\u3002\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\u901A\u5E38\u7528\u4E8E\u63D0\u4F9B\u5BF9\u5171\u4EAB\u8D44\u6E90\u7684\u8BBF\u95EE\u3001\u8F6F\u4EF6\u66F4\u65B0\u6216\u6267\u884C\u81EA\u52A8\u5316\u4EFB\u52A1\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/004\/"},{"id":"T1543.005","name":"\u5BB9\u5668\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\u5728\u5355\u4E2A\u4E3B\u673A\u4E0A\u4EE5\u5B88\u62A4\u8FDB\u7A0B\u3001\u4EE3\u7406\u6216\u670D\u52A1\u5F62\u5F0F\u8FD0\u884C\u7684\u5BB9\u5668\u6216\u5BB9\u5668\u96C6\u7FA4\u7BA1\u7406\u5DE5\u5177\u3002\u8FD9\u5305\u62EC\u7528\u4E8E\u521B\u5EFA\u548C\u7BA1\u7406\u5355\u4E2A\u5BB9\u5668\u7684\u8F6F\u4EF6\uFF0C\u5982Docker\u548CPodman\uFF0C\u4EE5\u53CA\u5BB9\u5668\u96C6\u7FA4\u8282\u70B9\u7EA7\u522B\u7684\u4EE3\u7406\uFF0C\u5982kubelet\u3002\u901A\u8FC7\u4FEE\u6539\u8FD9\u4E9B\u670D\u52A1\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u80FD\u591F\u5728\u4E3B\u673A\u4E0A\u5B9E\u73B0\u6301\u4E45\u5316\u6216\u63D0\u5347\u5176\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/005\/"},{"id":"T1543","name":"\u521B\u5EFA\u6216\u4FEE\u6539\u7CFB\u7EDF\u8FDB\u7A0B","description":"\u5BF9\u624B\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\u7CFB\u7EDF\u7EA7\u8FDB\u7A0B\uFF0C\u4EE5\u4F5C\u4E3A\u6301\u4E45\u5316\u624B\u6BB5\u53CD\u590D\u6267\u884C\u6076\u610F\u8D1F\u8F7D\u3002\u64CD\u4F5C\u7CFB\u7EDF\u542F\u52A8\u65F6\uFF0C\u4F1A\u8FD0\u884C\u6267\u884C\u540E\u53F0\u7CFB\u7EDF\u529F\u80FD\u7684\u8FDB\u7A0B\u3002\u5728Windows\u548CLinux\u7CFB\u7EDF\u4E2D\uFF0C\u8FD9\u4E9B\u7CFB\u7EDF\u8FDB\u7A0B\u88AB\u79F0\u4E3A\u670D\u52A1\uFF1B\u800C\u5728macOS\u7CFB\u7EDF\u4E2D\uFF0C\u5219\u901A\u8FC7\u540D\u4E3A\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\uFF08Launch Daemon\uFF09\u548C\u542F\u52A8\u4EE3\u7406\uFF08Launch Agent\uFF09\u7684launchd\u8FDB\u7A0B\u6765\u5B8C\u6210\u7CFB\u7EDF\u521D\u59CB\u5316\u5E76\u52A0\u8F7D\u7528\u6237\u7279\u5B9A\u53C2\u6570\u3002","sub-techniques":"T1543.001, T1543.002, T1543.003, T1543.004, T1543.005","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1543\/"},{"id":"T1546.001","name":"\u66F4\u6539\u9ED8\u8BA4\u6587\u4EF6\u5173\u8054","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u6587\u4EF6\u7C7B\u578B\u5173\u8054\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u5F53\u6587\u4EF6\u88AB\u6253\u5F00\u65F6\uFF0C\u7CFB\u7EDF\u4F1A\u68C0\u67E5\u7528\u4E8E\u6253\u5F00\u8BE5\u6587\u4EF6\u7684\u9ED8\u8BA4\u7A0B\u5E8F\uFF08\u4E5F\u79F0\u4E3A\u6587\u4EF6\u5173\u8054\u6216\u5904\u7406\u7A0B\u5E8F\uFF09\u3002\u6587\u4EF6\u5173\u8054\u9009\u62E9\u5B58\u50A8\u5728Windows\u6CE8\u518C\u8868\u4E2D\uFF0C\u53EF\u7531\u7528\u6237\u3001\u7BA1\u7406\u5458\u6216\u5177\u6709\u6CE8\u518C\u8868\u8BBF\u95EE\u6743\u9650\u7684\u7A0B\u5E8F\u8FDB\u884C\u7F16\u8F91\uFF0C\u6216\u7531\u7BA1\u7406\u5458\u4F7F\u7528\u5185\u7F6E\u7684assoc\u5B9E\u7528\u5DE5\u5177\u8FDB\u884C\u4FEE\u6539\u3002\u5E94\u7528\u7A0B\u5E8F\u53EF\u4EE5\u4FEE\u6539\u7279\u5B9A\u6587\u4EF6\u6269\u5C55\u540D\u7684\u6587\u4EF6\u5173\u8054\uFF0C\u4EE5\u4FBF\u5728\u6253\u5F00\u5177\u6709\u8BE5\u6269\u5C55\u540D\u7684\u6587\u4EF6\u65F6\u8C03\u7528\u4EFB\u610F\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/001\/"},{"id":"T1546.002","name":"\u5C4F\u5E55\u4FDD\u62A4\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u7528\u6237\u4E0D\u6D3B\u52A8\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u5C4F\u5E55\u4FDD\u62A4\u7A0B\u5E8F\u662F\u5728\u7528\u6237\u4E0D\u6D3B\u52A8\u8FBE\u5230\u53EF\u914D\u7F6E\u65F6\u95F4\u540E\u6267\u884C\u7684\u7A0B\u5E8F\uFF0C\u7531\u5177\u6709.scr\u6587\u4EF6\u6269\u5C55\u540D\u7684\u53EF\u79FB\u690D\u53EF\u6267\u884C\uFF08PE\uFF09\u6587\u4EF6\u7EC4\u6210\u3002Windows\u5C4F\u5E55\u4FDD\u62A4\u7A0B\u5E8F\u5E94\u7528\u7A0B\u5E8Fscrnsave.scr\u4F4D\u4E8EC:\\Windows\\System32\\\uFF0C\u572864\u4F4DWindows\u7CFB\u7EDF\u4E2D\u8FD8\u4F4D\u4E8EC:\\Windows\\sysWOW64\\\uFF0C\u8FD9\u4E9B\u4F4D\u7F6E\u5305\u542BWindows\u57FA\u7840\u5B89\u88C5\u4E2D\u7684\u5C4F\u5E55\u4FDD\u62A4\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/002\/"},{"id":"T1546.003","name":"Windows Management Instrumentation \u4E8B\u4EF6\u8BA2\u9605","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531Windows\u7BA1\u7406\u89C4\u8303\uFF08WMI\uFF09\u4E8B\u4EF6\u8BA2\u9605\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\uFF0C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u5E76\u63D0\u5347\u6743\u9650\u3002WMI\u53EF\u7528\u4E8E\u5B89\u88C5\u4E8B\u4EF6\u8FC7\u6EE4\u5668\u3001\u63D0\u4F9B\u7A0B\u5E8F\u3001\u6D88\u8D39\u8005\u4EE5\u53CA\u7ED1\u5B9A\uFF0C\u4EE5\u4FBF\u5728\u5B9A\u4E49\u7684\u4E8B\u4EF6\u53D1\u751F\u65F6\u6267\u884C\u4EE3\u7801\u3002\u53EF\u8BA2\u9605\u7684\u4E8B\u4EF6\u793A\u4F8B\u5305\u62EC\u7CFB\u7EDF\u65F6\u95F4\u3001\u7528\u6237\u767B\u5F55\u6216\u8BA1\u7B97\u673A\u8FD0\u884C\u65F6\u95F4\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/003\/"},{"id":"T1546.004","name":"Unix Shell \u914D\u7F6E\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u7528\u6237shell\u89E6\u53D1\u7684\u6076\u610F\u547D\u4EE4\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002\u7528\u6237Unix Shell\u4F1A\u6839\u636E\u4F1A\u8BDD\u4E2D\u7684\u4E0D\u540C\u4E8B\u4EF6\u6267\u884C\u591A\u4E2A\u914D\u7F6E\u811A\u672C\u3002\u4F8B\u5982\uFF0C\u5F53\u7528\u6237\u6253\u5F00\u547D\u4EE4\u884C\u754C\u9762\u6216\u8FDC\u7A0B\u767B\u5F55\uFF08\u5982\u901A\u8FC7SSH\uFF09\u65F6\uFF0C\u4F1A\u542F\u52A8\u4E00\u4E2A\u767B\u5F55shell\u3002\u767B\u5F55shell\u4F1A\u6267\u884C\u6765\u81EA\u7CFB\u7EDF\uFF08\/etc\uFF09\u548C\u7528\u6237\u4E3B\u76EE\u5F55\uFF08~\/\uFF09\u7684\u811A\u672C\u6765\u914D\u7F6E\u73AF\u5883\u3002\u7CFB\u7EDF\u4E2D\u7684\u6240\u6709\u767B\u5F55shell\u5728\u542F\u52A8\u65F6\u90FD\u4F1A\u4F7F\u7528\/etc\/profile\u3002\u8FD9\u4E9B\u914D\u7F6E\u811A\u672C\u4EE5\u5176\u6240\u5728\u76EE\u5F55\u7684\u6743\u9650\u7EA7\u522B\u8FD0\u884C\uFF0C\u901A\u5E38\u7528\u4E8E\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF\u3001\u521B\u5EFA\u522B\u540D\u4EE5\u53CA\u81EA\u5B9A\u4E49\u7528\u6237\u73AF\u5883\u3002\u5F53shell\u9000\u51FA\u6216\u7EC8\u6B62\u65F6\uFF0C\u4F1A\u6267\u884C\u989D\u5916\u7684shell\u811A\u672C\u4EE5\u786E\u4FDDshell\u6B63\u5E38\u9000\u51FA\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/004\/"},{"id":"T1546.005","name":"\u9677\u9631","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u4E2D\u65AD\u4FE1\u53F7\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002trap\u547D\u4EE4\u5141\u8BB8\u7A0B\u5E8F\u548Cshell\u6307\u5B9A\u5728\u63A5\u6536\u5230\u4E2D\u65AD\u4FE1\u53F7\u65F6\u6267\u884C\u7684\u547D\u4EE4\u3002\u5E38\u89C1\u7684\u60C5\u51B5\u662F\u811A\u672C\u5141\u8BB8\u4F18\u96C5\u5730\u7EC8\u6B62\u5E76\u5904\u7406\u5E38\u89C1\u7684\u952E\u76D8\u4E2D\u65AD\uFF0C\u5982ctrl+c\u548Cctrl+d\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/005\/"},{"id":"T1546.006","name":"LC_LOAD_DYLIB \u6DFB\u52A0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u53D7\u6C61\u67D3\u4E8C\u8FDB\u5236\u6587\u4EF6\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002Mach-O\u4E8C\u8FDB\u5236\u6587\u4EF6\u5305\u542B\u4E00\u7CFB\u5217\u5934\u90E8\u4FE1\u606F\uFF0C\u7528\u4E8E\u5728\u4E8C\u8FDB\u5236\u6587\u4EF6\u52A0\u8F7D\u65F6\u6267\u884C\u7279\u5B9A\u64CD\u4F5C\u3002Mach-O\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E2D\u7684LC_LOAD_DYLIB\u5934\u90E8\u6307\u793AmacOS\u548COS X\u5728\u8FD0\u884C\u65F6\u52A0\u8F7D\u54EA\u4E9B\u52A8\u6001\u5E93\uFF08dylibs\uFF09\u3002\u53EA\u8981\u5BF9\u5176\u4ED6\u5B57\u6BB5\u548C\u4F9D\u8D56\u9879\u8FDB\u884C\u76F8\u5E94\u8C03\u6574\uFF0C\u8FD9\u4E9B\u5E93\u53EF\u4EE5\u4E34\u65F6\u6DFB\u52A0\u5230\u5DF2\u7F16\u8BD1\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E2D\u3002\u73B0\u6709\u5DE5\u5177\u53EF\u7528\u4E8E\u6267\u884C\u8FD9\u4E9B\u66F4\u6539\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/006\/"},{"id":"T1546.007","name":"\u7F51\u7EDC\u5916\u58F3\u52A9\u624B\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531Netsh Helper DLL\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002Netsh.exe\uFF08\u4E5F\u79F0\u4E3ANetshell\uFF09\u662F\u4E00\u79CD\u547D\u4EE4\u884C\u811A\u672C\u5B9E\u7528\u7A0B\u5E8F\uFF0C\u7528\u4E8E\u4E0E\u7CFB\u7EDF\u7684\u7F51\u7EDC\u914D\u7F6E\u8FDB\u884C\u4EA4\u4E92\u3002\u5B83\u5305\u542B\u6DFB\u52A0\u8F85\u52A9DLL\u4EE5\u6269\u5C55\u5B9E\u7528\u7A0B\u5E8F\u529F\u80FD\u7684\u529F\u80FD\u3002\u5DF2\u6CE8\u518C\u7684netsh.exe\u8F85\u52A9DLL\u7684\u8DEF\u5F84\u88AB\u8F93\u5165\u5230Windows\u6CE8\u518C\u8868\u4E2D\u7684HKLM\\SOFTWARE\\Microsoft\\Netsh\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/007\/"},{"id":"T1546.008","name":"\u8F85\u52A9\u529F\u80FD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u89E6\u53D1\u8F85\u52A9\u529F\u80FD\u6267\u884C\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u8BBF\u95EE\u548C\/\u6216\u63D0\u5347\u6743\u9650\u3002Windows\u7CFB\u7EDF\u5305\u542B\u4E00\u4E9B\u8F85\u52A9\u529F\u80FD\uFF0C\u8FD9\u4E9B\u529F\u80FD\u53EF\u4EE5\u5728\u7528\u6237\u767B\u5F55\u524D\uFF08\u4F8B\u5982\uFF0C\u5F53\u7528\u6237\u5904\u4E8EWindows\u767B\u5F55\u754C\u9762\u65F6\uFF09\u901A\u8FC7\u7EC4\u5408\u952E\u542F\u52A8\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u4FEE\u6539\u8FD9\u4E9B\u7A0B\u5E8F\u7684\u542F\u52A8\u65B9\u5F0F\uFF0C\u4ECE\u800C\u65E0\u9700\u767B\u5F55\u7CFB\u7EDF\u5373\u53EF\u83B7\u53D6\u547D\u4EE4\u63D0\u793A\u7B26\u6216\u540E\u95E8\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/008\/"},{"id":"T1546.009","name":"AppCert DLLs","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u52A0\u8F7D\u5230\u8FDB\u7A0B\u4E2D\u7684AppCert DLL\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\uFF0C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u5E76\/\u6216\u63D0\u5347\u6743\u9650\u3002\u5728\u6CE8\u518C\u8868\u8DEF\u5F84HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\\u4E0B\u7684AppCertDLLs\u952E\u4E2D\u6307\u5B9A\u7684\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\uFF0C\u4F1A\u88AB\u52A0\u8F7D\u5230\u6BCF\u4E00\u4E2A\u8C03\u7528\u4EE5\u4E0B\u5E7F\u6CDB\u4F7F\u7528\u7684\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\u51FD\u6570\u7684\u8FDB\u7A0B\u4E2D\uFF1ACreateProcess\u3001CreateProcessAsUser\u3001CreateProcessWithLoginW\u3001CreateProcessWithTokenW\u6216WinExec\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/009\/"},{"id":"T1546.010","name":"\u5E94\u7528\u7A0B\u5E8F\u521D\u59CB\u5316\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531AppInit DLLs\u52A0\u8F7D\u5230\u8FDB\u7A0B\u4E2D\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u548C\/\u6216\u63D0\u5347\u6743\u9650\u3002\u5728\u6CE8\u518C\u8868\u952EHKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\u6216HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\u4E2DAppInit_DLLs\u503C\u6307\u5B9A\u7684\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLLs\uFF09\uFF0C\u4F1A\u88ABuser32.dll\u52A0\u8F7D\u5230\u6BCF\u4E00\u4E2A\u52A0\u8F7Duser32.dll\u7684\u8FDB\u7A0B\u4E2D\u3002\u5B9E\u9645\u4E0A\uFF0C\u8FD9\u51E0\u4E4E\u6DB5\u76D6\u4E86\u6240\u6709\u7A0B\u5E8F\uFF0C\u56E0\u4E3Auser32.dll\u662F\u4E00\u4E2A\u975E\u5E38\u5E38\u89C1\u7684\u5E93\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/010\/"},{"id":"T1546.011","name":"\u5E94\u7528\u7A0B\u5E8F\u517C\u5BB9\u6027\u586B\u5145","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u5E94\u7528\u7A0B\u5E8F\u517C\u5BB9\u6027\u57AB\u7247\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u5E76\/\u6216\u63D0\u5347\u6743\u9650\u3002\u5FAE\u8F6FWindows\u5E94\u7528\u7A0B\u5E8F\u517C\u5BB9\u6027\u57FA\u7840\u8BBE\u65BD\/\u6846\u67B6\uFF08\u5E94\u7528\u7A0B\u5E8F\u57AB\u7247\uFF09\u7684\u521B\u5EFA\u662F\u4E3A\u4E86\u5728\u64CD\u4F5C\u7CFB\u7EDF\u4EE3\u7801\u5E93\u968F\u65F6\u95F4\u53D8\u5316\u65F6\uFF0C\u786E\u4FDD\u8F6F\u4EF6\u7684\u5411\u540E\u517C\u5BB9\u6027\u3002\u4F8B\u5982\uFF0C\u5E94\u7528\u7A0B\u5E8F\u57AB\u7247\u529F\u80FD\u5141\u8BB8\u5F00\u53D1\u4EBA\u5458\u4E3A\u9488\u5BF9Windows XP\u521B\u5EFA\u7684\u5E94\u7528\u7A0B\u5E8F\u5E94\u7528\u4FEE\u590D\uFF08\u65E0\u9700\u91CD\u5199\u4EE3\u7801\uFF09\uFF0C\u4F7F\u5176\u80FD\u591F\u5728Windows 10\u4E0A\u8FD0\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/011\/"},{"id":"T1546.012","name":"\u6620\u50CF\u6587\u4EF6\u6267\u884C\u9009\u9879\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u6620\u50CF\u6587\u4EF6\u6267\u884C\u9009\u9879\uFF08IFEO\uFF09\u8C03\u8BD5\u5668\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\uFF0C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u8BBF\u95EE\u548C\/\u6216\u63D0\u5347\u6743\u9650\u3002IFEO\u5141\u8BB8\u5F00\u53D1\u8005\u5C06\u8C03\u8BD5\u5668\u9644\u52A0\u5230\u5E94\u7528\u7A0B\u5E8F\u4E0A\u3002\u5F53\u8FDB\u7A0B\u521B\u5EFA\u65F6\uFF0C\u5E94\u7528\u7A0B\u5E8FIFEO\u4E2D\u5B58\u5728\u7684\u8C03\u8BD5\u5668\u4F1A\u88AB\u6DFB\u52A0\u5230\u5E94\u7528\u7A0B\u5E8F\u540D\u79F0\u4E4B\u524D\uFF0C\u4ECE\u800C\u5728\u65B0\u8FDB\u7A0B\u542F\u52A8\u65F6\u5B9E\u9645\u4E0A\u662F\u5728\u8C03\u8BD5\u5668\u4E0B\u8FD0\u884C\uFF08\u4F8B\u5982\uFF0CC:\\dbg\\ntsd.exe -g notepad.exe\uFF09\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/012\/"},{"id":"T1546.013","name":"PowerShell \u914D\u7F6E\u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531PowerShell\u914D\u7F6E\u6587\u4EF6\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u83B7\u53D6\u6301\u4E45\u6027\u5E76\u63D0\u5347\u6743\u9650\u3002PowerShell\u914D\u7F6E\u6587\u4EF6\uFF08profile.ps1\uFF09\u662F\u5728PowerShell\u542F\u52A8\u65F6\u8FD0\u884C\u7684\u811A\u672C\uFF0C\u53EF\u4F5C\u4E3A\u767B\u5F55\u811A\u672C\u7528\u4E8E\u81EA\u5B9A\u4E49\u7528\u6237\u73AF\u5883\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/013\/"},{"id":"T1546.014","name":"\u57C3\u8499\u5FB7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u4E8B\u4EF6\u76D1\u63A7\u5B88\u62A4\u8FDB\u7A0B\uFF08emond\uFF09\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u83B7\u53D6\u6301\u4E45\u6027\u5E76\u63D0\u5347\u6743\u9650\u3002emond\u662F\u4E00\u4E2A\u542F\u52A8\u5B88\u62A4\u8FDB\u7A0B\uFF0C\u5B83\u63A5\u6536\u6765\u81EA\u5404\u79CD\u670D\u52A1\u7684\u4E8B\u4EF6\uFF0C\u901A\u8FC7\u7B80\u5355\u7684\u89C4\u5219\u5F15\u64CE\u5904\u7406\u8FD9\u4E9B\u4E8B\u4EF6\uFF0C\u5E76\u91C7\u53D6\u76F8\u5E94\u884C\u52A8\u3002\u4F4D\u4E8E\/sbin\/emond\u7684emond\u4E8C\u8FDB\u5236\u6587\u4EF6\u4F1A\u52A0\u8F7D\/etc\/emond.d\/rules\/\u76EE\u5F55\u4E0B\u7684\u6240\u6709\u89C4\u5219\uFF0C\u5E76\u5728\u660E\u786E\u5B9A\u4E49\u7684\u4E8B\u4EF6\u53D1\u751F\u65F6\u6267\u884C\u76F8\u5E94\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/014\/"},{"id":"T1546.015","name":"\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531\u52AB\u6301\u7684\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08COM\uFF09\u5BF9\u8C61\u5F15\u7528\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u3002COM\u662FWindows\u7CFB\u7EDF\u4E2D\u7684\u4E00\u4E2A\u673A\u5236\uFF0C\u65E8\u5728\u901A\u8FC7\u64CD\u4F5C\u7CFB\u7EDF\u5B9E\u73B0\u8F6F\u4EF6\u7EC4\u4EF6\u95F4\u7684\u4EA4\u4E92\u3002\u5404\u79CDCOM\u5BF9\u8C61\u7684\u5F15\u7528\u5B58\u50A8\u5728\u6CE8\u518C\u8868\u4E2D\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/015\/"},{"id":"T1546.016","name":"\u5B89\u88C5\u7A0B\u5E8F\u5305","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4F7F\u7528\u5B89\u88C5\u7A0B\u5E8F\u89E6\u53D1\u6076\u610F\u5185\u5BB9\u7684\u6267\u884C\u6765\u5EFA\u7ACB\u6301\u4E45\u6027\u5E76\u63D0\u5347\u6743\u9650\u3002\u5B89\u88C5\u7A0B\u5E8F\u5305\u662F\u64CD\u4F5C\u7CFB\u7EDF\u7279\u5B9A\u7684\uFF0C\u5305\u542B\u4E86\u64CD\u4F5C\u7CFB\u7EDF\u5728\u7CFB\u7EDF\u4E0A\u5B89\u88C5\u5E94\u7528\u7A0B\u5E8F\u6240\u9700\u7684\u8D44\u6E90\u3002\u5B89\u88C5\u7A0B\u5E8F\u5305\u53EF\u4EE5\u5305\u542B\u5728\u5B89\u88C5\u524D\u4EE5\u53CA\u5B89\u88C5\u5B8C\u6210\u540E\u8FD0\u884C\u7684\u811A\u672C\u3002\u5B89\u88C5\u7A0B\u5E8F\u811A\u672C\u5728\u6267\u884C\u65F6\u53EF\u80FD\u7EE7\u627F\u63D0\u5347\u7684\u6743\u9650\u3002\u5F00\u53D1\u8005\u901A\u5E38\u4F7F\u7528\u8FD9\u4E9B\u811A\u672C\u6765\u51C6\u5907\u5B89\u88C5\u73AF\u5883\u3001\u68C0\u67E5\u8981\u6C42\u3001\u4E0B\u8F7D\u4F9D\u8D56\u9879\u4EE5\u53CA\u5728\u5B89\u88C5\u540E\u5220\u9664\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/016\/"},{"id":"T1546.017","name":"Udev \u89C4\u5219","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u7531udev\u89C4\u5219\u89E6\u53D1\u7684\u6076\u610F\u5185\u5BB9\u6765\u7EF4\u6301\u6301\u4E45\u6027\u3002Udev\u662FLinux\u5185\u6838\u8BBE\u5907\u7BA1\u7406\u5668\uFF0C\u5B83\u52A8\u6001\u7BA1\u7406\u8BBE\u5907\u8282\u70B9\u3001\u5904\u7406\u5BF9\/dev\u76EE\u5F55\u4E0B\u4F2A\u8BBE\u5907\u6587\u4EF6\u7684\u8BBF\u95EE\uFF0C\u5E76\u54CD\u5E94\u786C\u4EF6\u4E8B\u4EF6\uFF0C\u4F8B\u5982\u5F53\u786C\u76D8\u6216\u952E\u76D8\u7B49\u5916\u90E8\u8BBE\u5907\u63D2\u5165\u6216\u79FB\u9664\u65F6\u3002Udev\u4F7F\u7528\u5305\u542B\u5339\u914D\u952E\u7684\u89C4\u5219\u6587\u4EF6\u6765\u6307\u5B9A\u786C\u4EF6\u4E8B\u4EF6\u5FC5\u987B\u6EE1\u8DB3\u7684\u6761\u4EF6\uFF0C\u4EE5\u53CA\u52A8\u4F5C\u952E\u6765\u5B9A\u4E49\u968F\u540E\u5E94\u6267\u884C\u7684\u64CD\u4F5C\u3002\u521B\u5EFA\u3001\u4FEE\u6539\u6216\u5220\u9664\u4F4D\u4E8E\/etc\/udev\/rules.d\/\u3001\/run\/udev\/rules.d\/\u3001\/usr\/lib\/udev\/rules.d\/\u3001\/usr\/local\/lib\/udev\/rules.d\/\u548C\/lib\/udev\/rules.d\/\u76EE\u5F55\u4E0B\u7684\u89C4\u5219\u6587\u4EF6\u9700\u8981root\u6743\u9650\u3002\u89C4\u5219\u4F18\u5148\u7EA7\u7531\u76EE\u5F55\u548C\u89C4\u5219\u6587\u4EF6\u540D\u4E2D\u7684\u6570\u5B57\u524D\u7F00\u5171\u540C\u51B3\u5B9A\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/017\/"},{"id":"T1546.018","name":"Python \u542F\u52A8\u94A9\u5B50","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5229\u7528Python\u7684\u542F\u52A8\u673A\u5236\u5B9E\u73B0\u6301\u4E45\u5316\uFF0C\u5305\u62EC\u8DEF\u5F84\u914D\u7F6E\u6587\u4EF6\uFF08.pth\uFF09\u4EE5\u53CAsitecustomize.py\u6216usercustomize.py\u6A21\u5757\u3002\u8FD9\u4E9B\u6587\u4EF6\u5728Python\u89E3\u91CA\u5668\u521D\u59CB\u5316\u671F\u95F4\u4F1A\u81EA\u52A8\u5904\u7406\uFF0C\u4F7F\u5F97\u6BCF\u6B21\u8C03\u7528Python\u65F6\u90FD\u80FD\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/018\/"},{"id":"T1546","name":"\u4E8B\u4EF6\u89E6\u53D1\u6267\u884C","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u7CFB\u7EDF\u673A\u5236\u5EFA\u7ACB\u6301\u4E45\u6027\u53CA\/\u6216\u63D0\u5347\u6743\u9650\uFF0C\u8FD9\u4E9B\u673A\u5236\u57FA\u4E8E\u7279\u5B9A\u4E8B\u4EF6\u89E6\u53D1\u6267\u884C\u3002\u4E0D\u540C\u64CD\u4F5C\u7CFB\u7EDF\u5177\u5907\u76D1\u63A7\u5E76\u8BA2\u9605\u4E8B\u4EF6\uFF08\u5982\u767B\u5F55\u6216\u5176\u4ED6\u7528\u6237\u6D3B\u52A8\uFF0C\u4F8B\u5982\u8FD0\u884C\u7279\u5B9A\u5E94\u7528\u7A0B\u5E8F\/\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF09\u7684\u529F\u80FD\u3002\u4E91\u73AF\u5883\u540C\u6837\u53EF\u80FD\u652F\u6301\u591A\u79CD\u51FD\u6570\u4E0E\u670D\u52A1\uFF0C\u8FD9\u4E9B\u529F\u80FD\u53EF\u76D1\u63A7\u7279\u5B9A\u4E91\u4E8B\u4EF6\u5E76\u80FD\u5728\u4E8B\u4EF6\u53D1\u751F\u65F6\u88AB\u8C03\u7528\u3002","sub-techniques":"T1546.001, T1546.002, T1546.003, T1546.004, T1546.005, T1546.006, T1546.007, T1546.008, T1546.009, T1546.010, T1546.011, T1546.012, T1546.013, T1546.014, T1546.015, T1546.016, T1546.017, T1546.018","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1546\/"},{"id":"T1547.001","name":"\u6CE8\u518C\u8868\u8FD0\u884C\u9879 \/ \u542F\u52A8\u6587\u4EF6\u5939","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u7A0B\u5E8F\u6DFB\u52A0\u5230\u542F\u52A8\u6587\u4EF6\u5939\u6216\u901A\u8FC7\u6CE8\u518C\u8868\u8FD0\u884C\u952E\u5F15\u7528\u6765\u5B9E\u73B0\u6301\u4E45\u5316\u3002\u5728\u6CE8\u518C\u8868\u7684\u201C\u8FD0\u884C\u952E\u201D\u6216\u542F\u52A8\u6587\u4EF6\u5939\u4E2D\u6DFB\u52A0\u6761\u76EE\uFF0C\u4F1A\u5BFC\u81F4\u5F15\u7528\u7684\u7A0B\u5E8F\u5728\u7528\u6237\u767B\u5F55\u65F6\u6267\u884C\u3002\u8FD9\u4E9B\u7A0B\u5E8F\u5C06\u5728\u7528\u6237\u7684\u4E0A\u4E0B\u6587\u4E2D\u6267\u884C\uFF0C\u5E76\u62E5\u6709\u8BE5\u8D26\u6237\u76F8\u5E94\u7684\u6743\u9650\u7EA7\u522B\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/001\/"},{"id":"T1547.002","name":"\u8EAB\u4EFD\u9A8C\u8BC1\u5305","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8EAB\u4EFD\u9A8C\u8BC1\u5305\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u6267\u884CDLL\u3002Windows\u8EAB\u4EFD\u9A8C\u8BC1\u5305DLL\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u7531\u672C\u5730\u5B89\u5168\u673A\u6784\uFF08LSA\uFF09\u8FDB\u7A0B\u52A0\u8F7D\uFF0C\u5B83\u4EEC\u4E3A\u64CD\u4F5C\u7CFB\u7EDF\u63D0\u4F9B\u5BF9\u591A\u4E2A\u767B\u5F55\u8FDB\u7A0B\u548C\u591A\u79CD\u5B89\u5168\u534F\u8BAE\u7684\u652F\u6301\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/002\/"},{"id":"T1547.003","name":"\u65F6\u95F4\u63D0\u4F9B\u8005","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u65F6\u95F4\u63D0\u4F9B\u7A0B\u5E8F\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u6267\u884CDLL\u3002Windows\u65F6\u95F4\u670D\u52A1\uFF08W32Time\uFF09\u652F\u6301\u8DE8\u57DF\u548C\u57DF\u5185\u7684\u65F6\u95F4\u540C\u6B65\u3002W32Time\u65F6\u95F4\u63D0\u4F9B\u7A0B\u5E8F\u8D1F\u8D23\u4ECE\u786C\u4EF6\/\u7F51\u7EDC\u8D44\u6E90\u68C0\u7D22\u65F6\u95F4\u6233\uFF0C\u5E76\u5C06\u8FD9\u4E9B\u503C\u8F93\u51FA\u7ED9\u5176\u4ED6\u7F51\u7EDC\u5BA2\u6237\u7AEF\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/003\/"},{"id":"T1547.004","name":"Winlogon \u8F85\u52A9\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Winlogon\u7684\u529F\u80FD\uFF0C\u5728\u7528\u6237\u767B\u5F55\u65F6\u6267\u884CDLL\u548C\/\u6216\u53EF\u6267\u884C\u6587\u4EF6\u3002Winlogon.exe\u662FWindows\u7684\u4E00\u4E2A\u7EC4\u4EF6\uFF0C\u8D1F\u8D23\u5904\u7406\u767B\u5F55\/\u6CE8\u9500\u64CD\u4F5C\u4EE5\u53CA\u7531Ctrl-Alt-Delete\u89E6\u53D1\u7684\u5B89\u5168\u6CE8\u610F\u5E8F\u5217\uFF08SAS\uFF09\u3002\u4F4D\u4E8EHKLM\\Software[\\Wow6432Node\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\\u548CHKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\\u7684\u6CE8\u518C\u8868\u9879\u7528\u4E8E\u7BA1\u7406\u652F\u6301Winlogon\u7684\u989D\u5916\u8F85\u52A9\u7A0B\u5E8F\u548C\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/004\/"},{"id":"T1547.005","name":"\u5B89\u5168\u652F\u6301\u63D0\u4F9B\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5B89\u5168\u652F\u6301\u63D0\u4F9B\u7A0B\u5E8F\uFF08SSP\uFF09\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u6267\u884CDLL\u3002Windows SSP DLL\u4F1A\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u52A0\u8F7D\u5230\u672C\u5730\u5B89\u5168\u673A\u6784\uFF08LSA\uFF09\u8FDB\u7A0B\u4E2D\u3002\u4E00\u65E6\u52A0\u8F7D\u5230LSA\u4E2D\uFF0CSSP DLL\u4FBF\u80FD\u8BBF\u95EEWindows\u4E2D\u5B58\u50A8\u7684\u52A0\u5BC6\u53CA\u660E\u6587\u5BC6\u7801\uFF0C\u4F8B\u5982\u4EFB\u4F55\u5DF2\u767B\u5F55\u7528\u6237\u7684\u57DF\u5BC6\u7801\u6216\u667A\u80FD\u5361PIN\u7801\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/005\/"},{"id":"T1547.006","name":"\u5185\u6838\u6A21\u5757\u4E0E\u6269\u5C55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u5185\u6838\uFF0C\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u81EA\u52A8\u6267\u884C\u7A0B\u5E8F\u3002\u53EF\u52A0\u8F7D\u5185\u6838\u6A21\u5757\uFF08LKMs\uFF09\u662F\u4E00\u79CD\u53EF\u6309\u9700\u52A0\u8F7D\u5230\u5185\u6838\u6216\u4ECE\u5185\u6838\u5378\u8F7D\u7684\u4EE3\u7801\u7247\u6BB5\uFF0C\u5B83\u4EEC\u80FD\u5728\u65E0\u9700\u91CD\u542F\u7CFB\u7EDF\u7684\u60C5\u51B5\u4E0B\u6269\u5C55\u5185\u6838\u529F\u80FD\u3002\u4F8B\u5982\uFF0C\u8BBE\u5907\u9A71\u52A8\u5C31\u662F\u4E00\u79CD\u6A21\u5757\u7C7B\u578B\uFF0C\u5B83\u4F7F\u5185\u6838\u80FD\u591F\u8BBF\u95EE\u8FDE\u63A5\u5230\u7CFB\u7EDF\u7684\u786C\u4EF6\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/006\/"},{"id":"T1547.007","name":"\u91CD\u65B0\u5F00\u653E\u7533\u8BF7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u5C5E\u6027\u5217\u8868\u6587\u4EF6\uFF0C\u5728\u7528\u6237\u767B\u5F55\u65F6\u81EA\u52A8\u8FD0\u884C\u5E94\u7528\u7A0B\u5E8F\u3002\u5F53\u7528\u6237\u901A\u8FC7macOS\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF08GUI\uFF09\u6CE8\u9500\u6216\u91CD\u542F\u65F6\uFF0C\u7CFB\u7EDF\u4F1A\u5411\u7528\u6237\u663E\u793A\u4E00\u4E2A\u63D0\u793A\uFF0C\u5176\u4E2D\u5305\u542B\u201C\u91CD\u65B0\u767B\u5F55\u65F6\u91CD\u65B0\u6253\u5F00\u7A97\u53E3\u201D\u7684\u590D\u9009\u6846\u3002\u82E5\u7528\u6237\u52FE\u9009\u6B64\u9009\u9879\uFF0C\u5F53\u524D\u6240\u6709\u6253\u5F00\u7684\u5E94\u7528\u7A0B\u5E8F\u5C06\u88AB\u6DFB\u52A0\u81F3\u4F4D\u4E8E~\/Library\/Preferences\/ByHost\u76EE\u5F55\u4E0B\u3001\u540D\u4E3Acom.apple.loginwindow.[UUID].plist\u7684\u5C5E\u6027\u5217\u8868\u6587\u4EF6\u4E2D\u3002\u8BE5\u6587\u4EF6\u6240\u5217\u7684\u5E94\u7528\u7A0B\u5E8F\u5C06\u5728\u7528\u6237\u4E0B\u6B21\u767B\u5F55\u65F6\u81EA\u52A8\u91CD\u65B0\u6253\u5F00\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/007\/"},{"id":"T1547.008","name":"LSASS \u9A71\u52A8\u7A0B\u5E8F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u6216\u6DFB\u52A0LSASS\u9A71\u52A8\u7A0B\u5E8F\uFF0C\u4EE5\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u5B9E\u73B0\u6301\u4E45\u5316\u3002Windows\u5B89\u5168\u5B50\u7CFB\u7EDF\u662F\u4E00\u7EC4\u7BA1\u7406\u548C\u6267\u884C\u8BA1\u7B97\u673A\u6216\u57DF\u5B89\u5168\u7B56\u7565\u7684\u7EC4\u4EF6\u3002\u672C\u5730\u5B89\u5168\u673A\u6784\uFF08LSA\uFF09\u662F\u8D1F\u8D23\u672C\u5730\u5B89\u5168\u7B56\u7565\u548C\u7528\u6237\u8EAB\u4EFD\u9A8C\u8BC1\u7684\u4E3B\u8981\u7EC4\u4EF6\u3002LSA\u5305\u542B\u591A\u4E2A\u4E0E\u5404\u79CD\u5176\u4ED6\u5B89\u5168\u529F\u80FD\u76F8\u5173\u7684\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\uFF0C\u6240\u6709\u8FD9\u4E9B\u90FD\u5728LSA\u5B50\u7CFB\u7EDF\u670D\u52A1\uFF08LSASS\uFF09lsass.exe\u8FDB\u7A0B\u7684\u4E0A\u4E0B\u6587\u4E2D\u8FD0\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/008\/"},{"id":"T1547.009","name":"\u5FEB\u6377\u65B9\u5F0F\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\u5FEB\u6377\u65B9\u5F0F\uFF0C\u4EE5\u4FBF\u5728\u7CFB\u7EDF\u542F\u52A8\u6216\u7528\u6237\u767B\u5F55\u65F6\u6267\u884C\u7A0B\u5E8F\u3002\u5FEB\u6377\u65B9\u5F0F\u6216\u7B26\u53F7\u94FE\u63A5\u7528\u4E8E\u5F15\u7528\u5176\u4ED6\u6587\u4EF6\u6216\u7A0B\u5E8F\uFF0C\u5F53\u5FEB\u6377\u65B9\u5F0F\u88AB\u70B9\u51FB\u6216\u7531\u7CFB\u7EDF\u542F\u52A8\u8FDB\u7A0B\u6267\u884C\u65F6\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u6216\u7A0B\u5E8F\u5C06\u88AB\u6253\u5F00\u6216\u8FD0\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/009\/"},{"id":"T1547.010","name":"\u7AEF\u53E3\u76D1\u89C6\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7AEF\u53E3\u76D1\u89C6\u5668\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u8FD0\u884C\u5176\u63D0\u4F9B\u7684DLL\uFF0C\u4EE5\u5B9E\u73B0\u6301\u4E45\u5316\u6216\u6743\u9650\u63D0\u5347\u3002\u901A\u8FC7\u8C03\u7528AddMonitor API\uFF0C\u53EF\u4EE5\u8BBE\u7F6E\u4E00\u4E2A\u5728\u542F\u52A8\u65F6\u52A0\u8F7D\u7684DLL\u3002\u8BE5DLL\u53EF\u5B58\u653E\u4E8EC:\\Windows\\System32\u76EE\u5F55\u4E0B\uFF0C\u5E76\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u7531\u6253\u5370\u540E\u53F0\u5904\u7406\u670D\u52A1spoolsv.exe\u4EE5SYSTEM\u6743\u9650\u52A0\u8F7D\u5E76\u6267\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/010\/"},{"id":"T1547.012","name":"\u6253\u5370\u5904\u7406\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u6253\u5370\u5904\u7406\u5668\u5728\u7CFB\u7EDF\u542F\u52A8\u65F6\u8FD0\u884C\u6076\u610FDLL\uFF0C\u4EE5\u5B9E\u73B0\u6301\u4E45\u5316\u548C\/\u6216\u6743\u9650\u63D0\u5347\u3002\u6253\u5370\u5904\u7406\u5668\u662F\u7531\u6253\u5370\u540E\u53F0\u5904\u7406\u7A0B\u5E8F\u670D\u52A1spoolsv.exe\u5728\u542F\u52A8\u671F\u95F4\u52A0\u8F7D\u7684DLL\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/012\/"},{"id":"T1547.013","name":"XDG \u81EA\u52A8\u542F\u52A8\u6761\u76EE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6DFB\u52A0\u6216\u4FEE\u6539XDG\u81EA\u542F\u52A8\u6761\u76EE\uFF0C\u4EE5\u4FBF\u5728\u7528\u6237\u767B\u5F55\u65F6\u52A0\u8F7D\u684C\u9762\u73AF\u5883\u65F6\u6267\u884C\u6076\u610F\u7A0B\u5E8F\u6216\u547D\u4EE4\u3002XDG\u81EA\u542F\u52A8\u6761\u76EE\u9002\u7528\u4E8E\u4EFB\u4F55\u7B26\u5408XDG\u6807\u51C6\u7684Linux\u7CFB\u7EDF\u3002XDG\u81EA\u542F\u52A8\u6761\u76EE\u4F7F\u7528\u684C\u9762\u6761\u76EE\u6587\u4EF6\uFF08.desktop\uFF09\u6765\u914D\u7F6E\u7528\u6237\u767B\u5F55\u65F6\u7684\u684C\u9762\u73AF\u5883\u3002\u8FD9\u4E9B\u914D\u7F6E\u6587\u4EF6\u51B3\u5B9A\u4E86\u7528\u6237\u767B\u5F55\u65F6\u542F\u52A8\u54EA\u4E9B\u5E94\u7528\u7A0B\u5E8F\uFF0C\u5B9A\u4E49\u4E86\u6253\u5F00\u7279\u5B9A\u6587\u4EF6\u7C7B\u578B\u7684\u5173\u8054\u5E94\u7528\u7A0B\u5E8F\uFF0C\u4EE5\u53CA\u7528\u4E8E\u6253\u5F00\u53EF\u79FB\u52A8\u5A92\u4F53\u7684\u5E94\u7528\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/013\/"},{"id":"T1547.014","name":"Active Setup","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5411\u672C\u5730\u8BA1\u7B97\u673A\u7684Active Setup\u6DFB\u52A0\u6CE8\u518C\u8868\u9879\u6765\u5B9E\u73B0\u6301\u4E45\u5316\u3002Active Setup\u662FWindows\u7684\u4E00\u79CD\u673A\u5236\uFF0C\u7528\u4E8E\u5728\u7528\u6237\u767B\u5F55\u65F6\u6267\u884C\u7A0B\u5E8F\u3002\u5B58\u50A8\u5728\u6CE8\u518C\u8868\u9879\u4E2D\u7684\u503C\u5C06\u5728\u7528\u6237\u767B\u5F55\u8BA1\u7B97\u673A\u540E\u6267\u884C\u3002\u8FD9\u4E9B\u7A0B\u5E8F\u5C06\u5728\u7528\u6237\u4E0A\u4E0B\u6587\u4E0B\u8FD0\u884C\uFF0C\u5E76\u5177\u6709\u8BE5\u8D26\u6237\u76F8\u5E94\u7684\u6743\u9650\u7EA7\u522B\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/014\/"},{"id":"T1547.015","name":"\u767B\u5F55\u9879","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6DFB\u52A0\u767B\u5F55\u9879\uFF0C\u5728\u7528\u6237\u767B\u5F55\u65F6\u81EA\u52A8\u6267\u884C\uFF0C\u4EE5\u5B9E\u73B0\u6301\u4E45\u5316\u6216\u63D0\u5347\u6743\u9650\u3002\u767B\u5F55\u9879\u6307\u7684\u662F\u5E94\u7528\u7A0B\u5E8F\u3001\u6587\u6863\u3001\u6587\u4EF6\u5939\u6216\u670D\u52A1\u5668\u8FDE\u63A5\uFF0C\u8FD9\u4E9B\u4F1A\u5728\u7528\u6237\u767B\u5F55\u65F6\u81EA\u52A8\u542F\u52A8\u3002\u767B\u5F55\u9879\u53EF\u4EE5\u901A\u8FC7\u5171\u4EAB\u6587\u4EF6\u5217\u8868\u6216\u670D\u52A1\u7BA1\u7406\u6846\u67B6\u6DFB\u52A0\u3002\u5171\u4EAB\u6587\u4EF6\u5217\u8868\u767B\u5F55\u9879\u53EF\u4EE5\u4F7F\u7528AppleScript\u7B49\u811A\u672C\u8BED\u8A00\u8FDB\u884C\u8BBE\u7F6E\uFF0C\u800C\u670D\u52A1\u7BA1\u7406\u6846\u67B6\u5219\u901A\u8FC7API\u8C03\u7528SMLoginItemSetEnabled\u6765\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/015\/"},{"id":"T1547","name":"\u542F\u52A8\u6216\u767B\u5F55\u81EA\u52A8\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u914D\u7F6E\u7CFB\u7EDF\u8BBE\u7F6E\uFF0C\u5728\u7CFB\u7EDF\u542F\u52A8\u6216\u767B\u5F55\u65F6\u81EA\u52A8\u6267\u884C\u7A0B\u5E8F\uFF0C\u4EE5\u7EF4\u6301\u5176\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E2D\u7684\u6301\u4E45\u6027\uFF0C\u6216\u83B7\u53D6\u66F4\u9AD8\u7EA7\u522B\u7684\u6743\u9650\u3002\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u5177\u5907\u5728\u7CFB\u7EDF\u542F\u52A8\u6216\u8D26\u6237\u767B\u5F55\u65F6\u81EA\u52A8\u8FD0\u884C\u7A0B\u5E8F\u7684\u673A\u5236\uFF0C\u8FD9\u4E9B\u673A\u5236\u53EF\u80FD\u5305\u62EC\u81EA\u52A8\u6267\u884C\u653E\u7F6E\u5728\u7279\u5B9A\u76EE\u5F55\u4E2D\u7684\u7A0B\u5E8F\uFF0C\u6216\u5F15\u7528\u5B58\u50A8\u914D\u7F6E\u4FE1\u606F\u7684\u4ED3\u5E93\uFF08\u5982Windows\u6CE8\u518C\u8868\uFF09\u4E2D\u7684\u7A0B\u5E8F\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u6216\u6269\u5C55\u5185\u6838\u529F\u80FD\u6765\u5B9E\u73B0\u76F8\u540C\u76EE\u7684\u3002","sub-techniques":"T1547.001, T1547.002, T1547.003, T1547.004, T1547.005, T1547.006, T1547.007, T1547.008, T1547.009, T1547.010, T1547.012, T1547.013, T1547.014, T1547.015","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1547\/"},{"id":"T1548.001","name":"Setuid\u4E0ESetgid","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5E94\u7528\u7A0B\u5E8F\u8BBE\u7F6E\u4E86setuid\u6216setgid\u4F4D\u7684\u914D\u7F6E\uFF0C\u4EE5\u4FBF\u5728\u53E6\u4E00\u4E2A\uFF08\u53EF\u80FD\u6743\u9650\u66F4\u9AD8\u7684\uFF09\u7528\u6237\u4E0A\u4E0B\u6587\u4E2D\u8FD0\u884C\u4EE3\u7801\u3002\u5728Linux\u6216macOS\u7CFB\u7EDF\u4E2D\uFF0C\u5F53\u5E94\u7528\u7A0B\u5E8F\u4E8C\u8FDB\u5236\u6587\u4EF6\u8BBE\u7F6E\u4E86setuid\u6216setgid\u4F4D\u65F6\uFF0C\u8BE5\u5E94\u7528\u7A0B\u5E8F\u5C06\u5206\u522B\u4EE5\u6587\u4EF6\u6240\u6709\u8005\u7528\u6237\u6216\u7EC4\u7684\u6743\u9650\u8FD0\u884C\u3002\u901A\u5E38\u60C5\u51B5\u4E0B\uFF0C\u65E0\u8BBA\u5E94\u7528\u7A0B\u5E8F\u5F52\u54EA\u4E2A\u7528\u6237\u6216\u7EC4\u6240\u6709\uFF0C\u5B83\u90FD\u5728\u5F53\u524D\u7528\u6237\u7684\u4E0A\u4E0B\u6587\u4E2D\u8FD0\u884C\u3002\u7136\u800C\uFF0C\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u7A0B\u5E8F\u9700\u8981\u5728\u63D0\u5347\u7684\u4E0A\u4E0B\u6587\u4E2D\u6267\u884C\u624D\u80FD\u6B63\u5E38\u5DE5\u4F5C\uFF0C\u4F46\u8FD0\u884C\u5B83\u4EEC\u7684\u7528\u6237\u53EF\u80FD\u4E0D\u5177\u5907\u6240\u9700\u7684\u5177\u4F53\u6743\u9650\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/001\/"},{"id":"T1548.002","name":"\u7ED5\u8FC7\u7528\u6237\u8D26\u6237\u63A7\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7ED5\u8FC7\u7528\u6237\u8D26\u6237\u63A7\u5236\uFF08UAC\uFF09\u673A\u5236\u6765\u63D0\u5347\u7CFB\u7EDF\u8FDB\u7A0B\u6743\u9650\u3002Windows\u7528\u6237\u8D26\u6237\u63A7\u5236\uFF08UAC\uFF09\u5141\u8BB8\u7A0B\u5E8F\u63D0\u5347\u5176\u6743\u9650\uFF08\u4EE5\u5B8C\u6574\u6027\u7EA7\u522B\u4ECE\u4F4E\u5230\u9AD8\u8FDB\u884C\u8DDF\u8E2A\uFF09\uFF0C\u4EE5\u4FBF\u5728\u7BA1\u7406\u5458\u7EA7\u522B\u6743\u9650\u4E0B\u6267\u884C\u4EFB\u52A1\uFF0C\u8FD9\u901A\u5E38\u901A\u8FC7\u63D0\u793A\u7528\u6237\u786E\u8BA4\u6765\u5B9E\u73B0\u3002\u5BF9\u7528\u6237\u7684\u5F71\u54CD\u8303\u56F4\u5305\u62EC\uFF1A\u5728\u9AD8\u5F3A\u5236\u7EA7\u522B\u4E0B\u62D2\u7EDD\u64CD\u4F5C\uFF1B\u5982\u679C\u7528\u6237\u5C5E\u4E8E\u672C\u5730\u7BA1\u7406\u5458\u7EC4\u5E76\u901A\u8FC7\u70B9\u51FB\u63D0\u793A\u6216\u8F93\u5165\u7BA1\u7406\u5458\u5BC6\u7801\u6765\u5B8C\u6210\u64CD\u4F5C\uFF0C\u5219\u5141\u8BB8\u7528\u6237\u6267\u884C\u8BE5\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/002\/"},{"id":"T1548.003","name":"Sudo\u4E0ESudo\u7F13\u5B58","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7sudo\u7F13\u5B58\u548C\/\u6216\u5229\u7528sudoers\u6587\u4EF6\u6765\u63D0\u5347\u6743\u9650\u3002\u4ED6\u4EEC\u8FD9\u6837\u505A\u662F\u4E3A\u4E86\u4EE5\u5176\u4ED6\u7528\u6237\u8EAB\u4EFD\u6267\u884C\u547D\u4EE4\uFF0C\u6216\u751F\u6210\u5177\u6709\u66F4\u9AD8\u6743\u9650\u7684\u8FDB\u7A0B\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/003\/"},{"id":"T1548.004","name":"\u9AD8\u6548\u6267\u884C\uFF0C\u5373\u523B\u54CD\u5E94","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528AuthorizationExecuteWithPrivileges API\uFF0C\u901A\u8FC7\u63D0\u793A\u7528\u6237\u8F93\u5165\u51ED\u8BC1\u6765\u63D0\u5347\u6743\u9650\u3002\u8BE5API\u7684\u8BBE\u8BA1\u521D\u8877\u662F\u4E3A\u5E94\u7528\u7A0B\u5E8F\u5F00\u53D1\u8005\u63D0\u4F9B\u4E00\u79CD\u7B80\u4FBF\u65B9\u5F0F\uFF0C\u4EE5\u6267\u884C\u9700\u8981root\u6743\u9650\u7684\u64CD\u4F5C\uFF0C\u4F8B\u5982\u5E94\u7528\u7A0B\u5E8F\u5B89\u88C5\u6216\u66F4\u65B0\u3002\u7136\u800C\uFF0C\u6B64API\u4E0D\u4F1A\u9A8C\u8BC1\u8BF7\u6C42root\u6743\u9650\u7684\u7A0B\u5E8F\u662F\u5426\u6765\u81EA\u53EF\u4FE1\u6765\u6E90\uFF0C\u6216\u662F\u5426\u5DF2\u88AB\u6076\u610F\u7BE1\u6539\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/004\/"},{"id":"T1548.005","name":"\u4E34\u65F6\u63D0\u5347\u4E91\u8BBF\u95EE\u6743\u9650","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u6743\u9650\u914D\u7F6E\uFF0C\u4EE5\u83B7\u53D6\u5BF9\u4E91\u8D44\u6E90\u7684\u4E34\u65F6\u63D0\u5347\u8BBF\u95EE\u6743\u9650\u3002\u8BB8\u591A\u4E91\u73AF\u5883\u5141\u8BB8\u7BA1\u7406\u5458\u6388\u4E88\u7528\u6237\u6216\u670D\u52A1\u8D26\u6237\u6743\u9650\uFF0C\u4F7F\u5176\u80FD\u591F\u8BF7\u6C42\u5373\u65F6\u8BBF\u95EE\u89D2\u8272\u3001\u6A21\u62DF\u5176\u4ED6\u8D26\u6237\u3001\u5C06\u89D2\u8272\u4F20\u9012\u7ED9\u8D44\u6E90\u548C\u670D\u52A1\uFF0C\u6216\u4EE5\u5176\u4ED6\u65B9\u5F0F\u83B7\u5F97\u77ED\u671F\u8BBF\u95EE\u6743\u9650\uFF0C\u8FD9\u4E9B\u6743\u9650\u53EF\u80FD\u4E0E\u5176\u81EA\u8EAB\u6743\u9650\u4E0D\u540C\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/005\/"},{"id":"T1548.006","name":"TCC \u64CD\u7EB5","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u64CD\u7EB5\u6216\u6EE5\u7528\u900F\u660E\u5EA6\u3001\u540C\u610F\u4E0E\u63A7\u5236\uFF08TCC\uFF09\u670D\u52A1\u6216\u6570\u636E\u5E93\uFF0C\u4E3A\u6076\u610F\u53EF\u6267\u884C\u6587\u4EF6\u6388\u4E88\u63D0\u5347\u7684\u6743\u9650\u3002TCC\u662FmacOS\u4E2D\u7684\u4E00\u9879\u9690\u79C1\u4E0E\u5B89\u5168\u63A7\u5236\u673A\u5236\uFF0C\u7528\u4E8E\u786E\u5B9A\u8FD0\u884C\u4E2D\u7684\u8FDB\u7A0B\u662F\u5426\u6709\u6743\u8BBF\u95EE\u53D7TCC\u4FDD\u62A4\u7684\u6570\u636E\u6216\u670D\u52A1\uFF0C\u4F8B\u5982\u5C4F\u5E55\u5171\u4EAB\u3001\u6444\u50CF\u5934\u3001\u9EA6\u514B\u98CE\u6216\u5168\u78C1\u76D8\u8BBF\u95EE\uFF08FDA\uFF09\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/006\/"},{"id":"T1548","name":"\u6EE5\u7528\u6743\u9650\u63D0\u5347\u63A7\u5236\u673A\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7ED5\u8FC7\u65E8\u5728\u63A7\u5236\u6743\u9650\u63D0\u5347\u7684\u673A\u5236\uFF0C\u4EE5\u83B7\u53D6\u66F4\u9AD8\u7EA7\u522B\u7684\u6743\u9650\u3002\u5927\u591A\u6570\u73B0\u4EE3\u7CFB\u7EDF\u90FD\u5185\u7F6E\u4E86\u539F\u751F\u6743\u9650\u63D0\u5347\u63A7\u5236\u673A\u5236\uFF0C\u65E8\u5728\u9650\u5236\u7528\u6237\u5728\u673A\u5668\u4E0A\u53EF\u6267\u884C\u7684\u6743\u9650\u3002\u5FC5\u987B\u6388\u4E88\u7279\u5B9A\u7528\u6237\u6388\u6743\uFF0C\u624D\u80FD\u6267\u884C\u90A3\u4E9B\u88AB\u89C6\u4E3A\u9AD8\u98CE\u9669\u7684\u4EFB\u52A1\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u591A\u79CD\u65B9\u6CD5\u6765\u5229\u7528\u5185\u7F6E\u7684\u63A7\u5236\u673A\u5236\uFF0C\u4ECE\u800C\u5728\u7CFB\u7EDF\u4E0A\u63D0\u5347\u6743\u9650\u3002","sub-techniques":"T1548.001, T1548.002, T1548.003, T1548.004, T1548.005, T1548.006","tactic":"\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1548\/"},{"id":"T1550.001","name":"\u5E94\u7528\u8BBF\u95EE\u4EE4\u724C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7A83\u53D6\u7684\u5E94\u7528\u8BBF\u95EE\u4EE4\u724C\u7ED5\u8FC7\u5E38\u89C4\u8EAB\u4EFD\u9A8C\u8BC1\u6D41\u7A0B\uFF0C\u8BBF\u95EE\u8FDC\u7A0B\u7CFB\u7EDF\u4E2D\u7684\u53D7\u9650\u8D26\u6237\u3001\u4FE1\u606F\u6216\u670D\u52A1\u3002\u8FD9\u4E9B\u4EE4\u724C\u901A\u5E38\u4ECE\u7528\u6237\u6216\u670D\u52A1\u5904\u7A83\u53D6\uFF0C\u5E76\u7528\u4E8E\u66FF\u4EE3\u767B\u5F55\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u6A2A\u5411\u79FB\u52A8","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1550\/001\/"},{"id":"T1550.002","name":"\u4F20\u9012\u54C8\u5E0C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7A83\u53D6\u7684\u5BC6\u7801\u54C8\u5E0C\u503C\u8FDB\u884C\"\u54C8\u5E0C\u4F20\u9012\"\uFF0C\u5728\u73AF\u5883\u4E2D\u6A2A\u5411\u79FB\u52A8\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u6B63\u5E38\u7684\u7CFB\u7EDF\u8BBF\u95EE\u63A7\u5236\u3002\u54C8\u5E0C\u4F20\u9012\u662F\u4E00\u79CD\u65E0\u9700\u83B7\u53D6\u7528\u6237\u660E\u6587\u5BC6\u7801\u5373\u53EF\u9A8C\u8BC1\u7528\u6237\u8EAB\u4EFD\u7684\u65B9\u6CD5\u3002\u8BE5\u6280\u672F\u7ED5\u8FC7\u4E86\u9700\u8981\u660E\u6587\u5BC6\u7801\u7684\u6807\u51C6\u8BA4\u8BC1\u6B65\u9AA4\uFF0C\u76F4\u63A5\u8FDB\u5165\u4F7F\u7528\u5BC6\u7801\u54C8\u5E0C\u8FDB\u884C\u9A8C\u8BC1\u7684\u8BA4\u8BC1\u73AF\u8282\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1550\/002\/"},{"id":"T1550.003","name":"\u4F20\u9012\u7968\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7A83\u53D6\u7684Kerberos\u7968\u636E\"\u4F20\u9012\u7968\u636E\"\uFF0C\u5728\u73AF\u5883\u4E2D\u6A2A\u5411\u79FB\u52A8\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u6B63\u5E38\u7684\u7CFB\u7EDF\u8BBF\u95EE\u63A7\u5236\u3002\u4F20\u9012\u7968\u636E\uFF08PtT\uFF09\u662F\u4E00\u79CD\u65E0\u9700\u8D26\u6237\u5BC6\u7801\u5373\u53EF\u4F7F\u7528Kerberos\u7968\u636E\u5411\u7CFB\u7EDF\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u7684\u65B9\u6CD5\u3002Kerberos\u8EAB\u4EFD\u9A8C\u8BC1\u53EF\u4F5C\u4E3A\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u7B2C\u4E00\u6B65\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1550\/003\/"},{"id":"T1550.004","name":"\u7F51\u7EDC\u4F1A\u8BDDCookie","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u5229\u7528\u7A83\u53D6\u7684\u4F1A\u8BDDcookie\u5BF9\u7F51\u7EDC\u5E94\u7528\u548C\u670D\u52A1\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002\u7531\u4E8E\u4F1A\u8BDD\u5DF2\u7ECF\u8FC7\u8BA4\u8BC1\uFF0C\u8FD9\u79CD\u6280\u672F\u53EF\u4EE5\u7ED5\u8FC7\u67D0\u4E9B\u591A\u56E0\u7D20\u8EAB\u4EFD\u9A8C\u8BC1\u534F\u8BAE\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u6A2A\u5411\u79FB\u52A8","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1550\/004\/"},{"id":"T1550","name":"\u4F7F\u7528\u66FF\u4EE3\u8EAB\u4EFD\u9A8C\u8BC1\u6750\u6599","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u66FF\u4EE3\u8BA4\u8BC1\u6750\u6599\uFF0C\u5982\u5BC6\u7801\u54C8\u5E0C\u3001Kerberos\u7968\u636E\u548C\u5E94\u7528\u7A0B\u5E8F\u8BBF\u95EE\u4EE4\u724C\uFF0C\u5728\u73AF\u5883\u4E2D\u6A2A\u5411\u79FB\u52A8\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u6B63\u5E38\u7684\u7CFB\u7EDF\u8BBF\u95EE\u63A7\u5236\u3002","sub-techniques":"T1550.001, T1550.002, T1550.003, T1550.004","tactic":"\u9632\u5FA1\u89C4\u907F,\u6A2A\u5411\u79FB\u52A8","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1550\/"},{"id":"T1552.001","name":"\u6587\u4EF6\u4E2D\u7684\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u672C\u5730\u6587\u4EF6\u7CFB\u7EDF\u548C\u8FDC\u7A0B\u6587\u4EF6\u5171\u4EAB\uFF0C\u4EE5\u5BFB\u627E\u5305\u542B\u4E0D\u5B89\u5168\u5B58\u50A8\u51ED\u636E\u7684\u6587\u4EF6\u3002\u8FD9\u4E9B\u6587\u4EF6\u53EF\u80FD\u662F\u7528\u6237\u4E3A\u5B58\u50A8\u81EA\u5DF1\u7684\u51ED\u636E\u800C\u521B\u5EFA\u7684\uFF0C\u4E5F\u53EF\u80FD\u662F\u4F9B\u4E00\u7EC4\u4E2A\u4EBA\u4F7F\u7528\u7684\u5171\u4EAB\u51ED\u636E\u5B58\u50A8\uFF0C\u6216\u662F\u5305\u542B\u7CFB\u7EDF\u6216\u670D\u52A1\u5BC6\u7801\u7684\u914D\u7F6E\u6587\u4EF6\uFF0C\u4EE5\u53CA\u5305\u542B\u5D4C\u5165\u5F0F\u5BC6\u7801\u7684\u6E90\u4EE3\u7801\u6216\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/001\/"},{"id":"T1552.002","name":"\u6CE8\u518C\u8868\u4E2D\u7684\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4E2D\u641C\u7D22\u6CE8\u518C\u8868\uFF0C\u4EE5\u5BFB\u627E\u4E0D\u5B89\u5168\u5B58\u50A8\u7684\u51ED\u636E\u3002Windows\u6CE8\u518C\u8868\u5B58\u50A8\u4E86\u7CFB\u7EDF\u6216\u5176\u4ED6\u7A0B\u5E8F\u53EF\u80FD\u4F7F\u7528\u7684\u914D\u7F6E\u4FE1\u606F\u3002\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u67E5\u8BE2\u6CE8\u518C\u8868\uFF0C\u5BFB\u627E\u5176\u4ED6\u7A0B\u5E8F\u6216\u670D\u52A1\u5B58\u50A8\u7684\u51ED\u636E\u548C\u5BC6\u7801\u3002\u6709\u65F6\u8FD9\u4E9B\u51ED\u636E\u7528\u4E8E\u81EA\u52A8\u767B\u5F55\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/002\/"},{"id":"T1552.003","name":"Shell \u5386\u53F2\u8BB0\u5F55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4E2D\u641C\u7D22\u547D\u4EE4\u5386\u53F2\u8BB0\u5F55\uFF0C\u4EE5\u5BFB\u627E\u4E0D\u5B89\u5168\u5B58\u50A8\u7684\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/003\/"},{"id":"T1552.004","name":"\u79C1\u94A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4E2D\u641C\u7D22\u79C1\u94A5\u8BC1\u4E66\u6587\u4EF6\uFF0C\u4EE5\u83B7\u53D6\u4E0D\u5B89\u5168\u5B58\u50A8\u7684\u51ED\u636E\u3002\u79C1\u5BC6\u52A0\u5BC6\u5BC6\u94A5\u548C\u8BC1\u4E66\u7528\u4E8E\u8EAB\u4EFD\u9A8C\u8BC1\u3001\u52A0\u5BC6\/\u89E3\u5BC6\u4EE5\u53CA\u6570\u5B57\u7B7E\u540D\u3002\u5E38\u89C1\u7684\u5BC6\u94A5\u548C\u8BC1\u4E66\u6587\u4EF6\u6269\u5C55\u540D\u5305\u62EC\uFF1A.key\u3001.pgp\u3001.gpg\u3001.ppk\u3001.p12\u3001.pem\u3001.pfx\u3001.cer\u3001.p7b\u3001.asc\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/004\/"},{"id":"T1552.005","name":"\u4E91\u5B9E\u4F8B\u5143\u6570\u636EAPI","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u8BBF\u95EE\u4E91\u5B9E\u4F8B\u5143\u6570\u636EAPI\uFF0C\u4EE5\u6536\u96C6\u51ED\u8BC1\u548C\u5176\u4ED6\u654F\u611F\u6570\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/005\/"},{"id":"T1552.006","name":"\u7EC4\u7B56\u7565\u9996\u9009\u9879","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5728\u7EC4\u7B56\u7565\u9996\u9009\u9879\uFF08GPP\uFF09\u4E2D\u5BFB\u627E\u672A\u53D7\u4FDD\u62A4\u7684\u51ED\u636E\u3002GPP\u662F\u5141\u8BB8\u7BA1\u7406\u5458\u521B\u5EFA\u5305\u542B\u5D4C\u5165\u5F0F\u51ED\u636E\u7684\u57DF\u7B56\u7565\u7684\u5DE5\u5177\u3002\u8FD9\u4E9B\u7B56\u7565\u4F7F\u7BA1\u7406\u5458\u80FD\u591F\u8BBE\u7F6E\u672C\u5730\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/006\/"},{"id":"T1552.007","name":"\u5BB9\u5668API","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5BB9\u5668\u73AF\u5883\u5185\u7684API\u6536\u96C6\u51ED\u636E\u3002\u8FD9\u4E9B\u73AF\u5883\u4E2D\u7684API\uFF0C\u5982Docker API\u548CKubernetes API\uFF0C\u5141\u8BB8\u7528\u6237\u8FDC\u7A0B\u7BA1\u7406\u5176\u5BB9\u5668\u8D44\u6E90\u548C\u96C6\u7FA4\u7EC4\u4EF6\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/007\/"},{"id":"T1552.008","name":"\u804A\u5929\u6D88\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u76F4\u63A5\u6536\u96C6\u5B58\u50A8\u6216\u901A\u8FC7\u7528\u6237\u901A\u4FE1\u670D\u52A1\u4F20\u9012\u7684\u672A\u53D7\u4FDD\u62A4\u7684\u51ED\u636E\u3002\u8FD9\u4E9B\u51ED\u636E\u53EF\u80FD\u901A\u8FC7\u7528\u6237\u804A\u5929\u901A\u4FE1\u5E94\u7528\u7A0B\u5E8F\u53D1\u9001\u548C\u5B58\u50A8\uFF0C\u4F8B\u5982\u7535\u5B50\u90AE\u4EF6\u3001Slack\u6216Teams\u7B49\u804A\u5929\u670D\u52A1\u3001Jira\u6216Trello\u7B49\u534F\u4F5C\u5DE5\u5177\uFF0C\u4EE5\u53CA\u5176\u4ED6\u4EFB\u4F55\u652F\u6301\u7528\u6237\u901A\u4FE1\u7684\u670D\u52A1\u3002\u7528\u6237\u53EF\u80FD\u5728\u79C1\u5BC6\u6216\u516C\u5F00\u7684\u4F01\u4E1A\u5185\u90E8\u901A\u4FE1\u6E20\u9053\u4E0A\u5206\u4EAB\u5404\u79CD\u5F62\u5F0F\u7684\u51ED\u636E\uFF08\u5982\u7528\u6237\u540D\u548C\u5BC6\u7801\u3001API\u5BC6\u94A5\u6216\u8EAB\u4EFD\u9A8C\u8BC1\u4EE4\u724C\uFF09\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/008\/"},{"id":"T1552","name":"\u672A\u53D7\u4FDD\u62A4\u7684\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u53D7\u611F\u67D3\u7CFB\u7EDF\uFF0C\u4EE5\u53D1\u73B0\u5E76\u83B7\u53D6\u4E0D\u5B89\u5168\u5B58\u50A8\u7684\u51ED\u636E\u3002\u8FD9\u4E9B\u51ED\u636E\u53EF\u80FD\u88AB\u5B58\u50A8\u6216\u8BEF\u7F6E\u4E8E\u7CFB\u7EDF\u7684\u591A\u4E2A\u4F4D\u7F6E\uFF0C\u5305\u62EC\u7EAF\u6587\u672C\u6587\u4EF6\uFF08\u4F8B\u5982Shell\u5386\u53F2\u8BB0\u5F55\uFF09\u3001\u64CD\u4F5C\u7CFB\u7EDF\u6216\u5E94\u7528\u7A0B\u5E8F\u7279\u5B9A\u7684\u5B58\u50A8\u5E93\uFF08\u4F8B\u5982\u6CE8\u518C\u8868\u4E2D\u7684\u51ED\u636E\uFF09\uFF0C\u6216\u5176\u4ED6\u4E13\u95E8\u7684\u6587\u4EF6\/\u5DE5\u4EF6\uFF08\u4F8B\u5982\u79C1\u94A5\uFF09\u3002","sub-techniques":"T1552.001, T1552.002, T1552.003, T1552.004, T1552.005, T1552.006, T1552.007, T1552.008","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1552\/"},{"id":"T1553.001","name":"\u95E8\u536B\u7ED5\u8FC7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u6587\u4EF6\u5C5E\u6027\u5E76\u7ED5\u8FC7Gatekeeper\u529F\u80FD\uFF0C\u4EE5\u89C4\u907F\u7528\u6237\u63D0\u793A\u5E76\u6267\u884C\u4E0D\u53D7\u4FE1\u4EFB\u7684\u7A0B\u5E8F\u3002Gatekeeper\u662F\u4E00\u5957\u6280\u672F\u7EC4\u5408\uFF0C\u4F5C\u4E3A\u82F9\u679C\u5B89\u5168\u6A21\u578B\u7684\u4E00\u5C42\uFF0C\u65E8\u5728\u786E\u4FDD\u4E3B\u673A\u4E0A\u4EC5\u6267\u884C\u53D7\u4FE1\u4EFB\u7684\u5E94\u7528\u7A0B\u5E8F\u3002\u8BE5\u6280\u672F\u6700\u521D\u6784\u5EFA\u4E8E\u96EA\u8C79\u7CFB\u7EDF\uFF0810.6\u7248\u672C\uFF0C2009\u5E74\uFF09\u7684\u6587\u4EF6\u9694\u79BB\u673A\u5236\u4E4B\u4E0A\uFF0C\u73B0\u5DF2\u6269\u5C55\u81F3\u5305\u542B\u4EE3\u7801\u7B7E\u540D\u3001\u5B89\u5168\u7B56\u7565\u5408\u89C4\u6027\u3001\u516C\u8BC1\u670D\u52A1\u7B49\u591A\u4E2A\u65B9\u9762\u3002Gatekeeper\u8FD8\u4F1A\u5BF9\u9996\u6B21\u8FD0\u884C\u7684\u5E94\u7528\u7A0B\u5E8F\u4E0E\u91CD\u65B0\u6253\u5F00\u7684\u5E94\u7528\u7A0B\u5E8F\u91C7\u53D6\u4E0D\u540C\u7684\u5904\u7406\u65B9\u5F0F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/001\/"},{"id":"T1553.002","name":"\u4EE3\u7801\u7B7E\u540D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u521B\u5EFA\u3001\u83B7\u53D6\u6216\u7A83\u53D6\u4EE3\u7801\u7B7E\u540D\u6750\u6599\uFF0C\u4EE5\u5BF9\u5176\u6076\u610F\u8F6F\u4EF6\u6216\u5DE5\u5177\u8FDB\u884C\u7B7E\u540D\u3002\u4EE3\u7801\u7B7E\u540D\u63D0\u4F9B\u4E86\u6765\u81EA\u5F00\u53D1\u8005\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E00\u5B9A\u7A0B\u5EA6\u7684\u771F\u5B9E\u6027\u4FDD\u8BC1\uFF0C\u5E76\u786E\u4FDD\u8BE5\u6587\u4EF6\u672A\u88AB\u7BE1\u6539\u3002\u5728\u64CD\u4F5C\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u7684\u8BC1\u4E66\u53EF\u80FD\u662F\u653B\u51FB\u8005\u521B\u5EFA\u3001\u83B7\u53D6\u6216\u7A83\u53D6\u7684\u3002\u4E0E\u65E0\u6548\u4EE3\u7801\u7B7E\u540D\u4E0D\u540C\uFF0C\u6B64\u7C7B\u6D3B\u52A8\u5C06\u4EA7\u751F\u6709\u6548\u7684\u7B7E\u540D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/002\/"},{"id":"T1553.003","name":"SIP\u4E0E\u4FE1\u4EFB\u63D0\u4F9B\u8005\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7BE1\u6539SIP\u548C\u4FE1\u4EFB\u63D0\u4F9B\u8005\u7EC4\u4EF6\uFF0C\u4EE5\u5728\u64CD\u4F5C\u7CFB\u7EDF\u548C\u5E94\u7528\u63A7\u5236\u5DE5\u5177\u6267\u884C\u7B7E\u540D\u9A8C\u8BC1\u68C0\u67E5\u65F6\u8BEF\u5BFC\u5B83\u4EEC\u3002\u5728\u7528\u6237\u6A21\u5F0F\u4E0B\uFF0CWindows Authenticode\u6570\u5B57\u7B7E\u540D\u7528\u4E8E\u9A8C\u8BC1\u6587\u4EF6\u7684\u6765\u6E90\u548C\u5B8C\u6574\u6027\uFF0C\u8FD9\u4E9B\u53D8\u91CF\u53EF\u7528\u4E8E\u5EFA\u7ACB\u5BF9\u7B7E\u540D\u4EE3\u7801\u7684\u4FE1\u4EFB\uFF08\u4F8B\u5982\uFF1A\u5177\u6709\u6709\u6548\u5FAE\u8F6F\u7B7E\u540D\u7684\u9A71\u52A8\u7A0B\u5E8F\u53EF\u80FD\u88AB\u89C6\u4E3A\u5B89\u5168\uFF09\u3002\u7B7E\u540D\u9A8C\u8BC1\u8FC7\u7A0B\u901A\u8FC7WinVerifyTrust\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\u51FD\u6570\u5904\u7406\uFF0C\u8BE5\u51FD\u6570\u63A5\u53D7\u67E5\u8BE2\u5E76\u4E0E\u76F8\u5E94\u7684\u4FE1\u4EFB\u63D0\u4F9B\u8005\u534F\u8C03\uFF0C\u540E\u8005\u8D1F\u8D23\u9A8C\u8BC1\u7B7E\u540D\u7684\u53C2\u6570\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/003\/"},{"id":"T1553.004","name":"\u5B89\u88C5\u6839\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4E0A\u5B89\u88C5\u6839\u8BC1\u4E66\uFF0C\u4EE5\u907F\u514D\u8FDE\u63A5\u5230\u53D7\u5176\u63A7\u5236\u7684\u7F51\u7EDC\u670D\u52A1\u5668\u65F6\u51FA\u73B0\u8B66\u544A\u3002\u6839\u8BC1\u4E66\u5728\u516C\u94A5\u52A0\u5BC6\u6280\u672F\u4E2D\u7528\u4E8E\u6807\u8BC6\u6839\u8BC1\u4E66\u9881\u53D1\u673A\u6784\uFF08CA\uFF09\u3002\u4E00\u65E6\u5B89\u88C5\u4E86\u6839\u8BC1\u4E66\uFF0C\u7CFB\u7EDF\u6216\u5E94\u7528\u7A0B\u5E8F\u5C06\u4FE1\u4EFB\u7531\u8BE5\u6839\u8BC1\u4E66\u7B7E\u53D1\u7684\u4FE1\u4EFB\u94FE\u4E2D\u7684\u6240\u6709\u8BC1\u4E66\u3002\u8BC1\u4E66\u901A\u5E38\u7528\u4E8E\u5728\u7F51\u9875\u6D4F\u89C8\u5668\u4E2D\u5EFA\u7ACB\u5B89\u5168\u7684TLS\/SSL\u901A\u4FE1\u3002\u5F53\u7528\u6237\u5C1D\u8BD5\u8BBF\u95EE\u4E00\u4E2A\u63D0\u4F9B\u4E0D\u53D7\u4FE1\u4EFB\u8BC1\u4E66\u7684\u7F51\u7AD9\u65F6\uFF0C\u6D4F\u89C8\u5668\u4F1A\u663E\u793A\u9519\u8BEF\u4FE1\u606F\u4EE5\u8B66\u544A\u7528\u6237\u5B58\u5728\u5B89\u5168\u98CE\u9669\u3002\u6839\u636E\u5B89\u5168\u8BBE\u7F6E\u7684\u4E0D\u540C\uFF0C\u6D4F\u89C8\u5668\u53EF\u80FD\u4F1A\u963B\u6B62\u7528\u6237\u4E0E\u8BE5\u7F51\u7AD9\u5EFA\u7ACB\u8FDE\u63A5\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/004\/"},{"id":"T1553.005","name":"Mark-of-the-Web \u7ED5\u8FC7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7279\u5B9A\u6587\u4EF6\u683C\u5F0F\u6765\u89C4\u907F\u7F51\u7EDC\u6807\u8BB0\uFF08MOTW\uFF09\u63A7\u5236\u3002\u5728Windows\u7CFB\u7EDF\u4E2D\uFF0C\u4ECE\u4E92\u8054\u7F51\u4E0B\u8F7D\u7684\u6587\u4EF6\u4F1A\u88AB\u6807\u8BB0\u4E00\u4E2A\u540D\u4E3AZone.Identifier\u7684\u9690\u85CFNTFS\u5907\u7528\u6570\u636E\u6D41\uFF08ADS\uFF09\uFF0C\u5176\u7279\u5B9A\u503C\u5373\u4E3AMOTW\u3002\u5E26\u6709MOTW\u6807\u8BB0\u7684\u6587\u4EF6\u53D7\u5230\u4FDD\u62A4\uFF0C\u65E0\u6CD5\u6267\u884C\u67D0\u4E9B\u64CD\u4F5C\u3002\u4F8B\u5982\uFF0C\u4ECEMS Office 10\u5F00\u59CB\uFF0C\u82E5MS Office\u6587\u4EF6\u5E26\u6709MOTW\u6807\u8BB0\uFF0C\u5C06\u5728\u53D7\u4FDD\u62A4\u89C6\u56FE\u4E2D\u6253\u5F00\u3002\u5E26\u6709MOTW\u6807\u8BB0\u7684\u53EF\u6267\u884C\u6587\u4EF6\u5C06\u7531Windows Defender SmartScreen\u5904\u7406\uFF0C\u8BE5\u529F\u80FD\u4F1A\u5C06\u6587\u4EF6\u4E0E\u5DF2\u77E5\u53EF\u6267\u884C\u6587\u4EF6\u7684\u5141\u8BB8\u5217\u8868\u8FDB\u884C\u6BD4\u8F83\u3002\u5982\u679C\u6587\u4EF6\u672A\u88AB\u8BC6\u522B\u6216\u4E0D\u53D7\u4FE1\u4EFB\uFF0CSmartScreen\u5C06\u963B\u6B62\u5176\u6267\u884C\u5E76\u8B66\u544A\u7528\u6237\u4E0D\u8981\u8FD0\u884C\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/005\/"},{"id":"T1553.006","name":"\u4EE3\u7801\u7B7E\u540D\u7B56\u7565\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u4EE3\u7801\u7B7E\u540D\u7B56\u7565\uFF0C\u4EE5\u5141\u8BB8\u6267\u884C\u672A\u7B7E\u540D\u6216\u81EA\u7B7E\u540D\u7684\u4EE3\u7801\u3002\u4EE3\u7801\u7B7E\u540D\u63D0\u4F9B\u4E86\u7A0B\u5E8F\u6765\u81EA\u5F00\u53D1\u8005\u7684\u771F\u5B9E\u6027\u4FDD\u8BC1\uFF0C\u5E76\u786E\u4FDD\u7A0B\u5E8F\u672A\u88AB\u7BE1\u6539\u3002\u5B89\u5168\u63A7\u5236\u63AA\u65BD\u53EF\u5305\u542B\u5F3A\u5236\u6267\u884C\u673A\u5236\uFF0C\u4EE5\u786E\u4FDD\u5728\u64CD\u4F5C\u7CFB\u7EDF\u4E0A\u4EC5\u80FD\u8FD0\u884C\u6709\u6548\u4E14\u7ECF\u8FC7\u7B7E\u540D\u7684\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/006\/"},{"id":"T1553","name":"\u98A0\u8986\u4FE1\u4EFB\u63A7\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7834\u574F\u90A3\u4E9B\u65E8\u5728\u8B66\u544A\u7528\u6237\u5B58\u5728\u4E0D\u53EF\u4FE1\u6D3B\u52A8\u6216\u963B\u6B62\u4E0D\u53EF\u4FE1\u7A0B\u5E8F\u6267\u884C\u7684\u5B89\u5168\u63A7\u5236\u63AA\u65BD\u3002\u64CD\u4F5C\u7CFB\u7EDF\u548C\u5B89\u5168\u4EA7\u54C1\u901A\u5E38\u5305\u542B\u8BC6\u522B\u7A0B\u5E8F\u6216\u7F51\u7AD9\u4FE1\u4EFB\u7EA7\u522B\u7684\u673A\u5236\u3002\u4F8B\u5982\uFF0C\u5141\u8BB8\u8FD0\u884C\u7ECF\u8FC7\u6709\u6548\u4EE3\u7801\u7B7E\u540D\u8BC1\u4E66\u7B7E\u540D\u7684\u7A0B\u5E8F\u3001\u56E0\u7A0B\u5E8F\u5177\u6709\u4ECE\u4E92\u8054\u7F51\u4E0B\u8F7D\u7684\u5C5E\u6027\u800C\u5411\u7528\u6237\u53D1\u51FA\u8B66\u544A\uFF0C\u6216\u5728\u5373\u5C06\u8FDE\u63A5\u81F3\u4E0D\u53EF\u4FE1\u7F51\u7AD9\u65F6\u83B7\u5F97\u63D0\u793A\uFF0C\u5747\u5C5E\u4E8E\u6B64\u7C7B\u5B89\u5168\u529F\u80FD\u7684\u4F53\u73B0\u3002","sub-techniques":"T1553.001, T1553.002, T1553.003, T1553.004, T1553.005, T1553.006","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1553\/"},{"id":"T1554","name":"\u59A5\u534F\u4E3B\u673A\u8F6F\u4EF6\u4E8C\u8FDB\u5236\u6587\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u4FEE\u6539\u4E3B\u673A\u8F6F\u4EF6\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF0C\u4EE5\u5EFA\u7ACB\u5BF9\u7CFB\u7EDF\u7684\u6301\u4E45\u8BBF\u95EE\u3002\u8F6F\u4EF6\u4E8C\u8FDB\u5236\u6587\u4EF6\/\u53EF\u6267\u884C\u6587\u4EF6\u63D0\u4F9B\u4E86\u5E7F\u6CDB\u7684\u7CFB\u7EDF\u547D\u4EE4\u6216\u670D\u52A1\u3001\u7A0B\u5E8F\u53CA\u5E93\u3002\u5E38\u89C1\u7684\u8F6F\u4EF6\u4E8C\u8FDB\u5236\u6587\u4EF6\u5305\u62ECSSH\u5BA2\u6237\u7AEF\u3001FTP\u5BA2\u6237\u7AEF\u3001\u7535\u5B50\u90AE\u4EF6\u5BA2\u6237\u7AEF\u3001\u7F51\u9875\u6D4F\u89C8\u5668\u4EE5\u53CA\u8BB8\u591A\u5176\u4ED6\u7528\u6237\u6216\u670D\u52A1\u5668\u5E94\u7528\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1554\/"},{"id":"T1555.001","name":"\u94A5\u5319\u6263","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u94A5\u5319\u4E32\u83B7\u53D6\u51ED\u8BC1\u3002\u94A5\u5319\u4E32\uFF08\u6216\u79F0\u94A5\u5319\u4E32\u670D\u52A1\uFF09\u662FmacOS\u7684\u51ED\u8BC1\u7BA1\u7406\u7CFB\u7EDF\uFF0C\u7528\u4E8E\u5B58\u50A8\u8D26\u6237\u540D\u3001\u5BC6\u7801\u3001\u79C1\u94A5\u3001\u8BC1\u4E66\u3001\u654F\u611F\u5E94\u7528\u6570\u636E\u3001\u652F\u4ED8\u6570\u636E\u53CA\u5B89\u5168\u5907\u6CE8\u3002\u94A5\u5319\u4E32\u5206\u4E3A\u4E09\u79CD\u7C7B\u578B\uFF1A\u767B\u5F55\u94A5\u5319\u4E32\u3001\u7CFB\u7EDF\u94A5\u5319\u4E32\u548C\u672C\u5730\u9879\u76EE\uFF08iCloud\uFF09\u94A5\u5319\u4E32\u3002\u9ED8\u8BA4\u7684\u94A5\u5319\u4E32\u662F\u767B\u5F55\u94A5\u5319\u4E32\uFF0C\u5B83\u5B58\u50A8\u7528\u6237\u5BC6\u7801\u53CA\u76F8\u5173\u4FE1\u606F\u3002\u7CFB\u7EDF\u94A5\u5319\u4E32\u5B58\u50A8\u64CD\u4F5C\u7CFB\u7EDF\u8BBF\u95EE\u7684\u9879\u76EE\uFF0C\u4F8B\u5982\u4E3B\u673A\u4E0A\u591A\u7528\u6237\u5171\u4EAB\u7684\u9879\u76EE\u3002\u672C\u5730\u9879\u76EE\uFF08iCloud\uFF09\u94A5\u5319\u4E32\u5219\u7528\u4E8E\u4E0E\u82F9\u679CiCloud\u670D\u52A1\u540C\u6B65\u7684\u9879\u76EE\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/001\/"},{"id":"T1555.002","name":"\u5B89\u5168\u5185\u5B58","description":"\u62E5\u6709\u6839\u6743\u9650\u7684\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8BFB\u53D6securityd\u7684\u5185\u5B58\u6765\u6536\u96C6\u51ED\u8BC1\u3002securityd\u662F\u4E00\u9879\u8D1F\u8D23\u5B9E\u65BD\u52A0\u5BC6\u548C\u6388\u6743\u7B49\u5B89\u5168\u534F\u8BAE\u7684\u670D\u52A1\/\u5B88\u62A4\u8FDB\u7A0B\u3002\u5177\u5907\u7279\u6743\u7684\u653B\u51FB\u8005\u53EF\u80FD\u80FD\u591F\u626B\u63CFsecurityd\u7684\u5185\u5B58\uFF0C\u627E\u5230\u6B63\u786E\u7684\u5BC6\u94A5\u5E8F\u5217\u4EE5\u89E3\u5BC6\u7528\u6237\u7684\u767B\u5F55\u94A5\u5319\u4E32\u3002\u8FD9\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u83B7\u5F97\u5404\u79CD\u660E\u6587\u5BC6\u7801\uFF0C\u4F8B\u5982\u7528\u6237\u5BC6\u7801\u3001WiFi\u5BC6\u7801\u3001\u90AE\u4EF6\u5BC6\u7801\u3001\u6D4F\u89C8\u5668\u5BC6\u7801\u3001\u8BC1\u4E66\u5BC6\u7801\u3001\u5B89\u5168\u7B14\u8BB0\u5BC6\u7801\u7B49\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/002\/"},{"id":"T1555.003","name":"\u6765\u81EA\u7F51\u9875\u6D4F\u89C8\u5668\u7684\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8BFB\u53D6\u76EE\u6807\u6D4F\u89C8\u5668\u7279\u5B9A\u7684\u6587\u4EF6\u6765\u83B7\u53D6\u6D4F\u89C8\u5668\u4E2D\u4FDD\u5B58\u7684\u51ED\u8BC1\u3002\u7F51\u7EDC\u6D4F\u89C8\u5668\u901A\u5E38\u4F1A\u4FDD\u5B58\u7F51\u7AD9\u7528\u6237\u540D\u548C\u5BC6\u7801\u7B49\u51ED\u8BC1\uFF0C\u4EE5\u4FBF\u672A\u6765\u65E0\u9700\u624B\u52A8\u8F93\u5165\u3002\u6D4F\u89C8\u5668\u901A\u5E38\u5C06\u8FD9\u4E9B\u51ED\u8BC1\u4EE5\u52A0\u5BC6\u5F62\u5F0F\u5B58\u50A8\u5728\u51ED\u8BC1\u5E93\u4E2D\uFF1B\u7136\u800C\uFF0C\u5B58\u5728\u591A\u79CD\u65B9\u6CD5\u53EF\u4EE5\u4ECE\u6D4F\u89C8\u5668\u4E2D\u63D0\u53D6\u660E\u6587\u51ED\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/003\/"},{"id":"T1555.004","name":"Windows \u51ED\u636E\u7BA1\u7406\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECEWindows\u51ED\u636E\u7BA1\u7406\u5668\u83B7\u53D6\u51ED\u636E\u3002\u8BE5\u7BA1\u7406\u5668\u5C06\u7528\u4E8E\u767B\u5F55\u7F51\u7AD9\u3001\u5E94\u7528\u7A0B\u5E8F\u548C\/\u6216\u8BBE\u5907\u7684\u51ED\u636E\u5B58\u50A8\u5728\u51ED\u636E\u4FDD\u9669\u67DC\uFF08\u5148\u524D\u79F0\u4E3AWindows\u4FDD\u9669\u5E93\uFF09\u4E2D\uFF0C\u8FD9\u4E9B\u51ED\u636E\u901A\u8FC7NTLM\u6216Kerberos\u534F\u8BAE\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/004\/"},{"id":"T1555.005","name":"\u5BC6\u7801\u7BA1\u7406\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u7B2C\u4E09\u65B9\u5BC6\u7801\u7BA1\u7406\u5668\u4E2D\u83B7\u53D6\u7528\u6237\u51ED\u636E\u3002\u5BC6\u7801\u7BA1\u7406\u5668\u662F\u8BBE\u8BA1\u7528\u4E8E\u5B58\u50A8\u7528\u6237\u51ED\u636E\u7684\u5E94\u7528\u7A0B\u5E8F\uFF0C\u901A\u5E38\u5C06\u51ED\u636E\u4FDD\u5B58\u5728\u52A0\u5BC6\u6570\u636E\u5E93\u4E2D\u3002\u7528\u6237\u63D0\u4F9B\u89E3\u9501\u6570\u636E\u5E93\u7684\u4E3B\u5BC6\u7801\u540E\uFF0C\u5373\u53EF\u8BBF\u95EE\u8FD9\u4E9B\u51ED\u636E\u3002\u6570\u636E\u5E93\u89E3\u9501\u540E\uFF0C\u51ED\u636E\u53EF\u80FD\u88AB\u590D\u5236\u5230\u5185\u5B58\u4E2D\u3002\u8FD9\u4E9B\u6570\u636E\u5E93\u53EF\u4EE5\u6587\u4EF6\u5F62\u5F0F\u5B58\u50A8\u5728\u78C1\u76D8\u4E0A\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/005\/"},{"id":"T1555.006","name":"\u4E91\u5BC6\u94A5\u7BA1\u7406\u5B58\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u4E91\u539F\u751F\u5BC6\u94A5\u7BA1\u7406\u89E3\u51B3\u65B9\u6848\u4E2D\u83B7\u53D6\u51ED\u8BC1\uFF0C\u4F8B\u5982AWS Secrets Manager\u3001GCP Secret Manager\u3001Azure Key Vault\u548CTerraform Vault\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/006\/"},{"id":"T1555","name":"\u5BC6\u7801\u5B58\u50A8\u4E2D\u7684\u51ED\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u5E38\u89C1\u7684\u5BC6\u7801\u5B58\u50A8\u4F4D\u7F6E\u4EE5\u83B7\u53D6\u7528\u6237\u51ED\u8BC1\u3002\u5BC6\u7801\u6839\u636E\u64CD\u4F5C\u7CFB\u7EDF\u6216\u6301\u6709\u51ED\u8BC1\u7684\u5E94\u7528\u7A0B\u5E8F\u7684\u4E0D\u540C\uFF0C\u5B58\u50A8\u5728\u7CFB\u7EDF\u7684\u591A\u4E2A\u4F4D\u7F6E\u3002\u6B64\u5916\uFF0C\u8FD8\u6709\u7279\u5B9A\u7684\u5E94\u7528\u7A0B\u5E8F\u548C\u670D\u52A1\uFF08\u5982\u5BC6\u7801\u7BA1\u7406\u5668\u548C\u4E91\u5BC6\u94A5\u5E93\uFF09\u5B58\u50A8\u5BC6\u7801\uFF0C\u4EE5\u65B9\u4FBF\u7528\u6237\u7BA1\u7406\u548C\u7EF4\u62A4\u3002\u4E00\u65E6\u83B7\u53D6\u51ED\u8BC1\uFF0C\u653B\u51FB\u8005\u4FBF\u53EF\u5229\u7528\u5176\u8FDB\u884C\u6A2A\u5411\u79FB\u52A8\u5E76\u8BBF\u95EE\u53D7\u9650\u4FE1\u606F\u3002","sub-techniques":"T1555.001, T1555.002, T1555.003, T1555.004, T1555.005, T1555.006","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1555\/"},{"id":"T1556.001","name":"\u57DF\u63A7\u5236\u5668\u8EAB\u4EFD\u9A8C\u8BC1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7BE1\u6539\u57DF\u63A7\u5236\u5668\u4E0A\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u6D41\u7A0B\uFF0C\u4EE5\u7ED5\u8FC7\u5E38\u89C4\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u673A\u5236\uFF0C\u4ECE\u800C\u83B7\u53D6\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/001\/"},{"id":"T1556.002","name":"\u5BC6\u7801\u7B5B\u9009\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u8EAB\u4EFD\u9A8C\u8BC1\u8FC7\u7A0B\u4E2D\u6CE8\u518C\u6076\u610F\u7684\u5BC6\u7801\u8FC7\u6EE4\u5668\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\uFF0C\u4EE5\u4FBF\u5728\u7528\u6237\u51ED\u636E\u9A8C\u8BC1\u65F6\u83B7\u53D6\u8FD9\u4E9B\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/002\/"},{"id":"T1556.003","name":"\u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\uFF08PAM\uFF09\u4EE5\u7A83\u53D6\u7528\u6237\u51ED\u636E\u6216\u975E\u6CD5\u83B7\u53D6\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u3002PAM\u662F\u4E00\u4E2A\u7531\u914D\u7F6E\u6587\u4EF6\u3001\u5E93\u6587\u4EF6\u548C\u53EF\u6267\u884C\u6587\u4EF6\u7EC4\u6210\u7684\u6A21\u5757\u5316\u7CFB\u7EDF\uFF0C\u4E3A\u4F17\u591A\u670D\u52A1\u63D0\u4F9B\u8EAB\u4EFD\u9A8C\u8BC1\u5F15\u5BFC\u3002\u5176\u4E2D\u6700\u5E38\u89C1\u7684\u8BA4\u8BC1\u6A21\u5757\u662Fpam_unix.so\uFF0C\u5B83\u8D1F\u8D23\u5728\/etc\/passwd\u548C\/etc\/shadow\u6587\u4EF6\u4E2D\u83B7\u53D6\u3001\u8BBE\u7F6E\u53CA\u9A8C\u8BC1\u8D26\u6237\u8BA4\u8BC1\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/003\/"},{"id":"T1556.004","name":"\u7F51\u7EDC\u8BBE\u5907\u8BA4\u8BC1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u8865\u7CFB\u7EDF\u6620\u50CF\uFF0C\u5728\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u786C\u7F16\u7801\u5BC6\u7801\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u7F51\u7EDC\u8BBE\u5907\u672C\u5730\u8D26\u6237\u7684\u539F\u751F\u8BA4\u8BC1\u673A\u5236\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/004\/"},{"id":"T1556.005","name":"\u53EF\u9006\u52A0\u5BC6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Active Directory\u7684\u8EAB\u4EFD\u9A8C\u8BC1\u52A0\u5BC6\u5C5E\u6027\u6765\u83B7\u53D6Windows\u7CFB\u7EDF\u4E0A\u7684\u51ED\u636E\u3002AllowReversiblePasswordEncryption\u5C5E\u6027\u6307\u5B9A\u662F\u5426\u542F\u7528\u8D26\u6237\u7684\u53EF\u9006\u5BC6\u7801\u52A0\u5BC6\u3002\u9ED8\u8BA4\u60C5\u51B5\u4E0B\uFF0C\u6B64\u5C5E\u6027\u5904\u4E8E\u7981\u7528\u72B6\u6001\uFF08\u800C\u662F\u5C06\u7528\u6237\u51ED\u636E\u5B58\u50A8\u4E3A\u5355\u5411\u54C8\u5E0C\u51FD\u6570\u7684\u8F93\u51FA\uFF09\uFF0C\u9664\u975E\u9057\u7559\u6216\u5176\u4ED6\u8F6F\u4EF6\u9700\u8981\uFF0C\u5426\u5219\u4E0D\u5E94\u542F\u7528\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/005\/"},{"id":"T1556.006","name":"\u591A\u56E0\u7D20\u8BA4\u8BC1","description":"\u5BF9\u624B\u53EF\u80FD\u7981\u7528\u6216\u4FEE\u6539\u591A\u56E0\u7D20\u8BA4\u8BC1\uFF08MFA\uFF09\u673A\u5236\uFF0C\u4EE5\u4FBF\u6301\u7EED\u8BBF\u95EE\u88AB\u5165\u4FB5\u7684\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/006\/"},{"id":"T1556.007","name":"\u6DF7\u5408\u8EAB\u4EFD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u8865\u3001\u4FEE\u6539\u6216\u4EE5\u5176\u4ED6\u65B9\u5F0F\u690D\u5165\u540E\u95E8\uFF0C\u7BE1\u6539\u4E0E\u672C\u5730\u7528\u6237\u8EAB\u4EFD\u7ED1\u5B9A\u7684\u4E91\u8EAB\u4EFD\u9A8C\u8BC1\u6D41\u7A0B\uFF0C\u4ECE\u800C\u7ED5\u8FC7\u5E38\u89C4\u8BA4\u8BC1\u673A\u5236\u3001\u7A83\u53D6\u8BBF\u95EE\u51ED\u8BC1\uFF0C\u5E76\u5B9E\u73B0\u5BF9\u8D26\u6237\u7684\u6301\u4E45\u5316\u8BBF\u95EE\u63A7\u5236\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/007\/"},{"id":"T1556.008","name":"\u7F51\u7EDC\u63D0\u4F9B\u5546\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6CE8\u518C\u6076\u610F\u7684\u7F51\u7EDC\u63D0\u4F9B\u7A0B\u5E8F\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\uFF0C\u4EE5\u5728\u8EAB\u4EFD\u9A8C\u8BC1\u8FC7\u7A0B\u4E2D\u6355\u83B7\u660E\u6587\u7528\u6237\u51ED\u636E\u3002\u7F51\u7EDC\u63D0\u4F9B\u7A0B\u5E8FDLL\u5141\u8BB8Windows\u4E0E\u7279\u5B9A\u7F51\u7EDC\u534F\u8BAE\u4EA4\u4E92\uFF0C\u5E76\u652F\u6301\u9644\u52A0\u7684\u51ED\u636E\u7BA1\u7406\u529F\u80FD\u3002\u5728\u767B\u5F55\u8FC7\u7A0B\u4E2D\uFF0CWinlogon\uFF08\u4EA4\u4E92\u5F0F\u767B\u5F55\u6A21\u5757\uFF09\u901A\u8FC7RPC\u5C06\u51ED\u636E\u53D1\u9001\u81F3\u672C\u5730mpnotify.exe\u8FDB\u7A0B\u3002\u968F\u540E\uFF0Cmpnotify.exe\u8FDB\u7A0B\u5728\u901A\u77E5\u767B\u5F55\u4E8B\u4EF6\u53D1\u751F\u65F6\uFF0C\u4F1A\u4EE5\u660E\u6587\u5F62\u5F0F\u4E0E\u5DF2\u6CE8\u518C\u7684\u51ED\u636E\u7BA1\u7406\u5668\u5171\u4EAB\u8FD9\u4E9B\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/008\/"},{"id":"T1556.009","name":"\u6761\u4EF6\u8BBF\u95EE\u7B56\u7565","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7981\u7528\u6216\u4FEE\u6539\u6761\u4EF6\u8BBF\u95EE\u7B56\u7565\uFF0C\u4EE5\u4FBF\u6301\u7EED\u8BBF\u95EE\u88AB\u5165\u4FB5\u7684\u8D26\u6237\u3002\u6761\u4EF6\u8BBF\u95EE\u7B56\u7565\u662F\u8EAB\u4EFD\u63D0\u4F9B\u5546\u4EE5\u53CA\u8EAB\u4EFD\u548C\u8BBF\u95EE\u7BA1\u7406\u7CFB\u7EDF\u7528\u6765\u786E\u5B9A\u662F\u5426\u5E94\u6388\u4E88\u7528\u6237\u8D44\u6E90\u8BBF\u95EE\u6743\u9650\u7684\u989D\u5916\u9A8C\u8BC1\u63AA\u65BD\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/009\/"},{"id":"T1556","name":"\u4FEE\u6539\u8BA4\u8BC1\u6D41\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u8BA4\u8BC1\u673A\u5236\u548C\u6D41\u7A0B\u6765\u83B7\u53D6\u7528\u6237\u51ED\u8BC1\uFF0C\u6216\u5B9E\u73B0\u672C\u4E0D\u5E94\u5141\u8BB8\u7684\u8D26\u6237\u8BBF\u95EE\u3002\u8BA4\u8BC1\u8FC7\u7A0B\u7531\u591A\u79CD\u673A\u5236\u5904\u7406\uFF0C\u4F8B\u5982Windows\u7CFB\u7EDF\u4E2D\u7684\u672C\u5730\u5B89\u5168\u8BA4\u8BC1\u670D\u52A1\u5668\uFF08LSASS\uFF09\u8FDB\u7A0B\u548C\u5B89\u5168\u8D26\u6237\u7BA1\u7406\u5668\uFF08SAM\uFF09\u3001\u57FA\u4E8EUnix\u7CFB\u7EDF\u4E2D\u7684\u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\uFF08PAM\uFF09\uFF0C\u4EE5\u53CAMacOS\u7CFB\u7EDF\u4E2D\u7684\u6388\u6743\u63D2\u4EF6\uFF0C\u8FD9\u4E9B\u673A\u5236\u8D1F\u8D23\u6536\u96C6\u3001\u5B58\u50A8\u548C\u9A8C\u8BC1\u51ED\u8BC1\u3002\u901A\u8FC7\u4FEE\u6539\u8BA4\u8BC1\u6D41\u7A0B\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u65E0\u9700\u4F7F\u7528\u6709\u6548\u8D26\u6237\u5373\u53EF\u5BF9\u670D\u52A1\u6216\u7CFB\u7EDF\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"T1556.001, T1556.002, T1556.003, T1556.004, T1556.005, T1556.006, T1556.007, T1556.008, T1556.009","tactic":"\u575A\u6301,\u9632\u5FA1\u89C4\u907F,\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1556\/"},{"id":"T1557.001","name":"LLMNR\/NBT-NS\u6295\u6BD2\u4E0ESMB\u4E2D\u7EE7\u653B\u51FB","description":"\u901A\u8FC7\u54CD\u5E94LLMNR\/NBT-NS\u7F51\u7EDC\u6D41\u91CF\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5192\u5145\u540D\u79F0\u89E3\u6790\u7684\u6743\u5A01\u6765\u6E90\uFF0C\u5F3A\u5236\u7CFB\u7EDF\u4E0E\u5176\u63A7\u5236\u7684\u6076\u610F\u7CFB\u7EDF\u901A\u4FE1\u3002\u6B64\u7C7B\u884C\u4E3A\u53EF\u7528\u4E8E\u6536\u96C6\u6216\u4E2D\u7EE7\u8EAB\u4EFD\u9A8C\u8BC1\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1557\/001\/"},{"id":"T1557.002","name":"ARP\u7F13\u5B58\u6295\u6BD2","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6C61\u67D3\u5730\u5740\u89E3\u6790\u534F\u8BAE\uFF08ARP\uFF09\u7F13\u5B58\uFF0C\u5C06\u81EA\u5DF1\u7F6E\u4E8E\u4E24\u4E2A\u6216\u591A\u4E2A\u7F51\u7EDC\u8BBE\u5907\u4E4B\u95F4\u7684\u901A\u4FE1\u8DEF\u5F84\u4E2D\u3002\u6B64\u7C7B\u884C\u4E3A\u53EF\u7528\u4E8E\u5B9E\u65BD\u540E\u7EED\u653B\u51FB\uFF0C\u5982\u7F51\u7EDC\u55C5\u63A2\u6216\u4F20\u8F93\u6570\u636E\u7BE1\u6539\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1557\/002\/"},{"id":"T1557.003","name":"DHCP\u6B3A\u9A97","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4F2A\u9020\u52A8\u6001\u4E3B\u673A\u914D\u7F6E\u534F\u8BAE\uFF08DHCP\uFF09\u6D41\u91CF\uFF0C\u5728\u53D7\u5BB3\u7F51\u7EDC\u4E2D\u5145\u5F53\u6076\u610FDHCP\u670D\u52A1\u5668\uFF0C\u4ECE\u800C\u5C06\u7F51\u7EDC\u6D41\u91CF\u91CD\u5B9A\u5411\u81F3\u5176\u63A7\u5236\u7684\u7CFB\u7EDF\u3002\u901A\u8FC7\u5B9E\u73B0\u4E2D\u95F4\u4EBA\u653B\u51FB\u4F4D\u7F6E\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u6536\u96C6\u7F51\u7EDC\u901A\u4FE1\u6570\u636E\uFF0C\u5305\u62EC\u4F20\u8F93\u7684\u51ED\u8BC1\u4FE1\u606F\uFF0C\u5C24\u5176\u662F\u90A3\u4E9B\u901A\u8FC7\u4E0D\u5B89\u5168\u3001\u672A\u52A0\u5BC6\u534F\u8BAE\u53D1\u9001\u7684\u51ED\u8BC1\u3002\u8FD9\u79CD\u884C\u4E3A\u8FD8\u53EF\u80FD\u4E3A\u540E\u7EED\u653B\u51FB\u884C\u4E3A\u521B\u9020\u6761\u4EF6\uFF0C\u4F8B\u5982\u7F51\u7EDC\u55C5\u63A2\u6216\u4F20\u8F93\u6570\u636E\u7BE1\u6539\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1557\/003\/"},{"id":"T1557.004","name":"\u90AA\u6076\u53CC\u80DE\u80CE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u67B6\u8BBE\u770B\u4F3C\u771F\u5B9E\u7684Wi-Fi\u63A5\u5165\u70B9\uFF0C\u8BF1\u4F7F\u7528\u6237\u8FDE\u63A5\u81F3\u6076\u610F\u7F51\u7EDC\uFF0C\u4EE5\u6B64\u4F5C\u4E3A\u540E\u7EED\u884C\u4E3A\u7684\u652F\u6301\u624B\u6BB5\uFF0C\u4F8B\u5982\u7F51\u7EDC\u55C5\u63A2\u3001\u4F20\u8F93\u6570\u636E\u7BE1\u6539\u6216\u8F93\u5165\u6355\u83B7\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1557\/004\/"},{"id":"T1557","name":"\u4E2D\u95F4\u4EBA\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5229\u7528\u4E2D\u95F4\u4EBA\u653B\u51FB\u6280\u672F\uFF0C\u5C06\u81EA\u5DF1\u7F6E\u4E8E\u4E24\u4E2A\u6216\u591A\u4E2A\u8054\u7F51\u8BBE\u5907\u4E4B\u95F4\uFF0C\u4EE5\u652F\u6301\u540E\u7EED\u884C\u4E3A\uFF0C\u5982\u7F51\u7EDC\u55C5\u63A2\u3001\u4F20\u8F93\u6570\u636E\u7BE1\u6539\u6216\u91CD\u653E\u653B\u51FB\uFF08\u5229\u7528\u51ED\u8BC1\u8BBF\u95EE\uFF09\u3002\u901A\u8FC7\u6EE5\u7528\u5E38\u89C1\u7F51\u7EDC\u534F\u8BAE\u4E2D\u53EF\u51B3\u5B9A\u7F51\u7EDC\u6D41\u91CF\u6D41\u5411\u7684\u529F\u80FD\uFF08\u4F8B\u5982ARP\u3001DNS\u3001LLMNR\u7B49\uFF09\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8FEB\u4F7F\u8BBE\u5907\u901A\u8FC7\u5176\u63A7\u5236\u7684\u7CFB\u7EDF\u8FDB\u884C\u901A\u4FE1\uFF0C\u4ECE\u800C\u6536\u96C6\u4FE1\u606F\u6216\u6267\u884C\u989D\u5916\u64CD\u4F5C\u3002","sub-techniques":"T1557.001, T1557.002, T1557.003, T1557.004","tactic":"\u51ED\u8BC1\u8BBF\u95EE,\u6536\u85CF","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1557\/"},{"id":"T1558.001","name":"\u91D1\u5238","description":"\u62E5\u6709KRBTGT\u8D26\u6237\u5BC6\u7801\u54C8\u5E0C\u7684\u5BF9\u624B\u53EF\u4EE5\u4F2A\u9020Kerberos\u7968\u636E\u6388\u4E88\u7968\u636E\uFF08TGT\uFF09\uFF0C\u5373\u6240\u8C13\u7684\u9EC4\u91D1\u7968\u636E\u3002\u9EC4\u91D1\u7968\u636E\u4F7F\u5BF9\u624B\u80FD\u591F\u4E3AActive Directory\u4E2D\u7684\u4EFB\u4F55\u8D26\u6237\u751F\u6210\u8BA4\u8BC1\u6750\u6599\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/001\/"},{"id":"T1558.002","name":"\u94F6\u7968","description":"\u653B\u51FB\u8005\u82E5\u83B7\u53D6\u4E86\u76EE\u6807\u670D\u52A1\u8D26\u6237\uFF08\u5982SharePoint\u3001MSSQL\uFF09\u7684\u5BC6\u7801\u54C8\u5E0C\uFF0C\u4FBF\u53EF\u4F2A\u9020Kerberos\u7968\u636E\u6388\u4E88\u670D\u52A1\uFF08TGS\uFF09\u7968\u636E\uFF0C\u5373\u6240\u8C13\u7684\u94F6\u7968\u3002Kerberos TGS\u7968\u636E\u4EA6\u79F0\u4E3A\u670D\u52A1\u7968\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/002\/"},{"id":"T1558.003","name":"Kerberoasting","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u6709\u6548\u7684Kerberos\u7968\u636E\u6388\u4E88\u7968\u636E\uFF08TGT\uFF09\u6216\u55C5\u63A2\u7F51\u7EDC\u6D41\u91CF\uFF0C\u4EE5\u83B7\u53D6\u53EF\u80FD\u6613\u53D7\u66B4\u529B\u7834\u89E3\u653B\u51FB\u7684\u7968\u636E\u6388\u4E88\u670D\u52A1\uFF08TGS\uFF09\u7968\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/003\/"},{"id":"T1558.004","name":"AS-REP \u70D8\u70E4\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7834\u89E3Kerberos\u6D88\u606F\uFF0C\u6765\u83B7\u53D6\u5DF2\u7981\u7528Kerberos\u9884\u8BA4\u8BC1\u7684\u8D26\u6237\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/004\/"},{"id":"T1558.005","name":"Ccache \u6587\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u7A83\u53D6\u5B58\u50A8\u5728\u51ED\u636E\u7F13\u5B58\u6587\u4EF6\uFF08\u6216ccache\uFF09\u4E2D\u7684Kerberos\u7968\u636E\u3002\u8FD9\u4E9B\u6587\u4EF6\u7528\u4E8E\u77ED\u671F\u5B58\u50A8\u7528\u6237\u7684\u6D3B\u8DC3\u4F1A\u8BDD\u51ED\u636E\u3002ccache\u6587\u4EF6\u5728\u7528\u6237\u8BA4\u8BC1\u65F6\u521B\u5EFA\uFF0C\u5141\u8BB8\u7528\u6237\u65E0\u9700\u91CD\u65B0\u8F93\u5165\u51ED\u636E\u5373\u53EF\u8BBF\u95EE\u591A\u4E2A\u670D\u52A1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/005\/"},{"id":"T1558","name":"\u7A83\u53D6\u6216\u4F2A\u9020Kerberos\u7968\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u7A83\u53D6\u6216\u4F2A\u9020Kerberos\u7968\u636E\u6765\u7834\u574FKerberos\u8BA4\u8BC1\uFF0C\u4EE5\u5B9E\u73B0\u7968\u636E\u4F20\u9012\u653B\u51FB\u3002Kerberos\u662F\u4E00\u79CD\u5728\u73B0\u4EE3Windows\u57DF\u73AF\u5883\u4E2D\u5E7F\u6CDB\u4F7F\u7528\u7684\u8BA4\u8BC1\u534F\u8BAE\u3002\u5728Kerberos\u73AF\u5883\u4E2D\uFF08\u79F0\u4E3A\u201C\u9886\u57DF\u201D\uFF09\uFF0C\u5B58\u5728\u4E09\u4E2A\u57FA\u672C\u53C2\u4E0E\u8005\uFF1A\u5BA2\u6237\u7AEF\u3001\u670D\u52A1\u548C\u5BC6\u94A5\u5206\u53D1\u4E2D\u5FC3\uFF08KDC\uFF09\u3002\u5BA2\u6237\u7AEF\u8BF7\u6C42\u8BBF\u95EE\u670D\u52A1\uFF0C\u5E76\u901A\u8FC7\u6E90\u81EAKDC\u7684Kerberos\u7968\u636E\u4EA4\u6362\uFF0C\u5728\u6210\u529F\u8BA4\u8BC1\u540E\u83B7\u5F97\u8BBF\u95EE\u6743\u9650\u3002KDC\u8D1F\u8D23\u8BA4\u8BC1\u548C\u7968\u636E\u6388\u4E88\u3002\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u7A83\u53D6\u7968\u636E\u6216\u4F2A\u9020\u7968\u636E\u6765\u6EE5\u7528Kerberos\uFF0C\u4EE5\u5B9E\u73B0\u672A\u7ECF\u6388\u6743\u7684\u8BBF\u95EE\u3002","sub-techniques":"T1558.001, T1558.002, T1558.003, T1558.004, T1558.005","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1558\/"},{"id":"T1559.001","name":"\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Windows\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08COM\uFF09\u8FDB\u884C\u672C\u5730\u4EE3\u7801\u6267\u884C\u3002COM\u4F5C\u4E3A\u539F\u751FWindows\u5E94\u7528\u7A0B\u5E8F\u7F16\u7A0B\u63A5\u53E3\uFF08API\uFF09\u7684\u8FDB\u7A0B\u95F4\u901A\u4FE1\uFF08IPC\uFF09\u7EC4\u4EF6\uFF0C\u80FD\u591F\u5B9E\u73B0\u8F6F\u4EF6\u5BF9\u8C61\u6216\u53EF\u6267\u884C\u4EE3\u7801\u4E4B\u95F4\u7684\u4EA4\u4E92\uFF0C\u8FD9\u4E9B\u4EE3\u7801\u5B9E\u73B0\u4E86\u4E00\u4E2A\u6216\u591A\u4E2A\u63A5\u53E3\u3002\u901A\u8FC7COM\uFF0C\u5BA2\u6237\u7AEF\u5BF9\u8C61\u53EF\u4EE5\u8C03\u7528\u670D\u52A1\u5668\u5BF9\u8C61\u7684\u65B9\u6CD5\uFF0C\u8FD9\u4E9B\u670D\u52A1\u5668\u5BF9\u8C61\u901A\u5E38\u662F\u4E8C\u8FDB\u5236\u52A8\u6001\u94FE\u63A5\u5E93\uFF08DLL\uFF09\u6216\u53EF\u6267\u884C\u6587\u4EF6\uFF08EXE\uFF09\u3002\u8FDC\u7A0BCOM\u6267\u884C\u5219\u901A\u8FC7\u5206\u5E03\u5F0F\u7EC4\u4EF6\u5BF9\u8C61\u6A21\u578B\uFF08DCOM\uFF09\u7B49\u8FDC\u7A0B\u670D\u52A1\u6765\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1559\/001\/"},{"id":"T1559.002","name":"\u52A8\u6001\u6570\u636E\u4EA4\u6362","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Windows\u52A8\u6001\u6570\u636E\u4EA4\u6362\uFF08DDE\uFF09\u6267\u884C\u4EFB\u610F\u547D\u4EE4\u3002DDE\u662F\u4E00\u79CD\u5BA2\u6237\u7AEF-\u670D\u52A1\u5668\u534F\u8BAE\uFF0C\u7528\u4E8E\u5E94\u7528\u7A0B\u5E8F\u4E4B\u95F4\u7684\u4E00\u6B21\u6027\u548C\/\u6216\u6301\u7EED\u8FDB\u7A0B\u95F4\u901A\u4FE1\uFF08IPC\uFF09\u3002\u4E00\u65E6\u5EFA\u7ACB\u94FE\u63A5\uFF0C\u5E94\u7528\u7A0B\u5E8F\u53EF\u4EE5\u81EA\u4E3B\u4EA4\u6362\u4E8B\u52A1\uFF0C\u5305\u62EC\u5B57\u7B26\u4E32\u3001\u6E29\u6570\u636E\u94FE\u63A5\uFF08\u6570\u636E\u9879\u53D8\u66F4\u65F6\u7684\u901A\u77E5\uFF09\u3001\u70ED\u6570\u636E\u94FE\u63A5\uFF08\u6570\u636E\u9879\u53D8\u66F4\u7684\u590D\u5236\uFF09\u4EE5\u53CA\u547D\u4EE4\u6267\u884C\u8BF7\u6C42\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1559\/002\/"},{"id":"T1559.003","name":"XPC \u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u4EE5\u5411XPC\u670D\u52A1\u5B88\u62A4\u8FDB\u7A0B\u63D0\u4F9B\u6076\u610F\u5185\u5BB9\uFF0C\u4EE5\u5B9E\u73B0\u672C\u5730\u4EE3\u7801\u6267\u884C\u3002macOS\u5229\u7528XPC\u670D\u52A1\u8FDB\u884C\u4E0D\u540C\u8FDB\u7A0B\u95F4\u7684\u57FA\u672C\u901A\u4FE1\uFF0C\u4F8B\u5982XPC\u670D\u52A1\u5B88\u62A4\u8FDB\u7A0B\u4E0E\u7B2C\u4E09\u65B9\u5E94\u7528\u7A0B\u5E8F\u7279\u6743\u52A9\u624B\u5DE5\u5177\u4E4B\u95F4\u7684\u4EA4\u4E92\u3002\u5E94\u7528\u7A0B\u5E8F\u53EF\u901A\u8FC7\u5E95\u5C42XPC\u670D\u52A1C\u8BED\u8A00API\u6216\u9AD8\u5C42NSXPCConnection API\u5411\u4EE5root\u6743\u9650\u8FD0\u884C\u7684XPC\u670D\u52A1\u5B88\u62A4\u8FDB\u7A0B\u53D1\u9001\u6D88\u606F\uFF0C\u4EE5\u5904\u7406\u9700\u8981\u63D0\u5347\u6743\u9650\u7684\u4EFB\u52A1\uFF08\u5982\u7F51\u7EDC\u8FDE\u63A5\uFF09\u3002\u5E94\u7528\u7A0B\u5E8F\u9700\u8D1F\u8D23\u63D0\u4F9B\u4F5C\u4E3AXPC\u670D\u52A1\u84DD\u56FE\u7684\u534F\u8BAE\u5B9A\u4E49\u3002\u5F00\u53D1\u8005\u901A\u5E38\u501F\u52A9XPC\u670D\u52A1\u6765\u786E\u4FDD\u5E94\u7528\u7A0B\u5E8F\u5BA2\u6237\u7AEF\u4E0E\u5B88\u62A4\u8FDB\u7A0B\u4E4B\u95F4\u7684\u7A33\u5B9A\u6027\u548C\u6743\u9650\u5206\u79BB\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1559\/003\/"},{"id":"T1559","name":"\u8FDB\u7A0B\u95F4\u901A\u4FE1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8FDB\u7A0B\u95F4\u901A\u4FE1\uFF08IPC\uFF09\u673A\u5236\u6765\u6267\u884C\u672C\u5730\u4EE3\u7801\u6216\u547D\u4EE4\u3002IPC\u901A\u5E38\u88AB\u8FDB\u7A0B\u7528\u4E8E\u5171\u4EAB\u6570\u636E\u3001\u76F8\u4E92\u901A\u4FE1\u6216\u540C\u6B65\u6267\u884C\u3002IPC\u4E5F\u5E38\u7528\u4E8E\u907F\u514D\u8BF8\u5982\u6B7B\u9501\u4E4B\u7C7B\u7684\u60C5\u51B5\uFF0C\u5373\u8FDB\u7A0B\u9677\u5165\u5FAA\u73AF\u7B49\u5F85\u6A21\u5F0F\u3002","sub-techniques":"T1559.001, T1559.002, T1559.003","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1559\/"},{"id":"T1560.001","name":"\u901A\u8FC7\u5B9E\u7528\u5DE5\u5177\u5F52\u6863","description":"\u5BF9\u624B\u53EF\u80FD\u5728\u6570\u636E\u5916\u6CC4\u524D\u4F7F\u7528\u5DE5\u5177\u5BF9\u6536\u96C6\u5230\u7684\u6570\u636E\u8FDB\u884C\u538B\u7F29\u548C\/\u6216\u52A0\u5BC6\u3002\u8BB8\u591A\u5DE5\u5177\u5177\u5907\u538B\u7F29\u3001\u52A0\u5BC6\u6216\u5C06\u6570\u636E\u6253\u5305\u6210\u66F4\u6613\u4E8E\u4F20\u8F93\u6216\u66F4\u5B89\u5168\u683C\u5F0F\u7684\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1560\/001\/"},{"id":"T1560.002","name":"\u901A\u8FC7\u56FE\u4E66\u9986\u5B58\u6863","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7B2C\u4E09\u65B9\u5E93\u5BF9\u7A83\u53D6\u524D\u6536\u96C6\u7684\u6570\u636E\u8FDB\u884C\u538B\u7F29\u6216\u52A0\u5BC6\u3002\u73B0\u6709\u591A\u79CD\u5E93\u53EF\u7528\u4E8E\u6570\u636E\u5F52\u6863\uFF0C\u4F8B\u5982Python\u7684rarfile\u3001libzip\u4EE5\u53CAzlib\u3002\u5927\u591A\u6570\u5E93\u90FD\u5177\u5907\u6570\u636E\u52A0\u5BC6\u548C\/\u6216\u538B\u7F29\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1560\/002\/"},{"id":"T1560.003","name":"\u901A\u8FC7\u81EA\u5B9A\u4E49\u65B9\u6CD5\u5F52\u6863","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u81EA\u5B9A\u4E49\u65B9\u6CD5\u5BF9\u7A83\u53D6\u524D\u6536\u96C6\u7684\u6570\u636E\u8FDB\u884C\u538B\u7F29\u6216\u52A0\u5BC6\u3002\u4ED6\u4EEC\u53EF\u80FD\u9009\u62E9\u91C7\u7528\u81EA\u5B9A\u4E49\u7684\u5F52\u6863\u624B\u6BB5\uFF0C\u4F8B\u5982\u4F7F\u7528\u4E0D\u4F9D\u8D56\u5916\u90E8\u5E93\u6216\u5DE5\u5177\u5F15\u7528\u7684XOR\u52A0\u5BC6\u6216\u6D41\u5BC6\u7801\u5B9E\u73B0\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u4E5F\u66FE\u5229\u7528\u81EA\u5B9A\u4E49\u5B9E\u73B0\u7684\u77E5\u540D\u538B\u7F29\u7B97\u6CD5\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1560\/003\/"},{"id":"T1560","name":"\u6863\u6848\u6536\u96C6\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u6570\u636E\u5916\u6CC4\u524D\u5BF9\u6536\u96C6\u5230\u7684\u6570\u636E\u8FDB\u884C\u538B\u7F29\u548C\/\u6216\u52A0\u5BC6\u3002\u538B\u7F29\u6570\u636E\u6709\u52A9\u4E8E\u6DF7\u6DC6\u6536\u96C6\u5230\u7684\u4FE1\u606F\uFF0C\u5E76\u51CF\u5C11\u901A\u8FC7\u7F51\u7EDC\u53D1\u9001\u7684\u6570\u636E\u91CF\u3002\u52A0\u5BC6\u5219\u53EF\u7528\u4E8E\u9690\u85CF\u5916\u6CC4\u4FE1\u606F\uFF0C\u4F7F\u5176\u96BE\u4EE5\u88AB\u68C0\u6D4B\uFF0C\u6216\u5728\u9632\u5FA1\u8005\u68C0\u67E5\u65F6\u964D\u4F4E\u5916\u6CC4\u884C\u4E3A\u7684\u660E\u663E\u6027\u3002","sub-techniques":"T1560.001, T1560.002, T1560.003","tactic":"\u6536\u85CF","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1560\/"},{"id":"T1561.001","name":"\u78C1\u76D8\u5185\u5BB9\u64E6\u9664","description":"\u5BF9\u624B\u53EF\u80FD\u64E6\u9664\u7279\u5B9A\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E2D\u5927\u8303\u56F4\u5B58\u50A8\u8BBE\u5907\u7684\u5185\u5BB9\uFF0C\u4EE5\u4E2D\u65AD\u7CFB\u7EDF\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1561\/001\/"},{"id":"T1561.002","name":"\u78C1\u76D8\u7ED3\u6784\u64E6\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7834\u574F\u6216\u64E6\u9664\u786C\u76D8\u4E0A\u542F\u52A8\u7CFB\u7EDF\u6240\u5FC5\u9700\u7684\u6570\u636E\u7ED3\u6784\uFF0C\u9488\u5BF9\u7279\u5B9A\u5173\u952E\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E2D\u7684\u5927\u91CF\u8BBE\u5907\u53D1\u8D77\u653B\u51FB\uFF0C\u4ECE\u800C\u4E2D\u65AD\u7CFB\u7EDF\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1561\/002\/"},{"id":"T1561","name":"\u78C1\u76D8\u64E6\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u64E6\u9664\u6216\u7834\u574F\u7279\u5B9A\u7CFB\u7EDF\u6216\u7F51\u7EDC\u4E2D\u5927\u91CF\u8BBE\u5907\u7684\u539F\u59CB\u78C1\u76D8\u6570\u636E\uFF0C\u4EE5\u4E2D\u65AD\u7CFB\u7EDF\u548C\u7F51\u7EDC\u8D44\u6E90\u7684\u53EF\u7528\u6027\u3002\u901A\u8FC7\u76F4\u63A5\u5199\u5165\u78C1\u76D8\u7684\u6743\u9650\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u8986\u76D6\u90E8\u5206\u78C1\u76D8\u6570\u636E\u3002\u4ED6\u4EEC\u53EF\u9009\u62E9\u64E6\u9664\u4EFB\u610F\u90E8\u5206\u7684\u78C1\u76D8\u6570\u636E\uFF0C\u6216\u7834\u574F\u78C1\u76D8\u7ED3\u6784\uFF0C\u5982\u4E3B\u5F15\u5BFC\u8BB0\u5F55\uFF08MBR\uFF09\u3002\u751A\u81F3\u53EF\u80FD\u5C1D\u8BD5\u5B8C\u5168\u64E6\u9664\u6240\u6709\u78C1\u76D8\u6247\u533A\u3002","sub-techniques":"T1561.001, T1561.002","tactic":"\u5F71\u54CD","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1561\/"},{"id":"T1562.001","name":"\u7981\u7528\u6216\u4FEE\u6539\u5DE5\u5177","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4FEE\u6539\u548C\/\u6216\u7981\u7528\u5B89\u5168\u5DE5\u5177\uFF0C\u4EE5\u907F\u514D\u5176\u6076\u610F\u8F6F\u4EF6\/\u5DE5\u5177\u53CA\u6D3B\u52A8\u88AB\u68C0\u6D4B\u5230\u3002\u8FD9\u53EF\u80FD\u91C7\u53D6\u591A\u79CD\u5F62\u5F0F\uFF0C\u4F8B\u5982\u7EC8\u6B62\u5B89\u5168\u8F6F\u4EF6\u8FDB\u7A0B\u6216\u670D\u52A1\u3001\u4FEE\u6539\/\u5220\u9664\u6CE8\u518C\u8868\u952E\u503C\u6216\u914D\u7F6E\u6587\u4EF6\u4EE5\u4F7F\u5DE5\u5177\u65E0\u6CD5\u6B63\u5E38\u8FD0\u884C\uFF0C\u6216\u91C7\u7528\u5176\u4ED6\u65B9\u6CD5\u5E72\u6270\u5B89\u5168\u5DE5\u5177\u7684\u626B\u63CF\u6216\u4FE1\u606F\u62A5\u544A\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u7981\u7528\u66F4\u65B0\uFF0C\u4EE5\u9632\u6B62\u6700\u65B0\u7684\u5B89\u5168\u8865\u4E01\u9001\u8FBE\u53D7\u5BB3\u7CFB\u7EDF\u4E0A\u7684\u5DE5\u5177\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/001\/"},{"id":"T1562.002","name":"\u7981\u7528Windows\u4E8B\u4EF6\u65E5\u5FD7\u8BB0\u5F55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7981\u7528Windows\u4E8B\u4EF6\u65E5\u5FD7\u8BB0\u5F55\uFF0C\u4EE5\u9650\u5236\u53EF\u7528\u4E8E\u68C0\u6D4B\u548C\u5BA1\u8BA1\u7684\u6570\u636E\u3002Windows\u4E8B\u4EF6\u65E5\u5FD7\u8BB0\u5F55\u4E86\u7528\u6237\u548C\u7CFB\u7EDF\u6D3B\u52A8\uFF0C\u5982\u767B\u5F55\u5C1D\u8BD5\u3001\u8FDB\u7A0B\u521B\u5EFA\u7B49\u3002\u5B89\u5168\u5DE5\u5177\u548C\u5206\u6790\u5E08\u5229\u7528\u8FD9\u4E9B\u6570\u636E\u751F\u6210\u68C0\u6D4B\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/002\/"},{"id":"T1562.003","name":"\u7981\u7528\u547D\u4EE4\u5386\u53F2\u8BB0\u5F55\u65E5\u5FD7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7834\u574F\u547D\u4EE4\u5386\u53F2\u8BB0\u5F55\u529F\u80FD\uFF0C\u4EE5\u9690\u85CF\u4ED6\u4EEC\u5728\u53D7\u611F\u67D3\u7CFB\u7EDF\u4E0A\u6267\u884C\u7684\u547D\u4EE4\u3002\u591A\u79CD\u547D\u4EE4\u89E3\u91CA\u5668\u4F1A\u8BB0\u5F55\u7528\u6237\u5728\u7EC8\u7AEF\u4E2D\u8F93\u5165\u7684\u547D\u4EE4\uFF0C\u4EE5\u4FBF\u7528\u6237\u8FFD\u6EAF\u81EA\u5DF1\u7684\u64CD\u4F5C\u5386\u53F2\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/003\/"},{"id":"T1562.004","name":"\u7981\u7528\u6216\u4FEE\u6539\u7CFB\u7EDF\u9632\u706B\u5899","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7981\u7528\u6216\u4FEE\u6539\u7CFB\u7EDF\u9632\u706B\u5899\uFF0C\u4EE5\u7ED5\u8FC7\u9650\u5236\u7F51\u7EDC\u4F7F\u7528\u7684\u63A7\u5236\u63AA\u65BD\u3002\u8FD9\u4E9B\u66F4\u6539\u53EF\u80FD\u5305\u62EC\u5B8C\u5168\u7981\u7528\u9632\u706B\u5899\u673A\u5236\uFF0C\u4EE5\u53CA\u6DFB\u52A0\u3001\u5220\u9664\u6216\u4FEE\u6539\u7279\u5B9A\u89C4\u5219\u3002\u5177\u4F53\u5B9E\u73B0\u65B9\u5F0F\u56E0\u64CD\u4F5C\u7CFB\u7EDF\u800C\u5F02\uFF0C\u5E38\u89C1\u624B\u6BB5\u5305\u62EC\u901A\u8FC7\u547D\u4EE4\u884C\u64CD\u4F5C\u3001\u7F16\u8F91Windows\u6CE8\u518C\u8868\u952E\u503C\u4EE5\u53CA\u5229\u7528Windows\u63A7\u5236\u9762\u677F\u8FDB\u884C\u914D\u7F6E\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/004\/"},{"id":"T1562.006","name":"\u6307\u793A\u5668\u5C4F\u853D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u963B\u6B62\u4F20\u611F\u5668\u901A\u5E38\u6355\u83B7\u7684\u6307\u6807\u6216\u4E8B\u4EF6\u88AB\u6536\u96C6\u548C\u5206\u6790\u3002\u8FD9\u53EF\u80FD\u5305\u62EC\u6076\u610F\u91CD\u5B9A\u5411\u751A\u81F3\u7981\u7528\u57FA\u4E8E\u4E3B\u673A\u7684\u4F20\u611F\u5668\uFF0C\u4F8B\u5982\u901A\u8FC7\u7BE1\u6539\u63A7\u5236\u4E8B\u4EF6\u9065\u6D4B\u6536\u96C6\u548C\u6D41\u52A8\u7684\u8BBE\u7F6E\u6765\u5E72\u6270Windows\u4E8B\u4EF6\u8FFD\u8E2A\uFF08ETW\uFF09\u3002\u8FD9\u4E9B\u8BBE\u7F6E\u53EF\u80FD\u5B58\u50A8\u5728\u7CFB\u7EDF\u7684\u914D\u7F6E\u6587\u4EF6\u548C\/\u6216\u6CE8\u518C\u8868\u4E2D\uFF0C\u5E76\u4E14\u53EF\u4EE5\u901A\u8FC7PowerShell\u6216Windows\u7BA1\u7406\u89C4\u8303\u7B49\u7BA1\u7406\u5DE5\u5177\u8FDB\u884C\u8BBF\u95EE\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/006\/"},{"id":"T1562.007","name":"\u7981\u7528\u6216\u4FEE\u6539\u4E91\u9632\u706B\u5899","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7981\u7528\u6216\u4FEE\u6539\u4E91\u73AF\u5883\u4E2D\u7684\u9632\u706B\u5899\uFF0C\u4EE5\u7ED5\u8FC7\u9650\u5236\u8BBF\u95EE\u4E91\u8D44\u6E90\u7684\u63A7\u5236\u63AA\u65BD\u3002\u4E91\u9632\u706B\u5899\u4E0E\u7CFB\u7EDF\u9632\u706B\u5899\u4E0D\u540C\uFF0C\u540E\u8005\u5728\u201C\u7981\u7528\u6216\u4FEE\u6539\u7CFB\u7EDF\u9632\u706B\u5899\u201D\u4E2D\u6709\u76F8\u5173\u63CF\u8FF0\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/007\/"},{"id":"T1562.008","name":"\u7981\u7528\u6216\u4FEE\u6539\u4E91\u65E5\u5FD7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7981\u7528\u6216\u4FEE\u6539\u4E91\u65E5\u5FD7\u8BB0\u5F55\u529F\u80FD\u53CA\u96C6\u6210\u670D\u52A1\uFF0C\u4EE5\u9650\u5236\u5BF9\u5176\u6D3B\u52A8\u6570\u636E\u7684\u6536\u96C6\uFF0C\u4ECE\u800C\u89C4\u907F\u68C0\u6D4B\u3002\u4E91\u73AF\u5883\u901A\u5E38\u652F\u6301\u5BA1\u8BA1\u65E5\u5FD7\u548C\u5E94\u7528\u65E5\u5FD7\u7684\u6536\u96C6\u4E0E\u5206\u6790\uFF0C\u8FD9\u4E9B\u65E5\u5FD7\u80FD\u63ED\u793A\u7528\u6237\u5728\u73AF\u5883\u5185\u7684\u64CD\u4F5C\u884C\u4E3A\u3002\u82E5\u653B\u51FB\u8005\u62E5\u6709\u8DB3\u591F\u6743\u9650\uFF0C\u4FBF\u53EF\u5173\u95ED\u6216\u7BE1\u6539\u65E5\u5FD7\u8BB0\u5F55\u673A\u5236\uFF0C\u4EE5\u63A9\u76D6\u5176\u6D3B\u52A8\u75D5\u8FF9\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/008\/"},{"id":"T1562.009","name":"\u5B89\u5168\u6A21\u5F0F\u542F\u52A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Windows\u5B89\u5168\u6A21\u5F0F\u6765\u7981\u7528\u7EC8\u7AEF\u9632\u5FA1\u3002\u5B89\u5168\u6A21\u5F0F\u542F\u52A8\u65F6\uFF0CWindows\u64CD\u4F5C\u7CFB\u7EDF\u4EC5\u52A0\u8F7D\u6709\u9650\u7684\u9A71\u52A8\u548C\u670D\u52A1\u3002\u5728\u5B89\u5168\u6A21\u5F0F\u4E0B\u542F\u52A8Windows\u540E\uFF0C\u7B2C\u4E09\u65B9\u5B89\u5168\u8F6F\u4EF6\uFF08\u5982\u7EC8\u7AEF\u68C0\u6D4B\u4E0E\u54CD\u5E94\u5DE5\u5177\uFF09\u53EF\u80FD\u65E0\u6CD5\u8FD0\u884C\u3002\u5B89\u5168\u6A21\u5F0F\u5206\u4E3A\u4E24\u79CD\uFF1A\u5B89\u5168\u6A21\u5F0F\u4E0E\u5E26\u7F51\u7EDC\u8FDE\u63A5\u7684\u5B89\u5168\u6A21\u5F0F\u3002\u5728\u5B89\u5168\u6A21\u5F0F\u542F\u52A8\u540E\uFF0C\u4ECD\u6709\u53EF\u80FD\u542F\u52A8\u989D\u5916\u7684\u670D\u52A1\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/009\/"},{"id":"T1562.010","name":"\u964D\u7EA7\u653B\u51FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u964D\u7EA7\u6216\u4F7F\u7528\u53EF\u80FD\u5DF2\u8FC7\u65F6\u3001\u5B58\u5728\u6F0F\u6D1E\u4E14\/\u6216\u4E0D\u652F\u6301\u6700\u65B0\u5B89\u5168\u63A7\u5236\u7684\u7CFB\u7EDF\u529F\u80FD\u7248\u672C\u3002\u964D\u7EA7\u653B\u51FB\u901A\u5E38\u5229\u7528\u7CFB\u7EDF\u7684\u5411\u540E\u517C\u5BB9\u6027\uFF0C\u8FEB\u4F7F\u5176\u8FDB\u5165\u5B89\u5168\u6027\u8F83\u4F4E\u7684\u64CD\u4F5C\u6A21\u5F0F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/010\/"},{"id":"T1562.011","name":"\u6B3A\u9A97\u6027\u5B89\u5168\u8B66\u62A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F2A\u9020\u5B89\u5168\u5DE5\u5177\u7684\u8B66\u62A5\u4FE1\u606F\uFF0C\u901A\u8FC7\u5448\u73B0\u865A\u5047\u8BC1\u636E\u6765\u524A\u5F31\u9632\u5FA1\u8005\u5BF9\u6076\u610F\u6D3B\u52A8\u7684\u611F\u77E5\u80FD\u529B\u3002\u9632\u5FA1\u5DE5\u5177\u751F\u6210\u7684\u6D88\u606F\u5305\u542B\u6F5C\u5728\u5B89\u5168\u4E8B\u4EF6\u7684\u4FE1\u606F\uFF0C\u4EE5\u53CA\u5B89\u5168\u8F6F\u4EF6\u548C\u7CFB\u7EDF\u8FD0\u884C\u72B6\u6001\u3002\u5B89\u5168\u62A5\u544A\u4FE1\u606F\u5BF9\u4E8E\u76D1\u63A7\u7CFB\u7EDF\u6B63\u5E38\u8FD0\u884C\u3001\u8BC6\u522B\u53EF\u80FD\u9884\u793A\u5B89\u5168\u4E8B\u4EF6\u7684\u91CD\u8981\u4FE1\u53F7\u81F3\u5173\u91CD\u8981\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/011\/"},{"id":"T1562.012","name":"\u7981\u7528\u6216\u4FEE\u6539Linux\u5BA1\u8BA1\u7CFB\u7EDF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u7981\u7528\u6216\u4FEE\u6539Linux\u5BA1\u8BA1\u7CFB\u7EDF\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u6D3B\u52A8\u5E76\u89C4\u907F\u68C0\u6D4B\u3002Linux\u7BA1\u7406\u5458\u901A\u5E38\u5229\u7528Linux\u5BA1\u8BA1\u7CFB\u7EDF\u6765\u8FFD\u8E2A\u7CFB\u7EDF\u4E2D\u7684\u5B89\u5168\u76F8\u5173\u4FE1\u606F\u3002\u8BE5\u7CFB\u7EDF\u8FD0\u884C\u4E8E\u5185\u6838\u7EA7\u522B\uFF0C\u6839\u636E\u9884\u8BBE\u89C4\u5219\u8BB0\u5F55\u5E94\u7528\u7A0B\u5E8F\u548C\u7CFB\u7EDF\u6D3B\u52A8\u7684\u4E8B\u4EF6\u65E5\u5FD7\uFF0C\u5305\u62EC\u8FDB\u7A0B\u3001\u7F51\u7EDC\u3001\u6587\u4EF6\u53CA\u767B\u5F55\u4E8B\u4EF6\u7B49\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/012\/"},{"id":"T1562.013","name":"\u7981\u7528\u6216\u4FEE\u6539\u7F51\u7EDC\u8BBE\u5907\u9632\u706B\u5899","description":"\u5BF9\u624B\u53EF\u80FD\u5B8C\u5168\u7981\u7528\u57FA\u4E8E\u7F51\u7EDC\u8BBE\u5907\u7684\u9632\u706B\u5899\u673A\u5236\uFF0C\u6216\u6DFB\u52A0\u3001\u5220\u9664\u3001\u4FEE\u6539\u7279\u5B9A\u89C4\u5219\uFF0C\u4EE5\u7ED5\u8FC7\u9650\u5236\u7F51\u7EDC\u4F7F\u7528\u7684\u63A7\u5236\u63AA\u65BD\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/013\/"},{"id":"T1562","name":"\u524A\u5F31\u9632\u5FA1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6076\u610F\u4FEE\u6539\u53D7\u5BB3\u73AF\u5883\u4E2D\u7684\u7EC4\u4EF6\uFF0C\u4EE5\u963B\u788D\u6216\u7981\u7528\u9632\u5FA1\u673A\u5236\u3002\u8FD9\u4E0D\u4EC5\u5305\u62EC\u524A\u5F31\u9632\u706B\u5899\u548C\u9632\u75C5\u6BD2\u8F6F\u4EF6\u7B49\u9884\u9632\u6027\u9632\u5FA1\u63AA\u65BD\uFF0C\u8FD8\u6D89\u53CA\u7834\u574F\u9632\u5FA1\u8005\u7528\u4E8E\u5BA1\u8BA1\u6D3B\u52A8\u548C\u8BC6\u522B\u6076\u610F\u884C\u4E3A\u7684\u68C0\u6D4B\u80FD\u529B\u3002\u8FD9\u79CD\u884C\u4E3A\u53EF\u80FD\u540C\u65F6\u9488\u5BF9\u7CFB\u7EDF\u539F\u751F\u9632\u5FA1\u529F\u80FD\u4EE5\u53CA\u7528\u6237\u548C\u7BA1\u7406\u5458\u5B89\u88C5\u7684\u8865\u5145\u6027\u9632\u62A4\u63AA\u65BD\u3002","sub-techniques":"T1562.001, T1562.002, T1562.003, T1562.004, T1562.006, T1562.007, T1562.008, T1562.009, T1562.010, T1562.011, T1562.012, T1562.013","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668,ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u7F51\u7EDC\u8BBE\u5907,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1562\/"},{"id":"T1563.001","name":"SSH\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u5408\u6CD5\u7528\u6237\u7684SSH\u4F1A\u8BDD\u5728\u73AF\u5883\u4E2D\u6A2A\u5411\u79FB\u52A8\u3002\u5B89\u5168\u5916\u58F3\u534F\u8BAE\uFF08SSH\uFF09\u662FLinux\u548CmacOS\u7CFB\u7EDF\u8FDC\u7A0B\u8BBF\u95EE\u7684\u6807\u51C6\u65B9\u5F0F\uFF0C\u5B83\u5141\u8BB8\u7528\u6237\u901A\u8FC7\u52A0\u5BC6\u96A7\u9053\u8FDE\u63A5\u5230\u53E6\u4E00\u53F0\u7CFB\u7EDF\uFF0C\u901A\u5E38\u901A\u8FC7\u5BC6\u7801\u3001\u8BC1\u4E66\u6216\u4F7F\u7528\u975E\u5BF9\u79F0\u52A0\u5BC6\u5BC6\u94A5\u5BF9\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1563\/001\/"},{"id":"T1563.002","name":"RDP\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u5408\u6CD5\u7528\u6237\u7684\u8FDC\u7A0B\u684C\u9762\u4F1A\u8BDD\uFF0C\u5728\u73AF\u5883\u4E2D\u6A2A\u5411\u79FB\u52A8\u3002\u8FDC\u7A0B\u684C\u9762\u662F\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u7684\u5E38\u89C1\u529F\u80FD\uFF0C\u5141\u8BB8\u7528\u6237\u767B\u5F55\u5230\u8FDC\u7A0B\u7CFB\u7EDF\u7684\u56FE\u5F62\u7528\u6237\u754C\u9762\u8FDB\u884C\u4EA4\u4E92\u4F1A\u8BDD\u3002\u5FAE\u8F6F\u5C06\u5176\u8FDC\u7A0B\u684C\u9762\u534F\u8BAE\uFF08RDP\uFF09\u7684\u5B9E\u73B0\u79F0\u4E3A\u8FDC\u7A0B\u684C\u9762\u670D\u52A1\uFF08RDS\uFF09\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1563\/002\/"},{"id":"T1563","name":"\u8FDC\u7A0B\u670D\u52A1\u4F1A\u8BDD\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u63A7\u5236\u8FDC\u7A0B\u670D\u52A1\u7684\u73B0\u6709\u4F1A\u8BDD\u6765\u6A2A\u5411\u79FB\u52A8\u4E8E\u7F51\u7EDC\u73AF\u5883\u4E2D\u3002\u7528\u6237\u901A\u5E38\u4F1A\u4F7F\u7528\u6709\u6548\u51ED\u636E\u767B\u5F55\u4E13\u95E8\u8BBE\u8BA1\u7528\u4E8E\u63A5\u53D7\u8FDC\u7A0B\u8FDE\u63A5\u7684\u670D\u52A1\uFF0C\u4F8B\u5982Telnet\u3001SSH\u548CRDP\u3002\u5F53\u7528\u6237\u767B\u5F55\u670D\u52A1\u65F6\uFF0C\u5C06\u5EFA\u7ACB\u4E00\u4E2A\u4F1A\u8BDD\uFF0C\u4F7F\u4ED6\u4EEC\u80FD\u591F\u4E0E\u8BE5\u670D\u52A1\u4FDD\u6301\u6301\u7EED\u4EA4\u4E92\u3002","sub-techniques":"T1563.001, T1563.002","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1563\/"},{"id":"T1564.001","name":"\u9690\u85CF\u6587\u4EF6\u548C\u76EE\u5F55","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6587\u4EF6\u548C\u76EE\u5F55\u8BBE\u7F6E\u4E3A\u9690\u85CF\uFF0C\u4EE5\u89C4\u907F\u68C0\u6D4B\u673A\u5236\u3002\u4E3A\u9632\u6B62\u666E\u901A\u7528\u6237\u610F\u5916\u66F4\u6539\u7CFB\u7EDF\u4E2D\u7684\u7279\u6B8A\u6587\u4EF6\uFF0C\u5927\u591A\u6570\u64CD\u4F5C\u7CFB\u7EDF\u90FD\u8BBE\u6709\u201C\u9690\u85CF\u201D\u6587\u4EF6\u7684\u6982\u5FF5\u3002\u5F53\u7528\u6237\u901A\u8FC7\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF08GUI\uFF09\u6D4F\u89C8\u6587\u4EF6\u7CFB\u7EDF\u6216\u4F7F\u7528\u547D\u4EE4\u884C\u4E2D\u7684\u5E38\u89C4\u547D\u4EE4\u65F6\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u4E0D\u4F1A\u663E\u793A\u3002\u7528\u6237\u5FC5\u987B\u901A\u8FC7\u4E00\u7CFB\u5217\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF08GUI\uFF09\u63D0\u793A\u6216\u547D\u4EE4\u884C\u5F00\u5173\uFF08Windows\u7CFB\u7EDF\u4F7F\u7528dir \/a\uFF0CLinux\u548CmacOS\u7CFB\u7EDF\u4F7F\u7528ls \u2013a\uFF09\u660E\u786E\u8981\u6C42\u663E\u793A\u9690\u85CF\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/001\/"},{"id":"T1564.002","name":"\u9690\u85CF\u7528\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u9690\u85CF\u7528\u6237\u6765\u63A9\u76D6\u4ED6\u4EEC\u521B\u5EFA\u6216\u4FEE\u6539\u7684\u7528\u6237\u8D26\u6237\u7684\u5B58\u5728\u3002\u7BA1\u7406\u5458\u53EF\u80FD\u5E0C\u671B\u5728\u7279\u5B9A\u7CFB\u7EDF\u4E0A\u5B58\u5728\u5927\u91CF\u7528\u6237\u8D26\u6237\u65F6\u9690\u85CF\u67D0\u4E9B\u7528\u6237\uFF0C\u6216\u8005\u4ED6\u4EEC\u5E0C\u671B\u5411\u5176\u4ED6\u7528\u6237\u9690\u85CF\u5176\u7BA1\u7406\u8D26\u6237\u6216\u5176\u4ED6\u7BA1\u7406\u8D26\u6237\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/002\/"},{"id":"T1564.003","name":"\u9690\u85CF\u7684\u7A97\u53E3","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u9690\u85CF\u7A97\u53E3\u6765\u63A9\u76D6\u6076\u610F\u6D3B\u52A8\uFF0C\u4F7F\u5176\u4E0D\u88AB\u7528\u6237\u8F7B\u6613\u5BDF\u89C9\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u5E94\u7528\u7A0B\u5E8F\u6267\u884C\u64CD\u4F5C\u65F6\u901A\u5E38\u4F1A\u663E\u793A\u7684\u7A97\u53E3\u53EF\u4EE5\u88AB\u9690\u85CF\u3002\u7CFB\u7EDF\u7BA1\u7406\u5458\u4E5F\u53EF\u80FD\u5229\u7528\u8FD9\u4E00\u529F\u80FD\uFF0C\u5728\u6267\u884C\u7BA1\u7406\u4EFB\u52A1\u65F6\u907F\u514D\u5E72\u6270\u7528\u6237\u7684\u5DE5\u4F5C\u73AF\u5883\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/003\/"},{"id":"T1564.004","name":"NTFS \u6587\u4EF6\u5C5E\u6027","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528NTFS\u6587\u4EF6\u5C5E\u6027\u9690\u85CF\u6076\u610F\u6570\u636E\u4EE5\u89C4\u907F\u68C0\u6D4B\u3002\u6BCF\u4E2A\u91C7\u7528\u65B0\u6280\u672F\u6587\u4EF6\u7CFB\u7EDF\uFF08NTFS\uFF09\u683C\u5F0F\u5316\u7684\u5206\u533A\u90FD\u5305\u542B\u4E00\u4E2A\u4E3B\u6587\u4EF6\u8868\uFF08MFT\uFF09\uFF0C\u8BE5\u8868\u8BB0\u5F55\u4E86\u5206\u533A\u4E0A\u6BCF\u4E2A\u6587\u4EF6\/\u76EE\u5F55\u7684\u4FE1\u606F\u3002\u5728MFT\u6761\u76EE\u4E2D\uFF0C\u6587\u4EF6\u5C5E\u6027\uFF08\u5982\u6269\u5C55\u5C5E\u6027\uFF08EA\uFF09\u548C\u6570\u636E\u5C5E\u6027\uFF09\u53EF\u7528\u4E8E\u5B58\u50A8\u4EFB\u610F\u6570\u636E\uFF08\u751A\u81F3\u5B8C\u6574\u6587\u4EF6\uFF09\uFF0C\u5F53\u5B58\u5728\u591A\u4E2A\u6570\u636E\u5C5E\u6027\u65F6\uFF0C\u8FD9\u4E9B\u6570\u636E\u5C5E\u6027\u88AB\u79F0\u4E3A\u5907\u7528\u6570\u636E\u6D41\uFF08ADS\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/004\/"},{"id":"T1564.005","name":"\u9690\u85CF\u6587\u4EF6\u7CFB\u7EDF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u9690\u85CF\u6587\u4EF6\u7CFB\u7EDF\u6765\u63A9\u76D6\u5176\u6076\u610F\u6D3B\u52A8\uFF0C\u4EE5\u8EB2\u907F\u7528\u6237\u548C\u5B89\u5168\u5DE5\u5177\u7684\u68C0\u6D4B\u3002\u6587\u4EF6\u7CFB\u7EDF\u4E3A\u7269\u7406\u5B58\u50A8\u8BBE\u5907\u4E0A\u7684\u6570\u636E\u5B58\u50A8\u4E0E\u8BBF\u95EE\u63D0\u4F9B\u4E86\u7ED3\u6784\u5316\u6846\u67B6\u3002\u901A\u5E38\uFF0C\u7528\u6237\u901A\u8FC7\u5E94\u7528\u7A0B\u5E8F\u4E0E\u6587\u4EF6\u7CFB\u7EDF\u4EA4\u4E92\uFF0C\u8BBF\u95EE\u6587\u4EF6\u548C\u76EE\u5F55\u2014\u2014\u8FD9\u4E9B\u62BD\u8C61\u6982\u5FF5\u72EC\u7ACB\u4E8E\u7269\u7406\u5B58\u50A8\u4F4D\u7F6E\uFF08\u4F8B\u5982\u78C1\u76D8\u6247\u533A\uFF09\u3002\u5E38\u89C1\u7684\u6807\u51C6\u6587\u4EF6\u7CFB\u7EDF\u5305\u62ECFAT\u3001NTFS\u3001ext4\u548CAPFS\u3002\u6587\u4EF6\u7CFB\u7EDF\u8FD8\u53EF\u5305\u542B\u5176\u4ED6\u7ED3\u6784\uFF0C\u4F8B\u5982NTFS\u4E2D\u7684\u5377\u5F15\u5BFC\u8BB0\u5F55\uFF08VBR\uFF09\u548C\u4E3B\u6587\u4EF6\u8868\uFF08MFT\uFF09\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/005\/"},{"id":"T1564.006","name":"\u8FD0\u884C\u865A\u62DF\u5B9E\u4F8B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u865A\u62DF\u5B9E\u4F8B\u6267\u884C\u6076\u610F\u64CD\u4F5C\u4EE5\u89C4\u907F\u68C0\u6D4B\u3002\u5F53\u524D\u5B58\u5728\u591A\u79CD\u865A\u62DF\u5316\u6280\u672F\uFF0C\u80FD\u591F\u6A21\u62DF\u8BA1\u7B97\u673A\u6216\u8BA1\u7B97\u73AF\u5883\u3002\u901A\u8FC7\u5728\u865A\u62DF\u5B9E\u4F8B\u5185\u90E8\u8FD0\u884C\u6076\u610F\u4EE3\u7801\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u9690\u85CF\u4E0E\u5176\u884C\u4E3A\u76F8\u5173\u7684\u75D5\u8FF9\uFF0C\u4F7F\u90A3\u4E9B\u65E0\u6CD5\u76D1\u63A7\u865A\u62DF\u5B9E\u4F8B\u5185\u90E8\u6D3B\u52A8\u7684\u5B89\u5168\u5DE5\u5177\u5931\u6548\u3002\u6B64\u5916\uFF0C\u6839\u636E\u865A\u62DF\u7F51\u7EDC\u5B9E\u73B0\u65B9\u5F0F\u7684\u4E0D\u540C\uFF08\u4F8B\u5982\u6865\u63A5\u9002\u914D\u5668\uFF09\uFF0C\u865A\u62DF\u5B9E\u4F8B\u4EA7\u751F\u7684\u7F51\u7EDC\u6D41\u91CF\u53EF\u80FD\u96BE\u4EE5\u8FFD\u6EAF\u5230\u53D7\u611F\u67D3\u7684\u4E3B\u673A\uFF0C\u56E0\u4E3A\u5176IP\u5730\u5740\u548C\u4E3B\u673A\u540D\u53EF\u80FD\u4E0E\u5DF2\u77E5\u4FE1\u606F\u4E0D\u7B26\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/006\/"},{"id":"T1564.007","name":"VBA \u4EE3\u7801\u8986\u76D6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06VBA\u6E90\u4EE3\u7801\u66FF\u6362\u4E3A\u826F\u6027\u6570\u636E\uFF0C\u6765\u9690\u85CF\u5D4C\u5165\u5728MS Office\u6587\u6863\u4E2D\u7684\u6076\u610FVBA\u8D1F\u8F7D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/007\/"},{"id":"T1564.008","name":"\u90AE\u4EF6\u9690\u85CF\u89C4\u5219","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u90AE\u4EF6\u89C4\u5219\u6765\u9690\u85CF\u5DF2\u5165\u4FB5\u7528\u6237\u90AE\u7BB1\u4E2D\u7684\u63A5\u6536\u90AE\u4EF6\u3002\u8BB8\u591A\u90AE\u4EF6\u5BA2\u6237\u7AEF\u5141\u8BB8\u7528\u6237\u521B\u5EFA\u6536\u4EF6\u7BB1\u89C4\u5219\uFF0C\u7528\u4E8E\u6267\u884C\u591A\u79CD\u90AE\u4EF6\u64CD\u4F5C\uFF0C\u5305\u62EC\u5C06\u90AE\u4EF6\u79FB\u81F3\u5176\u4ED6\u6587\u4EF6\u5939\u3001\u6807\u8BB0\u90AE\u4EF6\u4E3A\u5DF2\u8BFB\u6216\u5220\u9664\u90AE\u4EF6\u3002\u8FD9\u4E9B\u89C4\u5219\u53EF\u4EE5\u901A\u8FC7\u90AE\u4EF6\u5BA2\u6237\u7AEF\u5185\u90E8\u529F\u80FD\u521B\u5EFA\u6216\u4FEE\u6539\uFF0C\u4E5F\u53EF\u901A\u8FC7\u5916\u90E8\u529F\u80FD\u5B9E\u73B0\uFF0C\u4F8B\u5982\u5728Windows\u7CFB\u7EDF\u4E2D\u4F7F\u7528New-InboxRule\u6216Set-InboxRule PowerShell cmdlet\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/008\/"},{"id":"T1564.009","name":"\u8D44\u6E90\u5206\u53C9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8D44\u6E90\u5206\u652F\u6765\u9690\u85CF\u6076\u610F\u4EE3\u7801\u6216\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u4EE5\u9003\u907F\u68C0\u6D4B\u5E76\u7ED5\u8FC7\u5B89\u5168\u5E94\u7528\u7A0B\u5E8F\u3002\u8D44\u6E90\u5206\u652F\u4E3A\u5E94\u7528\u7A0B\u5E8F\u63D0\u4F9B\u4E86\u4E00\u79CD\u7ED3\u6784\u5316\u7684\u65B9\u5F0F\u6765\u5B58\u50A8\u8D44\u6E90\uFF0C\u5982\u7F29\u7565\u56FE\u3001\u83DC\u5355\u5B9A\u4E49\u3001\u56FE\u6807\u3001\u5BF9\u8BDD\u6846\u548C\u4EE3\u7801\u3002\u901A\u8FC7\u663E\u793A\u6587\u4EF6\u7684\u6269\u5C55\u5C5E\u6027\uFF0C\u4F7F\u7528`ls -l@`\u6216`xattr -l`\u547D\u4EE4\uFF0C\u53EF\u4EE5\u8BC6\u522B\u8D44\u6E90\u5206\u652F\u7684\u4F7F\u7528\u60C5\u51B5\u3002\u8D44\u6E90\u5206\u652F\u5DF2\u88AB\u5F03\u7528\uFF0C\u5E76\u88AB\u5E94\u7528\u7A0B\u5E8F\u5305\u7ED3\u6784\u6240\u53D6\u4EE3\u3002\u975E\u672C\u5730\u5316\u8D44\u6E90\u653E\u7F6E\u5728\u5E94\u7528\u7A0B\u5E8F\u5305\u7684\u9876\u7EA7\u76EE\u5F55\u4E2D\uFF0C\u800C\u672C\u5730\u5316\u8D44\u6E90\u5219\u653E\u7F6E\u5728`\/Resources`\u6587\u4EF6\u5939\u4E2D\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/009\/"},{"id":"T1564.010","name":"\u8FDB\u7A0B\u53C2\u6570\u6B3A\u9A97","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u8986\u76D6\u8FDB\u7A0B\u5185\u5B58\u6765\u9690\u85CF\u8FDB\u7A0B\u547D\u4EE4\u884C\u53C2\u6570\u3002\u8FDB\u7A0B\u547D\u4EE4\u884C\u53C2\u6570\u5B58\u50A8\u5728\u8FDB\u7A0B\u73AF\u5883\u5757\uFF08PEB\uFF09\u4E2D\uFF0C\u8FD9\u662FWindows\u7528\u4E8E\u5B58\u50A8\u8FDB\u7A0B\u76F8\u5173\u4FE1\u606F\u6216\u8FDB\u7A0B\u4F7F\u7528\u7684\u6570\u636E\u7ED3\u6784\u3002PEB\u5305\u542B\u4E86\u6267\u884C\u8FDB\u7A0B\u65F6\u5F15\u7528\u7684\u8FDB\u7A0B\u547D\u4EE4\u884C\u53C2\u6570\u3002\u5F53\u8FDB\u7A0B\u521B\u5EFA\u65F6\uFF0C\u76D1\u63A7\u8FDB\u7A0B\u521B\u5EFA\u7684\u9632\u5FA1\u5DE5\u5177\u6216\u4F20\u611F\u5668\u53EF\u80FD\u4F1A\u4ECEPEB\u4E2D\u68C0\u7D22\u8FDB\u7A0B\u53C2\u6570\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/010\/"},{"id":"T1564.011","name":"\u5FFD\u7565\u8FDB\u7A0B\u4E2D\u65AD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6267\u884C\u80FD\u591F\u8EB2\u907F\u8FDB\u7A0B\u4E2D\u65AD\u4FE1\u53F7\u7684\u547D\u4EE4\u6765\u89C4\u907F\u9632\u5FA1\u673A\u5236\u3002\u8BB8\u591A\u64CD\u4F5C\u7CFB\u7EDF\u5229\u7528\u4FE1\u53F7\u4F20\u9012\u4FE1\u606F\u4EE5\u63A7\u5236\u8FDB\u7A0B\u884C\u4E3A\u3002\u547D\u4EE4\u89E3\u91CA\u5668\u901A\u5E38\u5305\u542B\u7279\u5B9A\u7684\u547D\u4EE4\u6216\u6807\u5FD7\uFF0C\u7528\u4E8E\u5FFD\u7565\u9519\u8BEF\u53CA\u5176\u4ED6\u6302\u8D77\u60C5\u51B5\uFF0C\u4F8B\u5982\u5F53\u6D3B\u8DC3\u4F1A\u8BDD\u7684\u7528\u6237\u6CE8\u9500\u65F6\u3002\u9632\u5FA1\u5DE5\u5177\u548C\/\u6216\u5206\u6790\u4EBA\u5458\u4E5F\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u4E2D\u65AD\u4FE1\u53F7\u6765\u6682\u505C\u6216\u7EC8\u6B62\u6307\u5B9A\u7684\u8FD0\u884C\u8FDB\u7A0B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/011\/"},{"id":"T1564.012","name":"\u6587\u4EF6\/\u8DEF\u5F84\u6392\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u5C06\u57FA\u4E8E\u6587\u4EF6\u7684\u6076\u610F\u7A0B\u5E8F\u5199\u5165\u7279\u5B9A\u6587\u4EF6\u5939\u6216\u4F7F\u7528\u7279\u5B9A\u6587\u4EF6\u540D\u6765\u9690\u85CF\u5176\u75D5\u8FF9\uFF0C\u8FD9\u4E9B\u6587\u4EF6\u5939\u6216\u6587\u4EF6\u540D\u88AB\u6392\u9664\u5728\u9632\u75C5\u6BD2\uFF08AV\uFF09\u626B\u63CF\u548C\u5176\u4ED6\u9632\u5FA1\u80FD\u529B\u4E4B\u5916\u3002\u9632\u75C5\u6BD2\u8F6F\u4EF6\u548C\u5176\u4ED6\u57FA\u4E8E\u6587\u4EF6\u7684\u626B\u63CF\u7A0B\u5E8F\u901A\u5E38\u5305\u542B\u6392\u9664\u9879\uFF0C\u4EE5\u4F18\u5316\u6027\u80FD\uFF0C\u5E76\u4FBF\u4E8E\u5E94\u7528\u7A0B\u5E8F\u7684\u5B89\u88C5\u548C\u5408\u6CD5\u4F7F\u7528\u3002\u8FD9\u4E9B\u6392\u9664\u9879\u53EF\u80FD\u662F\u60C5\u5883\u6027\u7684\uFF08\u4F8B\u5982\uFF0C\u4EC5\u5728\u54CD\u5E94\u7279\u5B9A\u89E6\u53D1\u4E8B\u4EF6\/\u8B66\u62A5\u65F6\u542F\u52A8\u626B\u63CF\uFF09\uFF0C\u4F46\u4E5F\u5E38\u5E38\u662F\u786C\u7F16\u7801\u7684\u5B57\u7B26\u4E32\uFF0C\u5F15\u7528\u88AB\u5047\u5B9A\u4E3A\u53EF\u4FE1\u4E14\u5408\u6CD5\u7684\u7279\u5B9A\u6587\u4EF6\u5939\u548C\/\u6216\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/012\/"},{"id":"T1564.013","name":"\u7ED1\u5B9A\u6302\u8F7D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u6587\u4EF6\u7ED3\u6784\u4E0A\u7684\u7ED1\u5B9A\u6302\u8F7D\u6765\u9690\u85CF\u5176\u6D3B\u52A8\u548C\u75D5\u8FF9\uFF0C\u4F7F\u5176\u4E0D\u88AB\u539F\u751F\u5DE5\u5177\u68C0\u6D4B\u5230\u3002\u7ED1\u5B9A\u6302\u8F7D\u5C06\u6587\u4EF6\u7CFB\u7EDF\u4E2D\u7684\u4E00\u4E2A\u76EE\u5F55\u6216\u6587\u4EF6\u6620\u5C04\u5230\u53E6\u4E00\u4E2A\u4F4D\u7F6E\uFF0C\u7C7B\u4F3C\u4E8EWindows\u4E0A\u7684\u5FEB\u6377\u65B9\u5F0F\u3002\u5B83\u901A\u5E38\u7528\u4E8E\u5728\u4E0D\u540C\u73AF\u5883\uFF08\u5982\u5BB9\u5668\u6216chroot\u73AF\u5883\uFF09\u4E2D\u63D0\u4F9B\u5BF9\u7279\u5B9A\u6587\u4EF6\u6216\u76EE\u5F55\u7684\u8BBF\u95EE\uFF0C\u5E76\u4E14\u9700\u8981sudo\u6743\u9650\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/013\/"},{"id":"T1564.014","name":"\u6269\u5C55\u5C5E\u6027","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528macOS\u548CLinux\u4E0A\u7684\u6269\u5C55\u5C5E\u6027\uFF08xattrs\uFF09\u6765\u9690\u85CF\u6076\u610F\u6570\u636E\uFF0C\u4EE5\u9003\u907F\u68C0\u6D4B\u3002\u6269\u5C55\u5C5E\u6027\u662FmacOS\u548CLinux\u7CFB\u7EDF\u4E2D\u7528\u4E8E\u6587\u4EF6\u548C\u76EE\u5F55\u5143\u6570\u636E\u7684\u952E\u503C\u5BF9\u3002\u5B83\u4EEC\u65E0\u6CD5\u901A\u8FC7Finder\u3001ls\u6216cat\u7B49\u6807\u51C6\u5DE5\u5177\u76F4\u63A5\u67E5\u770B\uFF0C\u9700\u8981\u4F7F\u7528xattr\uFF08macOS\uFF09\u6216getfattr\uFF08Linux\uFF09\u7B49\u4E13\u7528\u5DE5\u5177\u8FDB\u884C\u68C0\u6D4B\u3002\u64CD\u4F5C\u7CFB\u7EDF\u548C\u5E94\u7528\u7A0B\u5E8F\u5229\u7528xattrs\u8FDB\u884C\u6807\u7B7E\u6807\u8BB0\u3001\u5B8C\u6574\u6027\u6821\u9A8C\u548C\u8BBF\u95EE\u63A7\u5236\u3002\u5728Linux\u7CFB\u7EDF\u4E2D\uFF0Cxattrs\u6309\u547D\u540D\u7A7A\u95F4\u7EC4\u7EC7\uFF0C\u4F8B\u5982user.\uFF08\u7528\u6237\u6743\u9650\uFF09\u3001trusted.\uFF08\u6839\u6743\u9650\uFF09\u3001security.\u548Csystem.\uFF0C\u6BCF\u4E2A\u547D\u540D\u7A7A\u95F4\u5177\u6709\u7279\u5B9A\u7684\u6743\u9650\u8BBE\u7F6E\u3002\u800C\u5728macOS\u7CFB\u7EDF\u4E2D\uFF0Cxattrs\u91C7\u7528\u65E0\u547D\u540D\u7A7A\u95F4\u524D\u7F00\u7684\u6241\u5E73\u5B57\u7B26\u4E32\u7ED3\u6784\uFF0C\u901A\u5E38\u4EE5com.apple.*\u4E3A\u524D\u7F00\uFF08\u4F8B\u5982com.apple.quarantine\u3001com.apple.metadata:_kMDItemUserTags\uFF09\uFF0C\u5E76\u88ABGatekeeper\u548CSpotlight\u7B49\u7CFB\u7EDF\u529F\u80FD\u6240\u4F7F\u7528\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/014\/"},{"id":"T1564","name":"\u9690\u85CF\u75D5\u8FF9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u9690\u85CF\u4E0E\u5176\u884C\u4E3A\u76F8\u5173\u7684\u75D5\u8FF9\u4EE5\u9003\u907F\u68C0\u6D4B\u3002\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u5177\u5907\u9690\u85CF\u5404\u7C7B\u75D5\u8FF9\u7684\u529F\u80FD\uFF0C\u4F8B\u5982\u91CD\u8981\u7684\u7CFB\u7EDF\u6587\u4EF6\u548C\u7BA1\u7406\u4EFB\u52A1\u6267\u884C\u8BB0\u5F55\uFF0C\u4EE5\u907F\u514D\u5E72\u6270\u7528\u6237\u5DE5\u4F5C\u73AF\u5883\u5E76\u9632\u6B62\u7528\u6237\u66F4\u6539\u7CFB\u7EDF\u6587\u4EF6\u6216\u529F\u80FD\u3002\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8FD9\u4E9B\u529F\u80FD\u6765\u9690\u85CF\u6587\u4EF6\u3001\u76EE\u5F55\u3001\u7528\u6237\u8D26\u6237\u6216\u5176\u4ED6\u7CFB\u7EDF\u6D3B\u52A8\u75D5\u8FF9\uFF0C\u4ECE\u800C\u89C4\u907F\u68C0\u6D4B\u3002","sub-techniques":"T1564.001, T1564.002, T1564.003, T1564.004, T1564.005, T1564.006, T1564.007, T1564.008, T1564.009, T1564.010, T1564.011, T1564.012, T1564.013, T1564.014","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"ESXi,Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1564\/"},{"id":"T1565.001","name":"\u5B58\u50A8\u6570\u636E\u64CD\u4F5C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u63D2\u5165\u3001\u5220\u9664\u6216\u7BE1\u6539\u9759\u6001\u6570\u636E\u6765\u5F71\u54CD\u5916\u90E8\u7ED3\u679C\u6216\u9690\u85CF\u6D3B\u52A8\uFF0C\u4ECE\u800C\u5A01\u80C1\u6570\u636E\u7684\u5B8C\u6574\u6027\u3002\u901A\u8FC7\u64CD\u7EB5\u5B58\u50A8\u7684\u6570\u636E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5F71\u54CD\u4E1A\u52A1\u6D41\u7A0B\u3001\u7EC4\u7EC7\u7406\u89E3\u548C\u51B3\u7B56\u5236\u5B9A\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1565\/001\/"},{"id":"T1565.002","name":"\u4F20\u8F93\u6570\u636E\u64CD\u7EB5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6570\u636E\u4F20\u5F80\u5B58\u50A8\u6216\u5176\u4ED6\u7CFB\u7EDF\u7684\u9014\u4E2D\u7BE1\u6539\u6570\u636E\uFF0C\u4EE5\u64CD\u7EB5\u5916\u90E8\u7ED3\u679C\u6216\u9690\u85CF\u6D3B\u52A8\uFF0C\u4ECE\u800C\u5A01\u80C1\u6570\u636E\u7684\u5B8C\u6574\u6027\u3002\u901A\u8FC7\u64CD\u63A7\u4F20\u8F93\u4E2D\u7684\u6570\u636E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5F71\u54CD\u4E1A\u52A1\u6D41\u7A0B\u3001\u7EC4\u7EC7\u8BA4\u77E5\u548C\u51B3\u7B56\u5236\u5B9A\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1565\/002\/"},{"id":"T1565.003","name":"\u8FD0\u884C\u65F6\u6570\u636E\u64CD\u4F5C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u7CFB\u7EDF\u6765\u64CD\u63A7\u7EC8\u7AEF\u7528\u6237\u8BBF\u95EE\u548C\u663E\u793A\u7684\u6570\u636E\uFF0C\u4ECE\u800C\u5A01\u80C1\u6570\u636E\u7684\u5B8C\u6574\u6027\u3002\u901A\u8FC7\u64CD\u7EB5\u8FD0\u884C\u65F6\u6570\u636E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u5F71\u54CD\u4E1A\u52A1\u6D41\u7A0B\u3001\u7EC4\u7EC7\u8BA4\u77E5\u548C\u51B3\u7B56\u5236\u5B9A\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1565\/003\/"},{"id":"T1565","name":"\u6570\u636E\u64CD\u4F5C","description":"\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u63D2\u5165\u3001\u5220\u9664\u6216\u7BE1\u6539\u6570\u636E\u6765\u5F71\u54CD\u5916\u90E8\u7ED3\u679C\u6216\u9690\u85CF\u6D3B\u52A8\uFF0C\u4ECE\u800C\u5A01\u80C1\u6570\u636E\u7684\u5B8C\u6574\u6027\u3002\u901A\u8FC7\u64CD\u7EB5\u6570\u636E\uFF0C\u5BF9\u624B\u53EF\u80FD\u8BD5\u56FE\u5F71\u54CD\u4E1A\u52A1\u6D41\u7A0B\u3001\u7EC4\u7EC7\u7406\u89E3\u6216\u51B3\u7B56\u5236\u5B9A\u3002","sub-techniques":"T1565.001, T1565.002, T1565.003","tactic":"\u5F71\u54CD","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1565\/"},{"id":"T1566.001","name":"\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u9644\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u53D1\u9001\u5E26\u6709\u6076\u610F\u9644\u4EF6\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u90AE\u4EF6\uFF0C\u8BD5\u56FE\u83B7\u53D6\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u9644\u4EF6\u662F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u7684\u4E00\u79CD\u7279\u5B9A\u53D8\u4F53\uFF0C\u5176\u7279\u70B9\u5728\u4E8E\u5229\u7528\u7535\u5B50\u90AE\u4EF6\u9644\u4EF6\u643A\u5E26\u6076\u610F\u8F6F\u4EF6\uFF0C\u8FD9\u4E0E\u5176\u5B83\u5F62\u5F0F\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u6709\u6240\u4E0D\u540C\u3002\u6240\u6709\u5F62\u5F0F\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u90FD\u662F\u9488\u5BF9\u7279\u5B9A\u4E2A\u4EBA\u3001\u516C\u53F8\u6216\u884C\u4E1A\u7684\u7535\u5B50\u5316\u793E\u4EA4\u5DE5\u7A0B\u624B\u6BB5\u3002\u5728\u6B64\u7C7B\u653B\u51FB\u573A\u666F\u4E2D\uFF0C\u653B\u51FB\u8005\u4F1A\u5728\u9C7C\u53C9\u5F0F\u9493\u9C7C\u90AE\u4EF6\u4E2D\u9644\u52A0\u6587\u4EF6\uFF0C\u5E76\u901A\u5E38\u4F9D\u8D56\u7528\u6237\u6267\u884C\u64CD\u4F5C\u6765\u5B9E\u73B0\u6076\u610F\u4EE3\u7801\u8FD0\u884C\u3002\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u8FD8\u53EF\u80FD\u6D89\u53CA\u4F2A\u88C5\u6210\u53EF\u4FE1\u6765\u6E90\u7B49\u793E\u4EA4\u5DE5\u7A0B\u6280\u672F\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1566\/001\/"},{"id":"T1566.002","name":"\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u94FE\u63A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u53D1\u9001\u5E26\u6709\u6076\u610F\u94FE\u63A5\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u90AE\u4EF6\uFF0C\u8BD5\u56FE\u83B7\u53D6\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u94FE\u63A5\u5F0F\u9C7C\u53C9\u7F51\u7EDC\u9493\u9C7C\u662F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u7684\u4E00\u79CD\u7279\u5B9A\u53D8\u4F53\u3002\u4E0E\u5176\u4ED6\u5F62\u5F0F\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u4E0D\u540C\uFF0C\u5B83\u5229\u7528\u94FE\u63A5\u4E0B\u8F7D\u90AE\u4EF6\u4E2D\u5305\u542B\u7684\u6076\u610F\u8F6F\u4EF6\uFF0C\u800C\u4E0D\u662F\u5C06\u6076\u610F\u6587\u4EF6\u9644\u52A0\u5230\u90AE\u4EF6\u672C\u8EAB\uFF0C\u4EE5\u89C4\u907F\u53EF\u80FD\u68C0\u67E5\u90AE\u4EF6\u9644\u4EF6\u7684\u9632\u5FA1\u63AA\u65BD\u3002\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u8FD8\u53EF\u80FD\u6D89\u53CA\u793E\u4F1A\u5DE5\u7A0B\u6280\u672F\uFF0C\u4F8B\u5982\u4F2A\u88C5\u6210\u53EF\u4FE1\u6765\u6E90\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1566\/002\/"},{"id":"T1566.003","name":"\u901A\u8FC7\u670D\u52A1\u8FDB\u884C\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7B2C\u4E09\u65B9\u670D\u52A1\u53D1\u9001\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u4FE1\u606F\uFF0C\u8BD5\u56FE\u83B7\u53D6\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u901A\u8FC7\u670D\u52A1\u8FDB\u884C\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u662F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u7684\u4E00\u79CD\u7279\u5B9A\u53D8\u4F53\u3002\u4E0E\u5176\u4ED6\u5F62\u5F0F\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u4E0D\u540C\uFF0C\u5B83\u5229\u7528\u7684\u662F\u7B2C\u4E09\u65B9\u670D\u52A1\uFF0C\u800C\u975E\u76F4\u63A5\u901A\u8FC7\u4F01\u4E1A\u7535\u5B50\u90AE\u4EF6\u6E20\u9053\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1566\/003\/"},{"id":"T1566.004","name":"\u9C7C\u53C9\u5F0F\u8BED\u97F3\u9493\u9C7C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u8BED\u97F3\u901A\u4FE1\u624B\u6BB5\uFF0C\u6700\u7EC8\u83B7\u53D6\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u9C7C\u53C9\u5F0F\u8BED\u97F3\u9493\u9C7C\u662F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u7684\u4E00\u79CD\u7279\u5B9A\u53D8\u4F53\uFF0C\u5176\u533A\u522B\u4E8E\u5176\u4ED6\u5F62\u5F0F\u9C7C\u53C9\u5F0F\u9493\u9C7C\u7684\u5173\u952E\u5728\u4E8E\uFF1A\u901A\u8FC7\u7535\u8BDD\u6216\u5176\u4ED6\u8BED\u97F3\u901A\u4FE1\u65B9\u5F0F\u64CD\u7EB5\u7528\u6237\uFF0C\u8BF1\u4F7F\u5176\u63D0\u4F9B\u7CFB\u7EDF\u8BBF\u95EE\u6743\u9650\u3002\u6B64\u7C7B\u653B\u51FB\u5E38\u91C7\u7528\u793E\u4F1A\u5DE5\u7A0B\u5B66\u6280\u672F\uFF0C\u4F8B\u5982\u4F2A\u88C5\u6210\u53EF\u4FE1\u6765\u6E90\uFF08\u5982\uFF1A\u8EAB\u4EFD\u5192\u5145\uFF09\u548C\/\u6216\u5236\u9020\u7D27\u8FEB\u611F\u6216\u6050\u614C\u60C5\u7EEA\u4EE5\u4FC3\u4F7F\u63A5\u6536\u8005\u91C7\u53D6\u884C\u52A8\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1566\/004\/"},{"id":"T1566","name":"\u7F51\u7EDC\u9493\u9C7C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u53D1\u9001\u9493\u9C7C\u4FE1\u606F\u6765\u83B7\u53D6\u5BF9\u53D7\u5BB3\u8005\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u3002\u6240\u6709\u5F62\u5F0F\u7684\u9493\u9C7C\u653B\u51FB\u90FD\u5C5E\u4E8E\u7535\u5B50\u65B9\u5F0F\u4F20\u9012\u7684\u793E\u4F1A\u5DE5\u7A0B\u5B66\u624B\u6BB5\u3002\u9493\u9C7C\u653B\u51FB\u53EF\u4EE5\u662F\u6709\u9488\u5BF9\u6027\u7684\uFF0C\u5373\u6240\u8C13\u7684\u9C7C\u53C9\u5F0F\u9493\u9C7C\u3002\u5728\u9C7C\u53C9\u5F0F\u9493\u9C7C\u4E2D\uFF0C\u653B\u51FB\u8005\u4F1A\u9488\u5BF9\u7279\u5B9A\u7684\u4E2A\u4EBA\u3001\u516C\u53F8\u6216\u884C\u4E1A\u53D1\u8D77\u653B\u51FB\u3002\u66F4\u666E\u904D\u7684\u60C5\u51B5\u662F\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8FDB\u884C\u975E\u9488\u5BF9\u6027\u7684\u9493\u9C7C\u6D3B\u52A8\uFF0C\u4F8B\u5982\u5927\u89C4\u6A21\u6076\u610F\u8F6F\u4EF6\u5783\u573E\u90AE\u4EF6\u6D3B\u52A8\u3002","sub-techniques":"T1566.001, T1566.002, T1566.003, T1566.004","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1566\/"},{"id":"T1567.001","name":"\u4EE3\u7801\u4ED3\u5E93\u6E17\u900F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u6570\u636E\u5916\u6CC4\u81F3\u4EE3\u7801\u4ED3\u5E93\uFF0C\u800C\u975E\u901A\u8FC7\u5176\u4E3B\u8981\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u4EE3\u7801\u4ED3\u5E93\u901A\u5E38\u53EF\u901A\u8FC7API\uFF08\u4F8B\u5982\uFF1Ahttps:\/\/api.github.com\uFF09\u8BBF\u95EE\u3002\u5BF9\u8FD9\u4E9BAPI\u7684\u8BBF\u95EE\u901A\u5E38\u57FA\u4E8EHTTPS\u534F\u8BAE\uFF0C\u8FD9\u4E3A\u653B\u51FB\u8005\u63D0\u4F9B\u4E86\u989D\u5916\u7684\u4FDD\u62A4\u5C42\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1567\/001\/"},{"id":"T1567.002","name":"\u5916\u6CC4\u81F3\u4E91\u5B58\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6570\u636E\u5916\u6CC4\u81F3\u4E91\u5B58\u50A8\u670D\u52A1\uFF0C\u800C\u975E\u901A\u8FC7\u5176\u4E3B\u8981\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u4E91\u5B58\u50A8\u670D\u52A1\u5141\u8BB8\u901A\u8FC7\u4E92\u8054\u7F51\u5728\u8FDC\u7A0B\u4E91\u5B58\u50A8\u670D\u52A1\u5668\u4E0A\u5B58\u50A8\u3001\u7F16\u8F91\u548C\u68C0\u7D22\u6570\u636E\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1567\/002\/"},{"id":"T1567.003","name":"\u5916\u6CC4\u81F3\u6587\u672C\u5B58\u50A8\u7AD9\u70B9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u6570\u636E\u5916\u6CC4\u81F3\u6587\u672C\u5B58\u50A8\u7F51\u7AD9\uFF0C\u800C\u975E\u901A\u8FC7\u5176\u4E3B\u8981\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u6587\u672C\u5B58\u50A8\u7F51\u7AD9\uFF0C\u5982pastebin[.]com\uFF0C\u901A\u5E38\u88AB\u5F00\u53D1\u8005\u7528\u4E8E\u5171\u4EAB\u4EE3\u7801\u53CA\u5176\u4ED6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1567\/003\/"},{"id":"T1567.004","name":"\u901A\u8FC7Webhook\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u6570\u636E\u5916\u6CC4\u81F3Webhook\u7AEF\u70B9\uFF0C\u800C\u975E\u901A\u8FC7\u5176\u4E3B\u8981\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002Webhook\u662F\u4E00\u79CD\u7B80\u5355\u673A\u5236\uFF0C\u5141\u8BB8\u670D\u52A1\u5668\u901A\u8FC7HTTP\/S\u5411\u5BA2\u6237\u7AEF\u63A8\u9001\u6570\u636E\uFF0C\u65E0\u9700\u5BA2\u6237\u7AEF\u6301\u7EED\u8F6E\u8BE2\u670D\u52A1\u5668\u3002\u8BB8\u591A\u516C\u5171\u53CA\u5546\u4E1A\u670D\u52A1\uFF08\u5982Discord\u3001Slack\u548Cwebhook.site\uFF09\u652F\u6301\u521B\u5EFAWebhook\u7AEF\u70B9\uFF0C\u53EF\u4F9B\u5176\u4ED6\u670D\u52A1\uFF08\u5982GitHub\u3001Jira\u6216Trello\uFF09\u4F7F\u7528\u3002\u5F53\u5173\u8054\u670D\u52A1\u53D1\u751F\u53D8\u66F4\uFF08\u4F8B\u5982\u63A8\u9001\u4ED3\u5E93\u66F4\u65B0\u6216\u4FEE\u6539\u5DE5\u5355\uFF09\u65F6\uFF0C\u8FD9\u4E9B\u670D\u52A1\u4F1A\u81EA\u52A8\u5C06\u6570\u636E\u53D1\u5E03\u81F3Webhook\u7AEF\u70B9\uFF0C\u4F9B\u6D88\u8D39\u5E94\u7528\u7A0B\u5E8F\u4F7F\u7528\u3002","sub-techniques":"","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1567\/004\/"},{"id":"T1567","name":"\u901A\u8FC7Web\u670D\u52A1\u8FDB\u884C\u6570\u636E\u5916\u6CC4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5229\u7528\u73B0\u6709\u7684\u5408\u6CD5\u5916\u90E8\u7F51\u7EDC\u670D\u52A1\u6765\u5916\u6CC4\u6570\u636E\uFF0C\u800C\u975E\u4F9D\u8D56\u5176\u4E3B\u8981\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u3002\u7531\u4E8E\u7F51\u7EDC\u5185\u7684\u4E3B\u673A\u5728\u906D\u53D7\u5165\u4FB5\u524D\u5F88\u53EF\u80FD\u5DF2\u4E0E\u8FD9\u4E9B\u6D41\u884C\u7F51\u7EDC\u670D\u52A1\u8FDB\u884C\u901A\u4FE1\uFF0C\u5C06\u5176\u7528\u4F5C\u6570\u636E\u5916\u6CC4\u673A\u5236\u53EF\u63D0\u4F9B\u76F8\u5F53\u7A0B\u5EA6\u7684\u9690\u853D\u6027\u3002\u6B64\u5916\uFF0C\u9632\u706B\u5899\u89C4\u5219\u53EF\u80FD\u5DF2\u9884\u5148\u5141\u8BB8\u6D41\u5411\u8FD9\u4E9B\u670D\u52A1\u7684\u6D41\u91CF\uFF0C\u4ECE\u800C\u8FDB\u4E00\u6B65\u964D\u4F4E\u4E86\u88AB\u68C0\u6D4B\u7684\u98CE\u9669\u3002","sub-techniques":"T1567.001, T1567.002, T1567.003, T1567.004","tactic":"\u6570\u636E\u5916\u6CC4","platforms":"ESXi,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1567\/"},{"id":"T1568.001","name":"\u5FEB\u901F\u901A\u91CFDNS","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u5FEB\u901F\u901A\u91CFDNS\u6280\u672F\uFF0C\u5C06\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\u9690\u85CF\u5728\u4E00\u7CFB\u5217\u4E0E\u5355\u4E00\u57DF\u540D\u89E3\u6790\u76F8\u5173\u8054\u3001\u5FEB\u901F\u66F4\u8FED\u7684IP\u5730\u5740\u80CC\u540E\u3002\u8BE5\u6280\u672F\u901A\u8FC7\u4E3A\u5B8C\u5168\u9650\u5B9A\u57DF\u540D\u5206\u914D\u591A\u4E2AIP\u5730\u5740\uFF0C\u5E76\u91C7\u7528\u8F6E\u8BE2IP\u5730\u5740\u5206\u914D\u4E0EDNS\u8D44\u6E90\u8BB0\u5F55\u77ED\u751F\u5B58\u65F6\u95F4\uFF08TTL\uFF09\u76F8\u7ED3\u5408\u7684\u65B9\u5F0F\uFF0C\u5B9E\u73B0\u8FD9\u4E9BIP\u5730\u5740\u7684\u9AD8\u9891\u5207\u6362\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1568\/001\/"},{"id":"T1568.002","name":"\u57DF\u540D\u751F\u6210\u7B97\u6CD5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u57DF\u540D\u751F\u6210\u7B97\u6CD5\uFF08DGAs\uFF09\u52A8\u6001\u786E\u5B9A\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\u7684\u76EE\u6807\u57DF\u540D\uFF0C\u800C\u975E\u4F9D\u8D56\u9759\u6001IP\u5730\u5740\u6216\u57DF\u540D\u5217\u8868\u3002\u8FD9\u79CD\u505A\u6CD5\u5177\u6709\u663E\u8457\u4F18\u52BF\uFF0C\u4F7F\u5F97\u9632\u5FA1\u8005\u66F4\u96BE\u963B\u65AD\u3001\u8FFD\u8E2A\u6216\u63A5\u7BA1\u547D\u4EE4\u4E0E\u63A7\u5236\u901A\u9053\uFF0C\u56E0\u4E3A\u6076\u610F\u8F6F\u4EF6\u53EF\u80FD\u68C0\u67E5\u6210\u5343\u4E0A\u4E07\u4E2A\u57DF\u540D\u4EE5\u83B7\u53D6\u6307\u4EE4\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1568\/002\/"},{"id":"T1568.003","name":"DNS \u8BA1\u7B97","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5BF9DNS\u67E5\u8BE2\u7ED3\u679C\u4E2D\u8FD4\u56DE\u7684\u5730\u5740\u8FDB\u884C\u8BA1\u7B97\uFF0C\u4EE5\u786E\u5B9A\u7528\u4E8E\u547D\u4EE4\u4E0E\u63A7\u5236\u7684\u7AEF\u53E3\u548CIP\u5730\u5740\uFF0C\u800C\u975E\u4F9D\u8D56\u9884\u8BBE\u7684\u7AEF\u53E3\u53F7\u6216\u5B9E\u9645\u8FD4\u56DE\u7684IP\u5730\u5740\u3002\u901A\u8FC7\u8BA1\u7B97IP\u5730\u5740\u548C\/\u6216\u7AEF\u53E3\u53F7\uFF0C\u53EF\u4EE5\u7ED5\u8FC7\u5BF9C2\u901A\u9053\u7684\u51FA\u53E3\u8FC7\u6EE4\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1568\/003\/"},{"id":"T1568","name":"\u52A8\u6001\u5206\u8FA8\u7387","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u52A8\u6001\u5EFA\u7ACB\u4E0E\u6307\u6325\u63A7\u5236\u57FA\u7840\u8BBE\u65BD\u7684\u8FDE\u63A5\uFF0C\u4EE5\u89C4\u907F\u5E38\u89C1\u7684\u68C0\u6D4B\u548C\u4FEE\u590D\u63AA\u65BD\u3002\u8FD9\u53EF\u4EE5\u901A\u8FC7\u4F7F\u7528\u4E0E\u5BF9\u624B\u63A5\u6536\u6076\u610F\u8F6F\u4EF6\u901A\u4FE1\u7684\u57FA\u7840\u8BBE\u65BD\u5171\u4EAB\u901A\u7528\u7B97\u6CD5\u7684\u6076\u610F\u8F6F\u4EF6\u6765\u5B9E\u73B0\u3002\u8FD9\u4E9B\u8BA1\u7B97\u53EF\u7528\u4E8E\u52A8\u6001\u8C03\u6574\u6076\u610F\u8F6F\u4EF6\u7528\u4E8E\u6307\u6325\u63A7\u5236\u7684\u53C2\u6570\uFF0C\u5982\u57DF\u540D\u3001IP\u5730\u5740\u6216\u7AEF\u53E3\u53F7\u3002","sub-techniques":"T1568.001, T1568.002, T1568.003","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1568\/"},{"id":"T1569.001","name":"\u542F\u52A8\u63A7\u5236","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528launchctl\u6765\u6267\u884C\u547D\u4EE4\u6216\u7A0B\u5E8F\u3002Launchctl\u4E0EmacOS\u7684\u670D\u52A1\u7BA1\u7406\u6846\u67B6launchd\u4EA4\u4E92\u3002Launchctl\u652F\u6301\u5728\u547D\u4EE4\u884C\u3001\u4EA4\u4E92\u5F0F\u754C\u9762\uFF0C\u751A\u81F3\u4ECE\u6807\u51C6\u8F93\u5165\u91CD\u5B9A\u5411\u63A5\u6536\u5B50\u547D\u4EE4\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1569\/001\/"},{"id":"T1569.002","name":"\u670D\u52A1\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528Windows\u670D\u52A1\u63A7\u5236\u7BA1\u7406\u5668\u6765\u6267\u884C\u6076\u610F\u547D\u4EE4\u6216\u8F7D\u8377\u3002Windows\u670D\u52A1\u63A7\u5236\u7BA1\u7406\u5668\uFF08services.exe\uFF09\u662F\u7BA1\u7406\u548C\u64CD\u4F5C\u670D\u52A1\u7684\u63A5\u53E3\u3002\u7528\u6237\u53EF\u901A\u8FC7\u56FE\u5F62\u7528\u6237\u754C\u9762\u7EC4\u4EF6\u4EE5\u53CA\u7CFB\u7EDF\u5DE5\u5177\uFF08\u5982sc.exe\u548CNet\uFF09\u8BBF\u95EE\u670D\u52A1\u63A7\u5236\u7BA1\u7406\u5668\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1569\/002\/"},{"id":"T1569.003","name":"Systemctl","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528systemctl\u6765\u6267\u884C\u547D\u4EE4\u6216\u7A0B\u5E8F\u3002Systemctl\u662Fsystemd\u7684\u4E3B\u8981\u63A5\u53E3\uFF0Csystemd\u662FLinux\u7684\u521D\u59CB\u5316\u7CFB\u7EDF\u548C\u670D\u52A1\u7BA1\u7406\u5668\u3002\u901A\u5E38\u4ECEshell\u8C03\u7528\uFF0CSystemctl\u4E5F\u53EF\u4EE5\u96C6\u6210\u5230\u811A\u672C\u6216\u5E94\u7528\u7A0B\u5E8F\u4E2D\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux","permalink":"https:\/\/attack.mitre.org\/techniques\/T1569\/003\/"},{"id":"T1569","name":"\u7CFB\u7EDF\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u7CFB\u7EDF\u670D\u52A1\u6216\u5B88\u62A4\u8FDB\u7A0B\u6765\u6267\u884C\u547D\u4EE4\u6216\u7A0B\u5E8F\u3002\u4ED6\u4EEC\u53EF\u4EE5\u901A\u8FC7\u672C\u5730\u6216\u8FDC\u7A0B\u4E0E\u670D\u52A1\u4EA4\u4E92\u6216\u521B\u5EFA\u670D\u52A1\u6765\u6267\u884C\u6076\u610F\u5185\u5BB9\u3002\u8BB8\u591A\u670D\u52A1\u88AB\u8BBE\u7F6E\u4E3A\u5728\u542F\u52A8\u65F6\u8FD0\u884C\uFF0C\u8FD9\u6709\u52A9\u4E8E\u5B9E\u73B0\u6301\u4E45\u6027\uFF08\u521B\u5EFA\u6216\u4FEE\u6539\u7CFB\u7EDF\u8FDB\u7A0B\uFF09\uFF0C\u4F46\u653B\u51FB\u8005\u4E5F\u53EF\u80FD\u6EE5\u7528\u670D\u52A1\u8FDB\u884C\u4E00\u6B21\u6027\u6216\u4E34\u65F6\u6267\u884C\u3002","sub-techniques":"T1569.001, T1569.002, T1569.003","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1569\/"},{"id":"T1570","name":"\u6A2A\u5411\u5DE5\u5177\u8F6C\u79FB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u53D7\u611F\u67D3\u73AF\u5883\u4E2D\u7684\u7CFB\u7EDF\u4E4B\u95F4\u4F20\u8F93\u5DE5\u5177\u6216\u5176\u4ED6\u6587\u4EF6\u3002\u4E00\u65E6\u8FD9\u4E9B\u6587\u4EF6\u88AB\u5E26\u5165\u53D7\u5BB3\u73AF\u5883\uFF08\u5373\u5165\u53E3\u5DE5\u5177\u4F20\u8F93\uFF09\uFF0C\u5728\u64CD\u4F5C\u8FC7\u7A0B\u4E2D\uFF0C\u5B83\u4EEC\u53EF\u80FD\u4F1A\u4ECE\u4E00\u4E2A\u7CFB\u7EDF\u590D\u5236\u5230\u53E6\u4E00\u4E2A\u7CFB\u7EDF\uFF0C\u4EE5\u4FBF\u4E3A\u653B\u51FB\u8005\u7684\u5DE5\u5177\u6216\u5176\u4ED6\u6587\u4EF6\u8FDB\u884C\u90E8\u7F72\u51C6\u5907\u3002","sub-techniques":"","tactic":"\u6A2A\u5411\u79FB\u52A8","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1570\/"},{"id":"T1571","name":"\u975E\u6807\u51C6\u7AEF\u53E3","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u901A\u5E38\u4E0D\u5173\u8054\u7684\u534F\u8BAE\u548C\u7AEF\u53E3\u914D\u5BF9\u8FDB\u884C\u901A\u4FE1\u3002\u4F8B\u5982\uFF0C\u901A\u8FC78088\u7AEF\u53E3\u6216587\u7AEF\u53E3\u8FDB\u884CHTTPS\u901A\u4FE1\uFF0C\u800C\u975E\u4F20\u7EDF\u7684443\u7AEF\u53E3\u3002\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u66F4\u6539\u534F\u8BAE\u4F7F\u7528\u7684\u6807\u51C6\u7AEF\u53E3\uFF0C\u4EE5\u7ED5\u8FC7\u8FC7\u6EE4\u6216\u6DF7\u6DC6\u7F51\u7EDC\u6570\u636E\u7684\u5206\u6790\/\u89E3\u6790\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1571\/"},{"id":"T1572","name":"\u534F\u8BAE\u96A7\u9053","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u7F51\u7EDC\u901A\u4FE1\u5C01\u88C5\u5728\u53E6\u4E00\u4E2A\u534F\u8BAE\u4E2D\uFF0C\u5728\u53D7\u5BB3\u7CFB\u7EDF\u4E4B\u95F4\u5EFA\u7ACB\u96A7\u9053\uFF0C\u4EE5\u89C4\u907F\u68C0\u6D4B\u548C\u7F51\u7EDC\u8FC7\u6EE4\uFF0C\u6216\u5B9E\u73B0\u5BF9\u539F\u672C\u65E0\u6CD5\u8BBF\u95EE\u7CFB\u7EDF\u7684\u8FDE\u63A5\u3002\u96A7\u9053\u6280\u672F\u6D89\u53CA\u5C06\u4E00\u4E2A\u534F\u8BAE\u660E\u786E\u5C01\u88C5\u5728\u53E6\u4E00\u4E2A\u534F\u8BAE\u5185\u90E8\u3002\u8FD9\u79CD\u884C\u4E3A\u53EF\u80FD\u901A\u8FC7\u6DF7\u5165\u73B0\u6709\u6D41\u91CF\u6765\u9690\u85CF\u6076\u610F\u6D41\u91CF\uFF0C\u548C\/\u6216\u63D0\u4F9B\u5916\u5C42\u52A0\u5BC6\uFF08\u7C7B\u4F3C\u4E8EVPN\uFF09\u3002\u96A7\u9053\u6280\u672F\u8FD8\u80FD\u5B9E\u73B0\u7F51\u7EDC\u6570\u636E\u5305\u7684\u7ED5\u884C\u4F20\u8F93\uFF0C\u4F8B\u5982SMB\u3001RDP\u6216\u5176\u4ED6\u53EF\u80FD\u88AB\u7F51\u7EDC\u8BBE\u5907\u8FC7\u6EE4\u6216\u65E0\u6CD5\u901A\u8FC7\u4E92\u8054\u7F51\u8DEF\u7531\u7684\u6D41\u91CF\uFF0C\u4F7F\u5176\u80FD\u591F\u5230\u8FBE\u539F\u672C\u65E0\u6CD5\u62B5\u8FBE\u7684\u76EE\u7684\u5730\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1572\/"},{"id":"T1573.001","name":"\u5BF9\u79F0\u52A0\u5BC6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u91C7\u7528\u5DF2\u77E5\u7684\u5BF9\u79F0\u52A0\u5BC6\u7B97\u6CD5\u6765\u9690\u85CF\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\uFF0C\u800C\u975E\u4F9D\u8D56\u901A\u4FE1\u534F\u8BAE\u63D0\u4F9B\u7684\u56FA\u6709\u4FDD\u62A4\u3002\u5BF9\u79F0\u52A0\u5BC6\u7B97\u6CD5\u4F7F\u7528\u76F8\u540C\u7684\u5BC6\u94A5\u8FDB\u884C\u660E\u6587\u52A0\u5BC6\u548C\u5BC6\u6587\u89E3\u5BC6\u3002\u5E38\u89C1\u7684\u5BF9\u79F0\u52A0\u5BC6\u7B97\u6CD5\u5305\u62ECAES\u3001DES\u30013DES\u3001Blowfish\u548CRC4\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1573\/001\/"},{"id":"T1573.002","name":"\u975E\u5BF9\u79F0\u52A0\u5BC6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u91C7\u7528\u5DF2\u77E5\u7684\u975E\u5BF9\u79F0\u52A0\u5BC6\u7B97\u6CD5\u6765\u9690\u85CF\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\uFF0C\u800C\u4E0D\u662F\u4F9D\u8D56\u901A\u4FE1\u534F\u8BAE\u63D0\u4F9B\u7684\u4EFB\u4F55\u56FA\u6709\u4FDD\u62A4\u3002\u975E\u5BF9\u79F0\u52A0\u5BC6\uFF0C\u4E5F\u79F0\u4E3A\u516C\u94A5\u52A0\u5BC6\uFF0C\u4E3A\u6BCF\u4E2A\u53C2\u4E0E\u65B9\u4F7F\u7528\u4E00\u5BF9\u5BC6\u94A5\uFF1A\u4E00\u4E2A\u53EF\u4EE5\u81EA\u7531\u5206\u53D1\u7684\u516C\u94A5\u548C\u4E00\u4E2A\u79C1\u94A5\u3002\u6839\u636E\u5BC6\u94A5\u751F\u6210\u7684\u65B9\u5F0F\uFF0C\u53D1\u9001\u65B9\u4F7F\u7528\u63A5\u6536\u65B9\u7684\u516C\u94A5\u52A0\u5BC6\u6570\u636E\uFF0C\u63A5\u6536\u65B9\u5219\u4F7F\u7528\u81EA\u5DF1\u7684\u79C1\u94A5\u89E3\u5BC6\u6570\u636E\u3002\u8FD9\u786E\u4FDD\u4E86\u53EA\u6709\u9884\u671F\u7684\u63A5\u6536\u8005\u624D\u80FD\u8BFB\u53D6\u52A0\u5BC6\u6570\u636E\u3002\u5E38\u89C1\u7684\u516C\u94A5\u52A0\u5BC6\u7B97\u6CD5\u5305\u62ECRSA\u548CElGamal\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1573\/002\/"},{"id":"T1573","name":"\u52A0\u5BC6\u901A\u9053","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u52A0\u5BC6\u7B97\u6CD5\u6765\u9690\u85CF\u547D\u4EE4\u4E0E\u63A7\u5236\u6D41\u91CF\uFF0C\u800C\u975E\u4F9D\u8D56\u901A\u4FE1\u534F\u8BAE\u63D0\u4F9B\u7684\u56FA\u6709\u4FDD\u62A4\u3002\u5C3D\u7BA1\u4F7F\u7528\u4E86\u5B89\u5168\u7B97\u6CD5\uFF0C\u4F46\u5982\u679C\u5BC6\u94A5\u88AB\u7F16\u7801\u548C\/\u6216\u751F\u6210\u4E8E\u6076\u610F\u8F6F\u4EF6\u6837\u672C\u6216\u914D\u7F6E\u6587\u4EF6\u4E2D\uFF0C\u8FD9\u4E9B\u5B9E\u73B0\u4ECD\u53EF\u80FD\u9762\u4E34\u9006\u5411\u5DE5\u7A0B\u7684\u98CE\u9669\u3002","sub-techniques":"T1573.001, T1573.002","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1573\/"},{"id":"T1574.001","name":"\u52A8\u6001\u94FE\u63A5\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u52A8\u6001\u94FE\u63A5\u5E93\u6587\u4EF6\uFF08DLL\uFF09\u6765\u5B9E\u73B0\u6301\u4E45\u5316\u3001\u63D0\u5347\u6743\u9650\u548C\u89C4\u907F\u9632\u5FA1\u3002DLL\u662F\u5305\u542B\u53EF\u7531\u591A\u4E2A\u7A0B\u5E8F\u540C\u65F6\u4F7F\u7528\u7684\u4EE3\u7801\u548C\u6570\u636E\u7684\u5E93\u3002\u867D\u7136DLL\u672C\u8EAB\u5E76\u975E\u6076\u610F\uFF0C\u4F46\u53EF\u901A\u8FC7\u4FA7\u52A0\u8F7D\u3001\u52AB\u6301\u641C\u7D22\u987A\u5E8F\u548C\u5E7D\u7075DLL\u52AB\u6301\u7B49\u673A\u5236\u88AB\u6EE5\u7528\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/001\/"},{"id":"T1574.004","name":"\u52A8\u6001\u5E93\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5C06\u6076\u610F\u52A8\u6001\u5E93\uFF08dylib\uFF09\u4EE5\u9884\u671F\u540D\u79F0\u653E\u7F6E\u5728\u53D7\u5BB3\u5E94\u7528\u7A0B\u5E8F\u8FD0\u884C\u65F6\u641C\u7D22\u7684\u8DEF\u5F84\u4E2D\uFF0C\u6765\u6267\u884C\u5176\u81EA\u8EAB\u7684\u6076\u610F\u8D1F\u8F7D\u3002\u52A8\u6001\u52A0\u8F7D\u5668\u4F1A\u6839\u636E\u641C\u7D22\u8DEF\u5F84\u7684\u987A\u5E8F\u5C1D\u8BD5\u67E5\u627E\u8FD9\u4E9B\u52A8\u6001\u5E93\u3002\u52A8\u6001\u5E93\u7684\u8DEF\u5F84\u53EF\u80FD\u4EE5@rpath\u4E3A\u524D\u7F00\uFF0C\u8FD9\u5141\u8BB8\u5F00\u53D1\u8005\u4F7F\u7528\u76F8\u5BF9\u8DEF\u5F84\u6765\u6307\u5B9A\u57FA\u4E8E\u53EF\u6267\u884C\u6587\u4EF6\u4F4D\u7F6E\u5728\u8FD0\u884C\u65F6\u4F7F\u7528\u7684\u4E00\u7CFB\u5217\u641C\u7D22\u8DEF\u5F84\u3002\u6B64\u5916\uFF0C\u5982\u679C\u4F7F\u7528\u4E86\u5F31\u94FE\u63A5\uFF0C\u4F8B\u5982LC_LOAD_WEAK_DYLIB\u529F\u80FD\uFF0C\u5373\u4F7F\u9884\u671F\u7684\u52A8\u6001\u5E93\u4E0D\u5B58\u5728\uFF0C\u5E94\u7528\u7A0B\u5E8F\u4ECD\u4F1A\u7EE7\u7EED\u6267\u884C\u3002\u5F31\u94FE\u63A5\u4F7F\u5F00\u53D1\u8005\u80FD\u591F\u5728\u591A\u4E2AmacOS\u7248\u672C\u4E0A\u8FD0\u884C\u5E94\u7528\u7A0B\u5E8F\uFF0C\u4EE5\u9002\u5E94\u65B0API\u7684\u6DFB\u52A0\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/004\/"},{"id":"T1574.005","name":"\u53EF\u6267\u884C\u5B89\u88C5\u7A0B\u5E8F\u6587\u4EF6\u6743\u9650\u5F31\u70B9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u5B89\u88C5\u7A0B\u5E8F\u6240\u4F7F\u7528\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u8FD9\u4E9B\u8FDB\u7A0B\u53EF\u80FD\u4F1A\u81EA\u52A8\u6267\u884C\u7279\u5B9A\u4E8C\u8FDB\u5236\u6587\u4EF6\u4F5C\u4E3A\u5176\u529F\u80FD\u7684\u4E00\u90E8\u5206\u6216\u6267\u884C\u5176\u4ED6\u64CD\u4F5C\u3002\u5982\u679C\u5305\u542B\u76EE\u6807\u4E8C\u8FDB\u5236\u6587\u4EF6\u7684\u6587\u4EF6\u7CFB\u7EDF\u76EE\u5F55\u6743\u9650\u8BBE\u7F6E\u4E0D\u5F53\uFF0C\u6216\u8005\u4E8C\u8FDB\u5236\u6587\u4EF6\u672C\u8EAB\u7684\u6743\u9650\u8BBE\u7F6E\u4E0D\u5F53\uFF0C\u5219\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7528\u6237\u7EA7\u6743\u9650\u8986\u76D6\u76EE\u6807\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF0C\u5E76\u7531\u539F\u59CB\u8FDB\u7A0B\u6267\u884C\u3002\u5982\u679C\u539F\u59CB\u8FDB\u7A0B\u548C\u7EBF\u7A0B\u5728\u66F4\u9AD8\u6743\u9650\u7EA7\u522B\u4E0B\u8FD0\u884C\uFF0C\u90A3\u4E48\u88AB\u66FF\u6362\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E5F\u5C06\u5728\u66F4\u9AD8\u6743\u9650\u7EA7\u522B\uFF08\u53EF\u80FD\u5305\u62ECSYSTEM\u6743\u9650\uFF09\u4E0B\u6267\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/005\/"},{"id":"T1574.006","name":"\u52A8\u6001\u94FE\u63A5\u5668\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u52A8\u6001\u94FE\u63A5\u5668\u7528\u4E8E\u52A0\u8F7D\u5171\u4EAB\u5E93\u7684\u73AF\u5883\u53D8\u91CF\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u5728\u7A0B\u5E8F\u7684\u6267\u884C\u51C6\u5907\u9636\u6BB5\uFF0C\u52A8\u6001\u94FE\u63A5\u5668\u4F1A\u4ECE\u5404\u79CD\u73AF\u5883\u53D8\u91CF\u548C\u6587\u4EF6\uFF08\u5982Linux\u4E0A\u7684LD_PRELOAD\u6216macOS\u4E0A\u7684DYLD_INSERT_LIBRARIES\uFF09\u4E2D\u52A0\u8F7D\u6307\u5B9A\u7684\u5171\u4EAB\u5E93\u7EDD\u5BF9\u8DEF\u5F84\u3002\u73AF\u5883\u53D8\u91CF\u4E2D\u6307\u5B9A\u7684\u5E93\u4F1A\u4F18\u5148\u52A0\u8F7D\uFF0C\u8986\u76D6\u5177\u6709\u76F8\u540C\u51FD\u6570\u540D\u7684\u7CFB\u7EDF\u5E93\u3002\u6BCF\u4E2A\u5E73\u53F0\u7684\u94FE\u63A5\u5668\u5728\u6267\u884C\u7684\u4E0D\u540C\u9636\u6BB5\u4F7F\u7528\u4E00\u7CFB\u5217\u5E7F\u6CDB\u7684\u73AF\u5883\u53D8\u91CF\u3002\u8FD9\u4E9B\u53D8\u91CF\u901A\u5E38\u88AB\u5F00\u53D1\u8005\u7528\u4E8E\u8C03\u8BD5\u4E8C\u8FDB\u5236\u6587\u4EF6\u800C\u65E0\u9700\u91CD\u65B0\u7F16\u8BD1\u3001\u89E3\u51B3\u6620\u5C04\u7B26\u53F7\u51B2\u7A81\u4EE5\u53CA\u5728\u539F\u59CB\u5E93\u4E2D\u5B9E\u73B0\u81EA\u5B9A\u4E49\u529F\u80FD\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/006\/"},{"id":"T1574.007","name":"\u8DEF\u5F84\u62E6\u622A\u901A\u8FC7PATH\u73AF\u5883\u53D8\u91CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u7528\u4E8E\u52A0\u8F7D\u5E93\u7684\u73AF\u5883\u53D8\u91CF\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002PATH\u73AF\u5883\u53D8\u91CF\u5305\u542B\u4E00\u7CFB\u5217\u76EE\u5F55\uFF08\u7528\u6237\u548C\u7CFB\u7EDF\u76EE\u5F55\uFF09\uFF0C\u64CD\u4F5C\u7CFB\u7EDF\u4F1A\u6309\u987A\u5E8F\u5728\u8FD9\u4E9B\u76EE\u5F55\u4E2D\u641C\u7D22\u4ECE\u811A\u672C\u6216\u547D\u4EE4\u884C\u8C03\u7528\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/007\/"},{"id":"T1574.008","name":"\u8DEF\u5F84\u62E6\u622A\u901A\u8FC7\u641C\u7D22\u987A\u5E8F\u52AB\u6301","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u7528\u4E8E\u52A0\u8F7D\u5176\u4ED6\u7A0B\u5E8F\u7684\u641C\u7D22\u987A\u5E8F\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u7531\u4E8E\u67D0\u4E9B\u7A0B\u5E8F\u5728\u8C03\u7528\u5176\u4ED6\u7A0B\u5E8F\u65F6\u672A\u4F7F\u7528\u5B8C\u6574\u8DEF\u5F84\uFF0C\u653B\u51FB\u8005\u53EF\u4EE5\u5C06\u81EA\u5DF1\u7684\u6587\u4EF6\u653E\u7F6E\u5728\u8C03\u7528\u7A0B\u5E8F\u6240\u5728\u7684\u76EE\u5F55\u4E2D\uFF0C\u5BFC\u81F4\u64CD\u4F5C\u7CFB\u7EDF\u5E94\u8C03\u7528\u7A0B\u5E8F\u7684\u8BF7\u6C42\u542F\u52A8\u5176\u6076\u610F\u8F6F\u4EF6\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/008\/"},{"id":"T1574.009","name":"\u8DEF\u5F84\u62E6\u622A\uFF08\u672A\u52A0\u5F15\u53F7\u7684\u8DEF\u5F84\uFF09","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u6613\u53D7\u653B\u51FB\u7684\u6587\u4EF6\u8DEF\u5F84\u5F15\u7528\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5229\u7528\u90A3\u4E9B\u672A\u7528\u5F15\u53F7\u62EC\u8D77\u6765\u7684\u8DEF\u5F84\uFF0C\u901A\u8FC7\u5728\u8DEF\u5F84\u7684\u66F4\u9AD8\u5C42\u7EA7\u76EE\u5F55\u4E2D\u653E\u7F6E\u53EF\u6267\u884C\u6587\u4EF6\uFF0C\u4F7F\u5F97Windows\u7CFB\u7EDF\u9009\u62E9\u542F\u52A8\u653B\u51FB\u8005\u7684\u53EF\u6267\u884C\u7A0B\u5E8F\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/009\/"},{"id":"T1574.010","name":"\u670D\u52A1\u6587\u4EF6\u6743\u9650\u5F31\u70B9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u670D\u52A1\u6240\u4F7F\u7528\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u4ED6\u4EEC\u53EF\u80FD\u5229\u7528Windows\u670D\u52A1\u6743\u9650\u4E2D\u7684\u6F0F\u6D1E\uFF0C\u66FF\u6362\u670D\u52A1\u542F\u52A8\u65F6\u6267\u884C\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u3002\u8FD9\u4E9B\u670D\u52A1\u8FDB\u7A0B\u53EF\u80FD\u4F1A\u81EA\u52A8\u6267\u884C\u7279\u5B9A\u4E8C\u8FDB\u5236\u6587\u4EF6\u4F5C\u4E3A\u5176\u529F\u80FD\u7684\u4E00\u90E8\u5206\u6216\u6267\u884C\u5176\u4ED6\u64CD\u4F5C\u3002\u5982\u679C\u5305\u542B\u76EE\u6807\u4E8C\u8FDB\u5236\u6587\u4EF6\u7684\u6587\u4EF6\u7CFB\u7EDF\u76EE\u5F55\u6743\u9650\u8BBE\u7F6E\u4E0D\u5F53\uFF0C\u6216\u8005\u4E8C\u8FDB\u5236\u6587\u4EF6\u672C\u8EAB\u7684\u6743\u9650\u914D\u7F6E\u6709\u8BEF\uFF0C\u90A3\u4E48\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7528\u6237\u7EA7\u6743\u9650\u8986\u76D6\u76EE\u6807\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF0C\u5E76\u7531\u539F\u59CB\u8FDB\u7A0B\u6267\u884C\u3002\u5982\u679C\u539F\u59CB\u8FDB\u7A0B\u548C\u7EBF\u7A0B\u4EE5\u66F4\u9AD8\u6743\u9650\u7EA7\u522B\u8FD0\u884C\uFF0C\u90A3\u4E48\u88AB\u66FF\u6362\u7684\u4E8C\u8FDB\u5236\u6587\u4EF6\u4E5F\u5C06\u5728\u66F4\u9AD8\u6743\u9650\u7EA7\u522B\uFF08\u53EF\u80FD\u5305\u62ECSYSTEM\u6743\u9650\uFF09\u4E0B\u6267\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/010\/"},{"id":"T1574.011","name":"\u670D\u52A1\u6CE8\u518C\u6743\u9650\u5F31\u70B9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u670D\u52A1\u4F7F\u7528\u7684\u6CE8\u518C\u8868\u9879\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u4E0E\u670D\u52A1\u76F8\u5173\u7684\u6CE8\u518C\u8868\u9879\u6743\u9650\u5B58\u5728\u7F3A\u9677\u65F6\uFF0C\u653B\u51FB\u8005\u53EF\u5C06\u539F\u672C\u6307\u5B9A\u7684\u53EF\u6267\u884C\u6587\u4EF6\u91CD\u5B9A\u5411\u81F3\u5176\u63A7\u5236\u7684\u7A0B\u5E8F\uFF0C\u4ECE\u800C\u5728\u670D\u52A1\u542F\u52A8\u65F6\u8FD0\u884C\u81EA\u8EAB\u4EE3\u7801\u3002Windows\u7CFB\u7EDF\u5C06\u672C\u5730\u670D\u52A1\u914D\u7F6E\u4FE1\u606F\u5B58\u50A8\u5728\u6CE8\u518C\u8868\u8DEF\u5F84HKLM\\SYSTEM\\CurrentControlSet\\Services\u4E0B\u3002\u901A\u8FC7\u670D\u52A1\u63A7\u5236\u5668\uFF08sc.exe\uFF09\u3001PowerShell\u6216\u6CE8\u518C\u8868\u7F16\u8F91\u5668\u7B49\u5DE5\u5177\uFF0C\u53EF\u7BE1\u6539\u670D\u52A1\u6CE8\u518C\u8868\u9879\u4E2D\u5B58\u50A8\u7684\u4FE1\u606F\u4EE5\u4FEE\u6539\u670D\u52A1\u7684\u6267\u884C\u53C2\u6570\u3002\u6CE8\u518C\u8868\u9879\u7684\u8BBF\u95EE\u6743\u9650\u7531\u8BBF\u95EE\u63A7\u5236\u5217\u8868\u548C\u7528\u6237\u6743\u9650\u8FDB\u884C\u7BA1\u63A7\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/011\/"},{"id":"T1574.012","name":"COR_PROFILER","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528COR_PROFILER\u73AF\u5883\u53D8\u91CF\u52AB\u6301\u52A0\u8F7D.NET CLR\u7A0B\u5E8F\u7684\u6267\u884C\u6D41\u7A0B\u3002COR_PROFILER\u662F.NET\u6846\u67B6\u7684\u4E00\u9879\u529F\u80FD\uFF0C\u5141\u8BB8\u5F00\u53D1\u8005\u6307\u5B9A\u4E00\u4E2A\u975E\u6258\u7BA1\uFF08\u6216.NET\u5916\u90E8\uFF09\u7684\u6027\u80FD\u5206\u6790DLL\uFF0C\u8BE5DLL\u4F1A\u88AB\u52A0\u8F7D\u5230\u6BCF\u4E2A\u52A0\u8F7D\u516C\u5171\u8BED\u8A00\u8FD0\u884C\u65F6\uFF08CLR\uFF09\u7684.NET\u8FDB\u7A0B\u4E2D\u3002\u8FD9\u4E9B\u6027\u80FD\u5206\u6790\u5668\u65E8\u5728\u76D1\u89C6\u3001\u6392\u67E5\u548C\u8C03\u8BD5\u7531.NET CLR\u6267\u884C\u7684\u6258\u7BA1\u4EE3\u7801\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/012\/"},{"id":"T1574.013","name":"\u5185\u6838\u56DE\u8C03\u8868","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u8FDB\u7A0B\u7684KernelCallbackTable\u6765\u52AB\u6301\u5176\u6267\u884C\u6D41\u7A0B\uFF0C\u4EE5\u8FD0\u884C\u81EA\u8EAB\u7684\u6076\u610F\u8D1F\u8F7D\u3002KernelCallbackTable\u4F4D\u4E8E\u8FDB\u7A0B\u73AF\u5883\u5757\uFF08PEB\uFF09\u4E2D\uFF0C\u4E00\u65E6\u52A0\u8F7Duser32.dll\uFF0C\u5B83\u4F1A\u88AB\u521D\u59CB\u5316\u4E3A\u4E00\u4E2A\u53EF\u4F9B\u56FE\u5F62\u7528\u6237\u754C\u9762\u8FDB\u7A0B\u4F7F\u7528\u7684\u56FE\u5F62\u51FD\u6570\u6570\u7EC4\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/013\/"},{"id":"T1574.014","name":"\u5E94\u7528\u7A0B\u5E8F\u57DF\u7BA1\u7406\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301.NET AppDomainManager\u52A0\u8F7D\u7A0B\u5E8F\u96C6\u7684\u65B9\u5F0F\uFF0C\u6267\u884C\u5176\u81EA\u8EAB\u7684\u6076\u610F\u8D1F\u8F7D\u3002.NET\u6846\u67B6\u5229\u7528AppDomainManager\u7C7B\u5728\u8FDB\u7A0B\u5185\u521B\u5EFA\u5E76\u7BA1\u7406\u4E00\u4E2A\u6216\u591A\u4E2A\u9694\u79BB\u7684\u8FD0\u884C\u65F6\u73AF\u5883\uFF08\u79F0\u4E3A\u5E94\u7528\u7A0B\u5E8F\u57DF\uFF09\uFF0C\u4EE5\u6258\u7BA1.NET\u5E94\u7528\u7A0B\u5E8F\u7684\u6267\u884C\u3002\u7A0B\u5E8F\u96C6\uFF08\u7F16\u8BD1\u4E3A.NET\u4EE3\u7801\u8FD0\u884C\u7684.exe\u6216.dll\u4E8C\u8FDB\u5236\u6587\u4EF6\uFF09\u53EF\u4F5C\u4E3A\u53EF\u6267\u884C\u4EE3\u7801\u52A0\u8F7D\u5230\u5E94\u7528\u7A0B\u5E8F\u57DF\u4E2D\u3002","sub-techniques":"","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/014\/"},{"id":"T1574","name":"\u52AB\u6301\u6267\u884C\u6D41\u7A0B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u52AB\u6301\u64CD\u4F5C\u7CFB\u7EDF\u7684\u7A0B\u5E8F\u8FD0\u884C\u65B9\u5F0F\uFF0C\u6765\u6267\u884C\u5176\u6076\u610F\u8D1F\u8F7D\u3002\u52AB\u6301\u6267\u884C\u6D41\u7A0B\u53EF\u7528\u4E8E\u5B9E\u73B0\u6301\u4E45\u5316\uFF0C\u56E0\u4E3A\u8FD9\u79CD\u88AB\u52AB\u6301\u7684\u6267\u884C\u53EF\u80FD\u4F1A\u968F\u65F6\u95F4\u53CD\u590D\u53D1\u751F\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5229\u7528\u8FD9\u4E9B\u673A\u5236\u6765\u63D0\u5347\u6743\u9650\u6216\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\uFF0C\u4F8B\u5982\u5E94\u7528\u7A0B\u5E8F\u63A7\u5236\u6216\u5176\u4ED6\u6267\u884C\u9650\u5236\u3002","sub-techniques":"T1574.001, T1574.004, T1574.005, T1574.006, T1574.007, T1574.008, T1574.009, T1574.010, T1574.011, T1574.012, T1574.013, T1574.014","tactic":"\u575A\u6301,\u6743\u9650\u63D0\u5347,\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1574\/"},{"id":"T1578.001","name":"\u521B\u5EFA\u5FEB\u7167","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u4E91\u8D26\u6237\u5185\u521B\u5EFA\u5FEB\u7167\u6216\u6570\u636E\u5907\u4EFD\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u5FEB\u7167\u662F\u73B0\u6709\u4E91\u8BA1\u7B97\u7EC4\u4EF6\uFF08\u5982\u865A\u62DF\u673A\u3001\u865A\u62DF\u786C\u76D8\u6216\u5377\uFF09\u5728\u67D0\u4E00\u65F6\u95F4\u70B9\u7684\u526F\u672C\u3002\u4E0E\u201C\u6062\u590D\u4E91\u5B9E\u4F8B\u201D\u4E2D\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6062\u590D\u5FEB\u7167\u6765\u9003\u907F\u68C0\u6D4B\u5E76\u6D88\u9664\u5176\u5B58\u5728\u75D5\u8FF9\u4E0D\u540C\uFF0C\u6B64\u5904\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u6743\u9650\u521B\u5EFA\u5FEB\u7167\uFF0C\u4EE5\u7ED5\u8FC7\u963B\u6B62\u8BBF\u95EE\u73B0\u6709\u8BA1\u7B97\u670D\u52A1\u57FA\u7840\u8BBE\u65BD\u7684\u9650\u5236\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/001\/"},{"id":"T1578.002","name":"\u521B\u5EFA\u4E91\u5B9E\u4F8B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u4E91\u8D26\u6237\u7684\u8BA1\u7B97\u670D\u52A1\u4E2D\u521B\u5EFA\u65B0\u7684\u5B9E\u4F8B\u6216\u865A\u62DF\u673A\uFF08VM\uFF09\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u521B\u5EFA\u65B0\u5B9E\u4F8B\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u7ED5\u8FC7\u5F53\u524D\u8D26\u6237\u4E2D\u73B0\u6709\u5B9E\u4F8B\u4E0A\u7684\u9632\u706B\u5899\u89C4\u5219\u548C\u6743\u9650\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5BF9\u8D26\u6237\u4E2D\u7684\u4E00\u4E2A\u6216\u591A\u4E2A\u5377\u521B\u5EFA\u5FEB\u7167\uFF0C\u968F\u540E\u521B\u5EFA\u65B0\u5B9E\u4F8B\u3001\u6302\u8F7D\u8FD9\u4E9B\u5FEB\u7167\uFF0C\u5E76\u5E94\u7528\u9650\u5236\u8F83\u5C11\u7684\u5B89\u5168\u7B56\u7565\uFF0C\u4ECE\u800C\u4ECE\u672C\u5730\u7CFB\u7EDF\u6536\u96C6\u6570\u636E\u6216\u7528\u4E8E\u8FDC\u7A0B\u6570\u636E\u6682\u5B58\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/002\/"},{"id":"T1578.003","name":"\u5220\u9664\u4E91\u5B9E\u4F8B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u5B9E\u65BD\u6076\u610F\u6D3B\u52A8\u540E\u5220\u9664\u4E91\u5B9E\u4F8B\uFF0C\u4EE5\u8BD5\u56FE\u9003\u907F\u68C0\u6D4B\u5E76\u6D88\u9664\u5176\u5B58\u5728\u7684\u8BC1\u636E\u3002\u5982\u679C\u5B9E\u4F8B\u65E0\u6CD5\u6062\u590D\uFF0C\u5220\u9664\u5B9E\u4F8B\u6216\u865A\u62DF\u673A\u4F1A\u79FB\u9664\u5B9D\u8D35\u7684\u53D6\u8BC1\u5DE5\u4EF6\u548C\u5176\u4ED6\u53EF\u7591\u884C\u4E3A\u7684\u8BC1\u636E\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/003\/"},{"id":"T1578.004","name":"\u6062\u590D\u4E91\u5B9E\u4F8B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u5B9E\u65BD\u6076\u610F\u6D3B\u52A8\u540E\uFF0C\u64A4\u9500\u5BF9\u4E91\u5B9E\u4F8B\u6240\u505A\u7684\u66F4\u6539\uFF0C\u4EE5\u8BD5\u56FE\u9003\u907F\u68C0\u6D4B\u5E76\u6D88\u9664\u5176\u5B58\u5728\u7684\u8BC1\u636E\u3002\u5728\u9AD8\u5EA6\u865A\u62DF\u5316\u7684\u73AF\u5883\u4E2D\uFF0C\u4F8B\u5982\u57FA\u4E8E\u4E91\u7684\u57FA\u7840\u8BBE\u65BD\uFF0C\u8FD9\u53EF\u4EE5\u901A\u8FC7\u4E91\u7BA1\u7406\u4EEA\u8868\u677F\u6216\u4E91API\u6062\u590D\u865A\u62DF\u673A\uFF08VM\uFF09\u6216\u6570\u636E\u5B58\u50A8\u5FEB\u7167\u6765\u5B9E\u73B0\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/004\/"},{"id":"T1578.005","name":"\u4FEE\u6539\u4E91\u8BA1\u7B97\u914D\u7F6E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4FEE\u6539\u76F4\u63A5\u5F71\u54CD\u4E91\u57FA\u7840\u8BBE\u65BD\u8BA1\u7B97\u89C4\u6A21\u3001\u4F4D\u7F6E\u548C\u53EF\u7528\u8D44\u6E90\u7684\u8BBE\u7F6E\uFF0C\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u8FD9\u4E9B\u8BBE\u7F6E\u53EF\u80FD\u5305\u62EC\u670D\u52A1\u914D\u989D\u3001\u8BA2\u9605\u5173\u8054\u3001\u79DF\u6237\u8303\u56F4\u5185\u7684\u7B56\u7565\u6216\u5176\u4ED6\u5F71\u54CD\u53EF\u7528\u8BA1\u7B97\u8D44\u6E90\u7684\u914D\u7F6E\u3002\u6B64\u7C7B\u4FEE\u6539\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u6EE5\u7528\u53D7\u5BB3\u8005\u7684\u8BA1\u7B97\u8D44\u6E90\u6765\u5B9E\u73B0\u5176\u76EE\u6807\uFF0C\u540C\u65F6\u53EF\u80FD\u4E0D\u4F1A\u5F71\u54CD\u6B63\u5728\u8FD0\u884C\u7684\u5B9E\u4F8B\u7684\u6267\u884C\uFF0C\u4E5F\u4E0D\u4F1A\u5411\u53D7\u5BB3\u8005\u66B4\u9732\u5176\u6D3B\u52A8\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/005\/"},{"id":"T1578","name":"\u4FEE\u6539\u4E91\u8BA1\u7B97\u57FA\u7840\u8BBE\u65BD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u4FEE\u6539\u4E91\u8D26\u6237\u7684\u8BA1\u7B97\u670D\u52A1\u57FA\u7840\u8BBE\u65BD\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002\u5BF9\u8BA1\u7B97\u670D\u52A1\u57FA\u7840\u8BBE\u65BD\u7684\u4FEE\u6539\u53EF\u5305\u62EC\u521B\u5EFA\u3001\u5220\u9664\u6216\u4FEE\u6539\u4E00\u4E2A\u6216\u591A\u4E2A\u7EC4\u4EF6\uFF0C\u4F8B\u5982\u8BA1\u7B97\u5B9E\u4F8B\u3001\u865A\u62DF\u673A\u548C\u5FEB\u7167\u3002","sub-techniques":"T1578.001, T1578.002, T1578.003, T1578.004, T1578.005","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1578\/"},{"id":"T1580","name":"\u4E91\u57FA\u7840\u8BBE\u65BD\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u53D1\u73B0\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1\uFF08IaaS\uFF09\u73AF\u5883\u4E2D\u53EF\u7528\u7684\u57FA\u7840\u8BBE\u65BD\u548C\u8D44\u6E90\u3002\u8FD9\u5305\u62EC\u8BA1\u7B97\u670D\u52A1\u8D44\u6E90\uFF0C\u5982\u5B9E\u4F8B\u3001\u865A\u62DF\u673A\u548C\u5FEB\u7167\uFF0C\u4EE5\u53CA\u5176\u4ED6\u670D\u52A1\u7684\u8D44\u6E90\uFF0C\u5305\u62EC\u5B58\u50A8\u548C\u6570\u636E\u5E93\u670D\u52A1\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1580\/"},{"id":"T1583.001","name":"\u57DF\u540D","description":"\u5BF9\u624B\u53EF\u80FD\u83B7\u53D6\u53EF\u7528\u4E8E\u653B\u51FB\u7684\u57DF\u540D\u3002\u57DF\u540D\u662F\u4EBA\u7C7B\u53EF\u8BFB\u7684\u540D\u79F0\uFF0C\u7528\u4E8E\u4EE3\u8868\u4E00\u4E2A\u6216\u591A\u4E2AIP\u5730\u5740\u3002\u8FD9\u4E9B\u57DF\u540D\u53EF\u4EE5\u8D2D\u4E70\uFF0C\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\u4E5F\u53EF\u4EE5\u514D\u8D39\u83B7\u53D6\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/001\/"},{"id":"T1583.002","name":"DNS\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5EFA\u7ACB\u81EA\u5DF1\u7684\u57DF\u540D\u7CFB\u7EDF\uFF08DNS\uFF09\u670D\u52A1\u5668\uFF0C\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u6D3B\u52A8\u3002\u5728\u5165\u4FB5\u540E\u7684\u884C\u52A8\u4E2D\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528DNS\u6D41\u91CF\u6267\u884C\u591A\u79CD\u4EFB\u52A1\uFF0C\u5305\u62EC\u8FDB\u884C\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08\u4F8B\u5982\uFF1A\u5E94\u7528\u5C42\u534F\u8BAE\uFF09\u3002\u4E0D\u540C\u4E8E\u52AB\u6301\u73B0\u6709DNS\u670D\u52A1\u5668\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u9009\u62E9\u914D\u7F6E\u5E76\u8FD0\u884C\u81EA\u5DF1\u7684DNS\u670D\u52A1\u5668\u4EE5\u652F\u6301\u5176\u64CD\u4F5C\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/002\/"},{"id":"T1583.003","name":"\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u79DF\u7528\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668\uFF08VPS\uFF09\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u3002\u5E02\u573A\u4E0A\u6709\u591A\u79CD\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u63D0\u4F9B\u865A\u62DF\u673A\/\u5BB9\u5668\u79DF\u8D41\u670D\u52A1\u3002\u901A\u8FC7\u4F7F\u7528VPS\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u7269\u7406\u8FFD\u6EAF\u5176\u64CD\u4F5C\u53D8\u5F97\u56F0\u96BE\u3002\u5229\u7528\u4E91\u57FA\u7840\u8BBE\u65BD\u8FD8\u80FD\u8BA9\u653B\u51FB\u8005\u66F4\u5FEB\u901F\u5730\u90E8\u7F72\u3001\u4FEE\u6539\u548C\u5173\u95ED\u5176\u653B\u51FB\u8BBE\u65BD\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/003\/"},{"id":"T1583.004","name":"\u670D\u52A1\u5668","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u3001\u79DF\u8D41\u3001\u79DF\u7528\u6216\u83B7\u53D6\u7269\u7406\u670D\u52A1\u5668\uFF0C\u8FD9\u4E9B\u670D\u52A1\u5668\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u4F7F\u7528\u3002\u5229\u7528\u670D\u52A1\u5668\u4F7F\u5BF9\u624B\u80FD\u591F\u7B56\u5212\u3001\u53D1\u8D77\u5E76\u6267\u884C\u653B\u51FB\u884C\u52A8\u3002\u5728\u5165\u4FB5\u540E\u7684\u6D3B\u52A8\u4E2D\uFF0C\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u670D\u52A1\u5668\u6267\u884C\u591A\u79CD\u4EFB\u52A1\uFF0C\u4F8B\u5982\u5728\u201C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u201D\u653B\u51FB\u4E2D\u8BBE\u7F6E\u6C34\u5751\u7F51\u7AD9\u3001\u652F\u6301\u9493\u9C7C\u653B\u51FB\u64CD\u4F5C\uFF0C\u6216\u534F\u52A9\u547D\u4EE4\u4E0E\u63A7\u5236\u6D3B\u52A8\u3002\u9664\u4E86\u5165\u4FB5\u7B2C\u4E09\u65B9\u670D\u52A1\u5668\u6216\u79DF\u7528\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668\u5916\uFF0C\u5BF9\u624B\u4E5F\u53EF\u80FD\u9009\u62E9\u81EA\u884C\u914D\u7F6E\u548C\u8FD0\u884C\u670D\u52A1\u5668\u4EE5\u652F\u6301\u5176\u653B\u51FB\u884C\u52A8\u3002\u6B64\u5916\uFF0C\u4E91\u670D\u52A1\u5668\u7684\u514D\u8D39\u8BD5\u7528\u671F\u4E5F\u53EF\u80FD\u88AB\u6EE5\u7528\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/004\/"},{"id":"T1583.005","name":"\u50F5\u5C38\u7F51\u7EDC","description":"\u5BF9\u624B\u53EF\u80FD\u8D2D\u4E70\u3001\u79DF\u8D41\u6216\u79DF\u7528\u4E00\u4E2A\u7531\u53D7\u611F\u67D3\u7CFB\u7EDF\u7EC4\u6210\u7684\u7F51\u7EDC\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u4F7F\u7528\u3002\u50F5\u5C38\u7F51\u7EDC\u662F\u7531\u53D7\u611F\u67D3\u7CFB\u7EDF\u6784\u6210\u7684\u7F51\u7EDC\uFF0C\u53EF\u88AB\u6307\u4EE4\u6267\u884C\u534F\u8C03\u4EFB\u52A1\u3002\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u542F\u52A8\u5668\/\u538B\u529B\u6D4B\u8BD5\u670D\u52A1\u8BA2\u9605\u4F7F\u7528\u73B0\u6709\u7684\u50F5\u5C38\u7F51\u7EDC\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/005\/"},{"id":"T1583.006","name":"\u7F51\u7EDC\u670D\u52A1","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6CE8\u518C\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u9636\u6BB5\u7684\u7F51\u7EDC\u670D\u52A1\u3002\u5B58\u5728\u591A\u79CD\u6D41\u884C\u7F51\u7AD9\u4F9B\u5BF9\u624B\u6CE8\u518C\u57FA\u4E8E\u7F51\u7EDC\u7684\u670D\u52A1\uFF0C\u8FD9\u4E9B\u670D\u52A1\u53EF\u5728\u5BF9\u624B\u751F\u547D\u5468\u671F\u7684\u540E\u7EED\u9636\u6BB5\u88AB\u6EE5\u7528\uFF0C\u4F8B\u5982\u5728\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08\u7F51\u7EDC\u670D\u52A1\uFF09\u3001\u901A\u8FC7\u7F51\u7EDC\u670D\u52A1\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u6216\u7F51\u7EDC\u9493\u9C7C\u7B49\u6D3B\u52A8\u4E2D\u3002\u901A\u8FC7\u4F7F\u7528\u8C37\u6B4C\u3001GitHub\u6216Twitter\u7B49\u5E38\u89C1\u670D\u52A1\uFF0C\u5BF9\u624B\u66F4\u5BB9\u6613\u9690\u85CF\u5728\u9884\u671F\u7684\u7F51\u7EDC\u566A\u58F0\u4E2D\u3002\u5229\u7528\u7F51\u7EDC\u670D\u52A1\uFF0C\u5BF9\u624B\u80FD\u591F\u4F7F\u5B9E\u9645\u64CD\u4F5C\u96BE\u4EE5\u88AB\u7269\u7406\u8FFD\u6EAF\u81F3\u5176\u81EA\u8EAB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/006\/"},{"id":"T1583.007","name":"\u65E0\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8D2D\u4E70\u5E76\u914D\u7F6E\u65E0\u670D\u52A1\u5668\u4E91\u57FA\u7840\u8BBE\u65BD\uFF0C\u4F8B\u5982Cloudflare Workers\u3001AWS Lambda\u51FD\u6570\u6216Google Apps Scripts\uFF0C\u8FD9\u4E9B\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u4F7F\u7528\u3002\u901A\u8FC7\u5229\u7528\u65E0\u670D\u52A1\u5668\u57FA\u7840\u8BBE\u65BD\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u64CD\u4F5C\u4E2D\u4F7F\u7528\u7684\u8BBE\u65BD\u66F4\u96BE\u8FFD\u6EAF\u5230\u5176\u81EA\u8EAB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/007\/"},{"id":"T1583.008","name":"\u6076\u610F\u5E7F\u544A","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u5728\u7EBF\u5E7F\u544A\uFF0C\u8FD9\u4E9B\u5E7F\u544A\u53EF\u80FD\u88AB\u6EE5\u7528\u4EE5\u5411\u53D7\u5BB3\u8005\u5206\u53D1\u6076\u610F\u8F6F\u4EF6\u3002\u8D2D\u4E70\u5E7F\u544A\u65E2\u53EF\u4EE5\u5728\u7279\u5B9A\u7F51\u7EDC\u4F4D\u7F6E\u690D\u5165\u6076\u610F\u5185\u5BB9\uFF0C\u4E5F\u80FD\u4F7F\u5176\u5728\u641C\u7D22\u7ED3\u679C\u7B49\u4F4D\u7F6E\u83B7\u5F97\u6709\u5229\u5C55\u793A\uFF0C\u4F8B\u5982\u5728\u641C\u7D22\u5F15\u64CE\u7ED3\u679C\u4E2D\u5360\u636E\u663E\u773C\u4F4D\u7F6E\u3002\u8FD9\u4E9B\u5E7F\u544A\u53EF\u80FD\u4F7F\u7528\u6237\u66F4\u96BE\u533A\u5206\u5B9E\u9645\u641C\u7D22\u7ED3\u679C\u4E0E\u5E7F\u544A\u5185\u5BB9\u3002\u6B64\u5916\uFF0C\u8D2D\u4E70\u5E7F\u544A\u8FD8\u53EF\u5229\u7528\u5E7F\u544A\u7F51\u7EDC\u7684\u529F\u80FD\u9488\u5BF9\u7279\u5B9A\u53D7\u4F17\u7FA4\u4F53\uFF0C\u53EF\u80FD\u8FDB\u4E00\u6B65\u5229\u7528\u7528\u6237\u5BF9\u641C\u7D22\u5F15\u64CE\u548C\u70ED\u95E8\u7F51\u7AD9\u56FA\u6709\u7684\u4FE1\u4EFB\u8FDB\u884C\u653B\u51FB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/008\/"},{"id":"T1583","name":"\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD","description":"\u5BF9\u624B\u53EF\u80FD\u8D2D\u4E70\u3001\u79DF\u8D41\u6216\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u57FA\u7840\u8BBE\u65BD\u3002\u5B58\u5728\u591A\u79CD\u591A\u6837\u7684\u57FA\u7840\u8BBE\u65BD\uFF0C\u7528\u4E8E\u6258\u7BA1\u548C\u534F\u8C03\u5BF9\u624B\u884C\u52A8\u3002\u57FA\u7840\u8BBE\u65BD\u89E3\u51B3\u65B9\u6848\u5305\u62EC\u7269\u7406\u6216\u4E91\u670D\u52A1\u5668\u3001\u57DF\u540D\u4EE5\u53CA\u7B2C\u4E09\u65B9\u7F51\u7EDC\u670D\u52A1\u3002\u90E8\u5206\u57FA\u7840\u8BBE\u65BD\u63D0\u4F9B\u5546\u63D0\u4F9B\u514D\u8D39\u8BD5\u7528\u671F\uFF0C\u4F7F\u5F97\u5BF9\u624B\u80FD\u591F\u4EE5\u6709\u9650\u751A\u81F3\u96F6\u6210\u672C\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\u3002\u6B64\u5916\uFF0C\u50F5\u5C38\u7F51\u7EDC\u4E5F\u53EF\u4F9B\u79DF\u7528\u6216\u8D2D\u4E70\u3002","sub-techniques":"T1583.001, T1583.002, T1583.003, T1583.004, T1583.005, T1583.006, T1583.007, T1583.008","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1583\/"},{"id":"T1584.001","name":"\u57DF\u540D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u52AB\u6301\u53EF\u7528\u4E8E\u5B9A\u5411\u653B\u51FB\u7684\u57DF\u540D\u548C\/\u6216\u5B50\u57DF\u540D\u3002\u57DF\u540D\u6CE8\u518C\u52AB\u6301\u662F\u6307\u672A\u7ECF\u539F\u6CE8\u518C\u8005\u8BB8\u53EF\u66F4\u6539\u57DF\u540D\u6CE8\u518C\u4FE1\u606F\u7684\u884C\u4E3A\u3002\u653B\u51FB\u8005\u53EF\u80FD\u83B7\u53D6\u57DF\u540D\u6240\u6709\u8005\u6240\u5217\u4EBA\u5458\u7684\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u8BBF\u95EE\u6743\u9650\uFF0C\u968F\u540E\u58F0\u79F0\u5FD8\u8BB0\u5BC6\u7801\u4EE5\u4FEE\u6539\u57DF\u540D\u6CE8\u518C\u4FE1\u606F\u3002\u5176\u4ED6\u624B\u6BB5\u5305\u62EC\u901A\u8FC7\u793E\u4F1A\u5DE5\u7A0B\u5B66\u6B3A\u9A97\u57DF\u540D\u6CE8\u518C\u5BA2\u670D\u4EE5\u83B7\u53D6\u8D26\u6237\u8BBF\u95EE\u6743\u3001\u5229\u7528\u7EED\u8D39\u6D41\u7A0B\u6F0F\u6D1E\uFF0C\u6216\u5165\u4FB5\u652F\u6301\u57DF\u540D\u7BA1\u7406\u7684\u4E91\u670D\u52A1\uFF08\u4F8B\u5982AWS Route53\uFF09\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/001\/"},{"id":"T1584.002","name":"DNS\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u7B2C\u4E09\u65B9DNS\u670D\u52A1\u5668\uFF0C\u8FD9\u4E9B\u670D\u52A1\u5668\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u88AB\u5229\u7528\u3002\u5728\u5165\u4FB5\u540E\u7684\u6D3B\u52A8\u9636\u6BB5\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528DNS\u6D41\u91CF\u6267\u884C\u591A\u79CD\u4EFB\u52A1\uFF0C\u5305\u62EC\u8FDB\u884C\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08\u4F8B\u5982\uFF1A\u5E94\u7528\u5C42\u534F\u8BAE\uFF09\u3002\u4E3A\u4E86\u652F\u6301\u5176\u64CD\u4F5C\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u9009\u62E9\u5165\u4FB5\u7B2C\u4E09\u65B9DNS\u670D\u52A1\u5668\uFF0C\u800C\u975E\u81EA\u884C\u642D\u5EFADNS\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/002\/"},{"id":"T1584.003","name":"\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u7B2C\u4E09\u65B9\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668\uFF08VPS\uFF09\uFF0C\u5E76\u5C06\u5176\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u3002\u5E02\u573A\u4E0A\u5B58\u5728\u4F17\u591A\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\uFF0C\u5B83\u4EEC\u4EE5\u670D\u52A1\u5F62\u5F0F\u51FA\u552E\u865A\u62DF\u673A\u6216\u5BB9\u5668\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u7531\u7B2C\u4E09\u65B9\u5B9E\u4F53\u8D2D\u4E70\u7684VPS\u3002\u901A\u8FC7\u63A7\u5236VPS\u4F5C\u4E3A\u57FA\u7840\u8BBE\u65BD\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u5B9E\u9645\u64CD\u4F5C\u96BE\u4EE5\u88AB\u7269\u7406\u8FFD\u6EAF\u81F3\u5176\u81EA\u8EAB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/003\/"},{"id":"T1584.004","name":"\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5165\u4FB5\u7B2C\u4E09\u65B9\u670D\u52A1\u5668\uFF0C\u8FD9\u4E9B\u670D\u52A1\u5668\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u88AB\u5229\u7528\u3002\u4F7F\u7528\u670D\u52A1\u5668\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u7B56\u5212\u3001\u53D1\u8D77\u5E76\u6267\u884C\u653B\u51FB\u884C\u52A8\u3002\u5728\u5165\u4FB5\u540E\u7684\u6D3B\u52A8\u9636\u6BB5\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u670D\u52A1\u5668\u6267\u884C\u591A\u79CD\u4EFB\u52A1\uFF0C\u5305\u62EC\u7528\u4E8E\u547D\u4EE4\u4E0E\u63A7\u5236\u3002\u4E3A\u4E86\u652F\u6301\u5176\u653B\u51FB\u884C\u52A8\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u9009\u62E9\u5165\u4FB5\u7B2C\u4E09\u65B9\u670D\u52A1\u5668\uFF0C\u800C\u975E\u81EA\u884C\u8D2D\u4E70\u670D\u52A1\u5668\u6216\u865A\u62DF\u4E13\u7528\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/004\/"},{"id":"T1584.005","name":"\u50F5\u5C38\u7F51\u7EDC","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5165\u4FB5\u5927\u91CF\u7B2C\u4E09\u65B9\u7CFB\u7EDF\u6784\u5EFA\u50F5\u5C38\u7F51\u7EDC\uFF0C\u7528\u4E8E\u5B9E\u65BD\u5B9A\u5411\u653B\u51FB\u3002\u50F5\u5C38\u7F51\u7EDC\u662F\u7531\u53D7\u63A7\u7CFB\u7EDF\u7EC4\u6210\u7684\u7F51\u7EDC\uFF0C\u80FD\u591F\u6267\u884C\u534F\u8C03\u4EFB\u52A1\u3002\u653B\u51FB\u8005\u5E76\u975E\u4ECE\u538B\u529B\u6D4B\u8BD5\u670D\u52A1\u5546\u5904\u8D2D\u4E70\u6216\u79DF\u7528\u50F5\u5C38\u7F51\u7EDC\uFF0C\u800C\u662F\u901A\u8FC7\u5165\u4FB5\u5927\u91CF\u7B2C\u4E09\u65B9\u7CFB\u7EDF\u81EA\u884C\u6784\u5EFA\u3002\u4ED6\u4EEC\u4E5F\u53EF\u80FD\u63A5\u7BA1\u73B0\u6709\u50F5\u5C38\u7F51\u7EDC\uFF0C\u4F8B\u5982\u5C06\u50F5\u5C38\u7A0B\u5E8F\u91CD\u5B9A\u5411\u81F3\u653B\u51FB\u8005\u63A7\u5236\u7684\u6307\u6325\u63A7\u5236\u670D\u52A1\u5668\u3002\u638C\u63E1\u50F5\u5C38\u7F51\u7EDC\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u5F00\u5C55\u540E\u7EED\u6D3B\u52A8\uFF0C\u5982\u5927\u89C4\u6A21\u9493\u9C7C\u653B\u51FB\u6216\u5206\u5E03\u5F0F\u62D2\u7EDD\u670D\u52A1\u653B\u51FB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/005\/"},{"id":"T1584.006","name":"\u7F51\u7EDC\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5165\u4FB5\u7B2C\u4E09\u65B9\u7F51\u7EDC\u670D\u52A1\u6765\u83B7\u53D6\u8BBF\u95EE\u6743\u9650\uFF0C\u8FD9\u4E9B\u670D\u52A1\u53EF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u88AB\u5229\u7528\u3002\u8BB8\u591A\u5E7F\u53D7\u6B22\u8FCE\u7684\u7F51\u7AD9\uFF0C\u5982GitHub\u3001Twitter\u3001Dropbox\u3001Google\u3001SendGrid\u7B49\uFF0C\u4E3A\u5408\u6CD5\u7528\u6237\u63D0\u4F9B\u57FA\u4E8E\u7F51\u7EDC\u7684\u670D\u52A1\u6CE8\u518C\u3002\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u7A83\u53D6\u5408\u6CD5\u7528\u6237\u5BF9\u7F51\u7EDC\u670D\u52A1\u7684\u8BBF\u95EE\u6743\u9650\uFF0C\u5E76\u5C06\u8FD9\u4E9B\u670D\u52A1\u7528\u4F5C\u652F\u6301\u7F51\u7EDC\u884C\u52A8\u7684\u57FA\u7840\u8BBE\u65BD\u3002\u6B64\u7C7B\u7F51\u7EDC\u670D\u52A1\u53EF\u80FD\u5728\u653B\u51FB\u8005\u751F\u547D\u5468\u671F\u7684\u540E\u7EED\u9636\u6BB5\u88AB\u6EE5\u7528\uFF0C\u4F8B\u5982\u5728\u547D\u4EE4\u4E0E\u63A7\u5236\uFF08\u7F51\u7EDC\u670D\u52A1\uFF09\u3001\u901A\u8FC7\u7F51\u7EDC\u670D\u52A1\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u6216\u7F51\u7EDC\u9493\u9C7C\u7B49\u6D3B\u52A8\u4E2D\u3002\u901A\u8FC7\u4F7F\u7528Google\u6216Twitter\u7B49\u5E38\u89C1\u670D\u52A1\uFF0C\u653B\u51FB\u8005\u66F4\u5BB9\u6613\u9690\u85CF\u5728\u6B63\u5E38\u7684\u7F51\u7EDC\u6D41\u91CF\u4E2D\u3002\u5229\u7528\u7F51\u7EDC\u670D\u52A1\uFF0C\u5C24\u5176\u662F\u4ECE\u5408\u6CD5\u7528\u6237\u90A3\u91CC\u7A83\u53D6\u7684\u8BBF\u95EE\u6743\u9650\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u8FFD\u8E2A\u5176\u771F\u5B9E\u8EAB\u4EFD\u53D8\u5F97\u56F0\u96BE\u3002\u6B64\u5916\uFF0C\u5229\u7528\u88AB\u5165\u4FB5\u7684\u57FA\u4E8E\u7F51\u7EDC\u7684\u7535\u5B50\u90AE\u4EF6\u670D\u52A1\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u501F\u52A9\u5408\u6CD5\u57DF\u540D\u6240\u9644\u5E26\u7684\u4FE1\u4EFB\u5173\u7CFB\u6765\u589E\u5F3A\u653B\u51FB\u7684\u9690\u853D\u6027\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/006\/"},{"id":"T1584.007","name":"\u65E0\u670D\u52A1\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u65E0\u670D\u52A1\u5668\u4E91\u57FA\u7840\u8BBE\u65BD\uFF0C\u4F8B\u5982Cloudflare Workers\u3001AWS Lambda\u51FD\u6570\u6216Google Apps Scripts\uFF0C\u8FD9\u4E9B\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u88AB\u5229\u7528\u3002\u901A\u8FC7\u4F7F\u7528\u65E0\u670D\u52A1\u5668\u57FA\u7840\u8BBE\u65BD\uFF0C\u653B\u51FB\u8005\u80FD\u591F\u4F7F\u64CD\u4F5C\u671F\u95F4\u4F7F\u7528\u7684\u57FA\u7840\u8BBE\u65BD\u66F4\u96BE\u8FFD\u6EAF\u5230\u5176\u81EA\u8EAB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/007\/"},{"id":"T1584.008","name":"\u7F51\u7EDC\u8BBE\u5907","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u7B2C\u4E09\u65B9\u7F51\u7EDC\u8BBE\u5907\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u4F8B\u5982\u5C0F\u578B\u529E\u516C\u5BA4\/\u5BB6\u5EAD\u529E\u516C\u5BA4\uFF08SOHO\uFF09\u8DEF\u7531\u5668\u7B49\u7F51\u7EDC\u8BBE\u5907\u53EF\u80FD\u88AB\u653B\u9677\uFF0C\u6B64\u65F6\u653B\u51FB\u8005\u7684\u6700\u7EC8\u76EE\u7684\u5E76\u975E\u83B7\u53D6\u8BE5\u73AF\u5883\u7684\u521D\u59CB\u8BBF\u95EE\u6743\u9650\uFF0C\u800C\u662F\u5229\u7528\u8FD9\u4E9B\u8BBE\u5907\u6765\u652F\u6301\u8FDB\u4E00\u6B65\u7684\u9488\u5BF9\u6027\u653B\u51FB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/008\/"},{"id":"T1584","name":"\u59A5\u534F\u57FA\u7840\u8BBE\u65BD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u7B2C\u4E09\u65B9\u57FA\u7840\u8BBE\u65BD\uFF0C\u5E76\u5C06\u5176\u7528\u4E8E\u653B\u51FB\u6D3B\u52A8\u3002\u57FA\u7840\u8BBE\u65BD\u8D44\u6E90\u5305\u62EC\u7269\u7406\u6216\u4E91\u670D\u52A1\u5668\u3001\u57DF\u540D\u3001\u7F51\u7EDC\u8BBE\u5907\u4EE5\u53CA\u7B2C\u4E09\u65B9\u7F51\u7EDC\u548CDNS\u670D\u52A1\u3002\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5165\u4FB5\u800C\u975E\u8D2D\u4E70\u3001\u79DF\u8D41\u6216\u79DF\u7528\u57FA\u7840\u8BBE\u65BD\u7684\u65B9\u5F0F\uFF0C\u5728\u5176\u4ED6\u653B\u51FB\u9636\u6BB5\u5229\u7528\u8FD9\u4E9B\u8D44\u6E90\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5165\u4FB5\u5927\u91CF\u673A\u5668\u7EC4\u5EFA\u50F5\u5C38\u7F51\u7EDC\uFF0C\u4EE5\u4F9B\u5176\u5229\u7528\u3002","sub-techniques":"T1584.001, T1584.002, T1584.003, T1584.004, T1584.005, T1584.006, T1584.007, T1584.008","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1584\/"},{"id":"T1585.001","name":"\u793E\u4EA4\u5A92\u4F53\u8D26\u53F7","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u521B\u5EFA\u5E76\u57F9\u517B\u793E\u4EA4\u5A92\u4F53\u8D26\u6237\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5EFA\u7ACB\u793E\u4EA4\u5A92\u4F53\u8D26\u6237\uFF0C\u7528\u4EE5\u5851\u9020\u7279\u5B9A\u4EBA\u8BBE\uFF0C\u4ECE\u800C\u63A8\u8FDB\u5176\u884C\u52A8\u3002\u8FD9\u79CD\u4EBA\u8BBE\u6784\u5EFA\u5305\u62EC\u516C\u5F00\u4FE1\u606F\u7684\u7B56\u5212\u3001\u5728\u7EBF\u5B58\u5728\u7684\u5EFA\u7ACB\u3001\u5386\u53F2\u80CC\u666F\u7684\u8425\u9020\u4EE5\u53CA\u5408\u9002\u7684\u5173\u8054\u5173\u7CFB\u7684\u5EFA\u7ACB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1585\/001\/"},{"id":"T1585.002","name":"\u7535\u5B50\u90AE\u4EF6\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u521B\u5EFA\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5229\u7528\u7535\u5B50\u90AE\u4EF6\u670D\u52A1\u63D0\u4F9B\u5546\u6CE8\u518C\u7684\u8D26\u6237\u6765\u63A8\u8FDB\u5176\u884C\u52A8\uFF0C\u4F8B\u5982\u5229\u7528\u8FD9\u4E9B\u8D26\u6237\u8FDB\u884C\u4FE1\u606F\u9493\u9C7C\u6216\u7F51\u7EDC\u9493\u9C7C\u3002\u5EFA\u7ACB\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u8FD8\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u6EE5\u7528\u514D\u8D39\u670D\u52A1\u2014\u2014\u4F8B\u5982\u8BD5\u7528\u671F\u2014\u2014\u4EE5\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF0C\u7528\u4E8E\u540E\u7EED\u76EE\u7684\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1585\/002\/"},{"id":"T1585.003","name":"\u4E91\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u521B\u5EFA\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u7684\u8D26\u6237\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5229\u7528\u4E91\u8D26\u6237\u6765\u63A8\u8FDB\u5176\u64CD\u4F5C\uFF0C\u5305\u62EC\u5229\u7528\u4E91\u5B58\u50A8\u670D\u52A1\uFF08\u5982Dropbox\u3001MEGA\u3001Microsoft OneDrive\u6216AWS S3\u5B58\u50A8\u6876\uFF09\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u81F3\u4E91\u5B58\u50A8\u6216\u4E0A\u4F20\u5DE5\u5177\u3002\u4E91\u8D26\u6237\u8FD8\u53EF\u7528\u4E8E\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF0C\u4F8B\u5982\u865A\u62DF\u79C1\u6709\u670D\u52A1\u5668\u6216\u65E0\u670D\u52A1\u5668\u67B6\u6784\u3002\u5EFA\u7ACB\u4E91\u8D26\u6237\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u5F00\u53D1\u590D\u6742\u7684\u80FD\u529B\uFF0C\u800C\u65E0\u9700\u7BA1\u7406\u81EA\u5DF1\u7684\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1585\/003\/"},{"id":"T1585","name":"\u5F00\u8BBE\u8D26\u6237","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u521B\u5EFA\u5E76\u57F9\u517B\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u670D\u52A1\u8D26\u6237\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5EFA\u7ACB\u8D26\u6237\u4EE5\u6784\u5EFA\u89D2\u8272\uFF0C\u4ECE\u800C\u63A8\u8FDB\u5176\u884C\u52A8\u3002\u89D2\u8272\u5851\u9020\u5305\u62EC\u53D1\u5C55\u516C\u5F00\u4FE1\u606F\u3001\u5B58\u5728\u611F\u3001\u5386\u53F2\u8BB0\u5F55\u4EE5\u53CA\u9002\u5F53\u7684\u5173\u8054\u5173\u7CFB\u3002\u8FD9\u79CD\u5851\u9020\u53EF\u5E94\u7528\u4E8E\u793E\u4EA4\u5A92\u4F53\u3001\u7F51\u7AD9\u6216\u5176\u4ED6\u516C\u5F00\u53EF\u83B7\u53D6\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u5728\u4F7F\u7528\u8BE5\u89D2\u8272\u6216\u8EAB\u4EFD\u7684\u884C\u52A8\u8FC7\u7A0B\u4E2D\u53EF\u80FD\u88AB\u5F15\u7528\u548C\u5BA1\u67E5\u5176\u771F\u5B9E\u6027\u3002","sub-techniques":"T1585.001, T1585.002, T1585.003","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1585\/"},{"id":"T1586.001","name":"\u793E\u4EA4\u5A92\u4F53\u8D26\u53F7","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5165\u4FB5\u793E\u4EA4\u5A92\u4F53\u8D26\u6237\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u5BF9\u4E8E\u5305\u542B\u793E\u4F1A\u5DE5\u7A0B\u5B66\u7684\u64CD\u4F5C\uFF0C\u5229\u7528\u5728\u7EBF\u8EAB\u4EFD\u53EF\u80FD\u81F3\u5173\u91CD\u8981\u3002\u4E0E\u5176\u521B\u5EFA\u548C\u57F9\u517B\u793E\u4EA4\u5A92\u4F53\u8D44\u6599\uFF08\u5373\u793E\u4EA4\u5A92\u4F53\u8D26\u6237\uFF09\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5165\u4FB5\u73B0\u6709\u7684\u793E\u4EA4\u5A92\u4F53\u8D26\u6237\u3002\u5982\u679C\u6F5C\u5728\u53D7\u5BB3\u8005\u4E0E\u88AB\u5165\u4FB5\u7684\u8EAB\u4EFD\u5B58\u5728\u5173\u8054\u6216\u5BF9\u5176\u6709\u6240\u4E86\u89E3\uFF0C\u5229\u7528\u73B0\u6709\u8EAB\u4EFD\u53EF\u80FD\u4F1A\u5728\u4E00\u5B9A\u7A0B\u5EA6\u4E0A\u8D62\u5F97\u4ED6\u4EEC\u7684\u4FE1\u4EFB\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1586\/001\/"},{"id":"T1586.002","name":"\u7535\u5B50\u90AE\u4EF6\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5165\u4FB5\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u3002\u4ED6\u4EEC\u53EF\u5229\u7528\u8FD9\u4E9B\u88AB\u5165\u4FB5\u7684\u8D26\u6237\u63A8\u8FDB\u5176\u884C\u52A8\uFF0C\u4F8B\u5982\u501F\u6B64\u8FDB\u884C\u4FE1\u606F\u9493\u9C7C\u3001\u7F51\u7EDC\u9493\u9C7C\u6216\u5927\u89C4\u6A21\u5783\u573E\u90AE\u4EF6\u6D3B\u52A8\u3002\u82E5\u6F5C\u5728\u53D7\u5BB3\u8005\u4E0E\u88AB\u5165\u4FB5\u8D26\u6237\u6301\u6709\u8005\u5B58\u5728\u5173\u8054\u6216\u4E86\u89E3\u5176\u8EAB\u4EFD\uFF0C\u4F7F\u7528\u8BE5\u73B0\u6709\u8EAB\u4EFD\u8FDB\u884C\u6D3B\u52A8\u53EF\u80FD\u5728\u4E00\u5B9A\u7A0B\u5EA6\u4E0A\u83B7\u53D6\u53D7\u5BB3\u8005\u7684\u4FE1\u4EFB\u3002\u6B64\u5916\uFF0C\u88AB\u5165\u4FB5\u7684\u7535\u5B50\u90AE\u4EF6\u8D26\u6237\u8FD8\u53EF\u7528\u4E8E\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF08\u4F8B\u5982\uFF1A\u57DF\u540D\uFF09\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1586\/002\/"},{"id":"T1586.003","name":"\u4E91\u8D26\u6237","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5165\u4FB5\u4E91\u8D26\u6237\uFF0C\u5E76\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u52A0\u4EE5\u5229\u7528\u3002\u4ED6\u4EEC\u53EF\u5229\u7528\u8FD9\u4E9B\u88AB\u653B\u9677\u7684\u8D26\u6237\u63A8\u8FDB\u5176\u884C\u52A8\uFF0C\u5305\u62EC\u501F\u52A9Dropbox\u3001Microsoft OneDrive\u6216AWS S3\u5B58\u50A8\u6876\u7B49\u4E91\u5B58\u50A8\u670D\u52A1\u8FDB\u884C\u6570\u636E\u5916\u6CC4\u81F3\u4E91\u7AEF\u5B58\u50A8\u6216\u4E0A\u4F20\u5DE5\u5177\u3002\u4E91\u8D26\u6237\u8FD8\u53EF\u7528\u4E8E\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF0C\u5982\u865A\u62DF\u79C1\u6709\u670D\u52A1\u5668\u6216\u65E0\u670D\u52A1\u5668\u67B6\u6784\u3002\u6B64\u5916\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528Twilio\u3001SendGrid\u3001AWS\u7EC8\u7AEF\u7528\u6237\u6D88\u606F\u670D\u52A1\u3001AWS SNS\uFF08\u7B80\u5355\u901A\u77E5\u670D\u52A1\uFF09\u6216AWS SES\uFF08\u7B80\u5355\u7535\u5B50\u90AE\u4EF6\u670D\u52A1\uFF09\u7B49\u57FA\u4E8E\u4E91\u7684\u6D88\u606F\u670D\u52A1\u8FDB\u884C\u5783\u573E\u90AE\u4EF6\u6216\u9493\u9C7C\u653B\u51FB\u3002\u5165\u4FB5\u4E91\u8D26\u6237\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u5F00\u53D1\u590D\u6742\u7684\u80FD\u529B\uFF0C\u800C\u65E0\u9700\u7BA1\u7406\u81EA\u5DF1\u7684\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1586\/003\/"},{"id":"T1586","name":"\u59A5\u534F\u8D26\u6237","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5165\u4FB5\u90A3\u4E9B\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u53EF\u88AB\u5229\u7528\u7684\u670D\u52A1\u8D26\u6237\u3002\u5728\u6D89\u53CA\u793E\u4F1A\u5DE5\u7A0B\u5B66\u7684\u64CD\u4F5C\u4E2D\uFF0C\u4F7F\u7528\u5728\u7EBF\u8EAB\u4EFD\u53EF\u80FD\u81F3\u5173\u91CD\u8981\u3002\u4E0E\u5176\u521B\u5EFA\u548C\u57F9\u517B\u8D26\u6237\uFF08\u5373\u5EFA\u7ACB\u8D26\u6237\uFF09\uFF0C\u5BF9\u624B\u53EF\u80FD\u4F1A\u9009\u62E9\u5165\u4FB5\u73B0\u6709\u8D26\u6237\u3002\u5229\u7528\u73B0\u6709\u8EAB\u4EFD\u53EF\u80FD\u4F1A\u5728\u6F5C\u5728\u53D7\u5BB3\u8005\u4E2D\u5EFA\u7ACB\u4E00\u5B9A\u7A0B\u5EA6\u7684\u4FE1\u4EFB\uFF0C\u7279\u522B\u662F\u5F53\u4ED6\u4EEC\u4E0E\u88AB\u5165\u4FB5\u7684\u8EAB\u4EFD\u5B58\u5728\u5173\u8054\u6216\u5BF9\u5176\u6709\u6240\u4E86\u89E3\u65F6\u3002","sub-techniques":"T1586.001, T1586.002, T1586.003","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1586\/"},{"id":"T1587.001","name":"\u6076\u610F\u8F6F\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u5F00\u53D1\u6076\u610F\u8F6F\u4EF6\u53CA\u5176\u7EC4\u4EF6\uFF0C\u7528\u4E8E\u653B\u51FB\u8FC7\u7A0B\u4E2D\u7684\u76EE\u6807\u5B9A\u4F4D\u3002\u6784\u5EFA\u6076\u610F\u8F6F\u4EF6\u53EF\u5305\u62EC\u5F00\u53D1\u6709\u6548\u8F7D\u8377\u3001\u6295\u653E\u5668\u3001\u5165\u4FB5\u540E\u5DE5\u5177\u3001\u540E\u95E8\u7A0B\u5E8F\uFF08\u5305\u62EC\u690D\u5165\u540E\u95E8\u7684\u955C\u50CF\u6587\u4EF6\uFF09\u3001\u52A0\u58F3\u7A0B\u5E8F\u3001\u547D\u4EE4\u4E0E\u63A7\u5236\u534F\u8BAE\uFF0C\u4EE5\u53CA\u5236\u4F5C\u53D7\u611F\u67D3\u7684\u53EF\u79FB\u52A8\u5B58\u50A8\u4ECB\u8D28\u3002\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u5F00\u53D1\u6076\u610F\u8F6F\u4EF6\u6765\u652F\u6301\u5176\u653B\u51FB\u884C\u52A8\uFF0C\u4EE5\u6B64\u5EFA\u7ACB\u7EF4\u6301\u8FDC\u7A0B\u673A\u5668\u63A7\u5236\u6743\u3001\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u5E76\u5B9E\u65BD\u5165\u4FB5\u540E\u884C\u4E3A\u7684\u624B\u6BB5\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1587\/001\/"},{"id":"T1587.002","name":"\u4EE3\u7801\u7B7E\u540D\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u521B\u5EFA\u81EA\u7B7E\u540D\u7684\u4EE3\u7801\u7B7E\u540D\u8BC1\u4E66\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u4F7F\u7528\u3002\u4EE3\u7801\u7B7E\u540D\u662F\u6307\u5BF9\u53EF\u6267\u884C\u6587\u4EF6\u548C\u811A\u672C\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\u7684\u8FC7\u7A0B\uFF0C\u4EE5\u786E\u8BA4\u8F6F\u4EF6\u4F5C\u8005\u8EAB\u4EFD\uFF0C\u5E76\u786E\u4FDD\u4EE3\u7801\u672A\u88AB\u7BE1\u6539\u6216\u635F\u574F\u3002\u4EE3\u7801\u7B7E\u540D\u4E3A\u7A0B\u5E8F\u63D0\u4F9B\u4E86\u4E00\u5B9A\u7A0B\u5EA6\u7684\u5F00\u53D1\u8005\u771F\u5B9E\u6027\u4FDD\u8BC1\uFF0C\u5E76\u786E\u4FDD\u7A0B\u5E8F\u672A\u88AB\u7BE1\u6539\u3002\u7528\u6237\u548C\/\u6216\u5B89\u5168\u5DE5\u5177\u53EF\u80FD\u66F4\u4FE1\u4EFB\u7ECF\u8FC7\u7B7E\u540D\u7684\u4EE3\u7801\uFF0C\u800C\u975E\u672A\u7B7E\u540D\u7684\u4EE3\u7801\uFF0C\u5373\u4F7F\u4ED6\u4EEC\u4E0D\u77E5\u9053\u8BC1\u4E66\u7684\u9881\u53D1\u8005\u6216\u4F5C\u8005\u662F\u8C01\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1587\/002\/"},{"id":"T1587.003","name":"\u6570\u5B57\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u521B\u5EFA\u81EA\u7B7E\u540D\u7684SSL\/TLS\u8BC1\u4E66\uFF0C\u7528\u4E8E\u653B\u51FB\u8FC7\u7A0B\u4E2D\u3002SSL\/TLS\u8BC1\u4E66\u65E8\u5728\u5EFA\u7ACB\u4FE1\u4EFB\uFF0C\u5176\u4E2D\u5305\u542B\u5BC6\u94A5\u4FE1\u606F\u3001\u6240\u6709\u8005\u8EAB\u4EFD\u4FE1\u606F\u4EE5\u53CA\u9A8C\u8BC1\u8BC1\u4E66\u5185\u5BB9\u6B63\u786E\u7684\u5B9E\u4F53\u6570\u5B57\u7B7E\u540D\u3002\u5982\u679C\u7B7E\u540D\u6709\u6548\uFF0C\u4E14\u68C0\u67E5\u8BC1\u4E66\u7684\u4EBA\u4FE1\u4EFB\u7B7E\u540D\u8005\uFF0C\u90A3\u4E48\u4ED6\u4EEC\u5C31\u77E5\u9053\u53EF\u4EE5\u4F7F\u7528\u8BE5\u5BC6\u94A5\u4E0E\u5176\u6240\u6709\u8005\u8FDB\u884C\u901A\u4FE1\u3002\u5728\u81EA\u7B7E\u540D\u7684\u60C5\u51B5\u4E0B\uFF0C\u6570\u5B57\u8BC1\u4E66\u5C06\u7F3A\u4E4F\u4E0E\u7B2C\u4E09\u65B9\u8BC1\u4E66\u9881\u53D1\u673A\u6784\uFF08CA\uFF09\u7B7E\u540D\u76F8\u5173\u7684\u4FE1\u4EFB\u8981\u7D20\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1587\/003\/"},{"id":"T1587.004","name":"\u6F0F\u6D1E\u5229\u7528","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5F00\u53D1\u53EF\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u7684\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u3002\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u5229\u7528\u7A0B\u5E8F\u9519\u8BEF\u6216\u5B89\u5168\u6F0F\u6D1E\uFF0C\u5BFC\u81F4\u8BA1\u7B97\u673A\u786C\u4EF6\u6216\u8F6F\u4EF6\u51FA\u73B0\u975E\u9884\u671F\u6216\u610F\u5916\u7684\u884C\u4E3A\u3002\u9664\u4E86\u4ECE\u7F51\u4E0A\u67E5\u627E\/\u4FEE\u6539\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u6216\u4ECE\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u4F9B\u5E94\u5546\u5904\u8D2D\u4E70\u5916\uFF0C\u5BF9\u624B\u4E5F\u53EF\u80FD\u81EA\u884C\u5F00\u53D1\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u3002\u5BF9\u624B\u53EF\u80FD\u4F1A\u5229\u7528\u901A\u8FC7\u6F0F\u6D1E\u83B7\u53D6\u7684\u4FE1\u606F\u6765\u96C6\u4E2D\u7CBE\u529B\u5F00\u53D1\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u3002\u5728\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u5F00\u53D1\u8FC7\u7A0B\u4E2D\uFF0C\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u6A21\u7CCA\u6D4B\u8BD5\u548C\u8865\u4E01\u5206\u6790\u7B49\u65B9\u6CD5\u53D1\u73B0\u53EF\u5229\u7528\u7684\u6F0F\u6D1E\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1587\/004\/"},{"id":"T1587","name":"\u5F00\u53D1\u80FD\u529B","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6784\u5EFA\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u80FD\u529B\u3002\u4E0E\u8D2D\u4E70\u3001\u514D\u8D39\u4E0B\u8F7D\u6216\u7A83\u53D6\u80FD\u529B\u4E0D\u540C\uFF0C\u5BF9\u624B\u53EF\u80FD\u4F1A\u81EA\u884C\u5F00\u53D1\u5185\u90E8\u80FD\u529B\u3002\u8FD9\u4E00\u8FC7\u7A0B\u5305\u62EC\u786E\u5B9A\u5F00\u53D1\u9700\u6C42\u5E76\u6784\u5EFA\u89E3\u51B3\u65B9\u6848\uFF0C\u5982\u6076\u610F\u8F6F\u4EF6\u3001\u6F0F\u6D1E\u5229\u7528\u5DE5\u5177\u548C\u81EA\u7B7E\u540D\u8BC1\u4E66\u3002\u5BF9\u624B\u53EF\u80FD\u4F1A\u5F00\u53D1\u80FD\u529B\u4EE5\u652F\u6301\u5176\u5728\u5BF9\u624B\u751F\u547D\u5468\u671F\u7684\u591A\u4E2A\u9636\u6BB5\u4E2D\u7684\u64CD\u4F5C\u3002","sub-techniques":"T1587.001, T1587.002, T1587.003, T1587.004","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1587\/"},{"id":"T1588.001","name":"\u6076\u610F\u8F6F\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u3001\u7A83\u53D6\u6216\u4E0B\u8F7D\u53EF\u5728\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u7684\u6076\u610F\u8F6F\u4EF6\u3002\u6076\u610F\u8F6F\u4EF6\u53EF\u5305\u542B\u6709\u6548\u8F7D\u8377\u3001\u6295\u653E\u5668\u3001\u5165\u4FB5\u540E\u5DE5\u5177\u3001\u540E\u95E8\u7A0B\u5E8F\u3001\u52A0\u58F3\u5DE5\u5177\u4EE5\u53CA\u547D\u4EE4\u4E0E\u63A7\u5236\u534F\u8BAE\u3002\u5BF9\u624B\u83B7\u53D6\u6076\u610F\u8F6F\u4EF6\u65E8\u5728\u652F\u6301\u5176\u884C\u52A8\uFF0C\u4ECE\u800C\u83B7\u5F97\u7EF4\u6301\u5BF9\u8FDC\u7A0B\u673A\u5668\u7684\u63A7\u5236\u3001\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u4EE5\u53CA\u6267\u884C\u5165\u4FB5\u540E\u884C\u4E3A\u7684\u624B\u6BB5\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/001\/"},{"id":"T1588.002","name":"\u5DE5\u5177","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u3001\u7A83\u53D6\u6216\u4E0B\u8F7D\u53EF\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u7684\u8F6F\u4EF6\u5DE5\u5177\u3002\u8FD9\u4E9B\u5DE5\u5177\u53EF\u80FD\u662F\u5F00\u6E90\u6216\u95ED\u6E90\u7684\uFF0C\u514D\u8D39\u6216\u5546\u4E1A\u7684\u3002\u5C3D\u7BA1\u8FD9\u4E9B\u5DE5\u5177\u53EF\u88AB\u5BF9\u624B\u7528\u4E8E\u6076\u610F\u76EE\u7684\uFF0C\u4F46\uFF08\u4E0E\u6076\u610F\u8F6F\u4EF6\u4E0D\u540C\uFF09\u5B83\u4EEC\u5E76\u975E\u4E3A\u6B64\u7C7B\u76EE\u7684\u800C\u8BBE\u8BA1\uFF08\u4F8B\u5982\uFF1APsExec\uFF09\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/002\/"},{"id":"T1588.003","name":"\u4EE3\u7801\u7B7E\u540D\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8D2D\u4E70\u548C\/\u6216\u7A83\u53D6\u4EE3\u7801\u7B7E\u540D\u8BC1\u4E66\uFF0C\u4EE5\u4FBF\u5728\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u4EE3\u7801\u7B7E\u540D\u662F\u6307\u5BF9\u53EF\u6267\u884C\u6587\u4EF6\u548C\u811A\u672C\u8FDB\u884C\u6570\u5B57\u7B7E\u540D\u7684\u8FC7\u7A0B\uFF0C\u4EE5\u786E\u8BA4\u8F6F\u4EF6\u4F5C\u8005\u8EAB\u4EFD\uFF0C\u5E76\u786E\u4FDD\u4EE3\u7801\u672A\u88AB\u7BE1\u6539\u6216\u635F\u574F\u3002\u4EE3\u7801\u7B7E\u540D\u4E3A\u5F00\u53D1\u8005\u63D0\u4F9B\u7684\u7A0B\u5E8F\u63D0\u4F9B\u4E86\u4E00\u5B9A\u7A0B\u5EA6\u7684\u771F\u5B9E\u6027\u4FDD\u8BC1\uFF0C\u5E76\u786E\u4FDD\u7A0B\u5E8F\u672A\u88AB\u7BE1\u6539\u3002\u7528\u6237\u548C\/\u6216\u5B89\u5168\u5DE5\u5177\u53EF\u80FD\u66F4\u4FE1\u4EFB\u7ECF\u8FC7\u7B7E\u540D\u7684\u4EE3\u7801\uFF0C\u800C\u4E0D\u662F\u672A\u7B7E\u540D\u7684\u4EE3\u7801\uFF0C\u5373\u4F7F\u4ED6\u4EEC\u4E0D\u77E5\u9053\u8BC1\u4E66\u7684\u9881\u53D1\u8005\u6216\u4F5C\u8005\u662F\u8C01\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/003\/"},{"id":"T1588.004","name":"\u6570\u5B57\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8D2D\u4E70\u548C\/\u6216\u7A83\u53D6SSL\/TLS\u8BC1\u4E66\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u4F7F\u7528\u3002SSL\/TLS\u8BC1\u4E66\u65E8\u5728\u5EFA\u7ACB\u4FE1\u4EFB\u3002\u5B83\u4EEC\u5305\u542B\u5BC6\u94A5\u4FE1\u606F\u3001\u6240\u6709\u8005\u8EAB\u4EFD\u4FE1\u606F\u4EE5\u53CA\u9A8C\u8BC1\u8BC1\u4E66\u5185\u5BB9\u6B63\u786E\u7684\u5B9E\u4F53\u7684\u6570\u5B57\u7B7E\u540D\u3002\u5982\u679C\u7B7E\u540D\u6709\u6548\uFF0C\u5E76\u4E14\u68C0\u67E5\u8BC1\u4E66\u7684\u4EBA\u4FE1\u4EFB\u7B7E\u540D\u8005\uFF0C\u90A3\u4E48\u4ED6\u4EEC\u5C31\u77E5\u9053\u53EF\u4EE5\u4F7F\u7528\u8BE5\u5BC6\u94A5\u4E0E\u5176\u6240\u6709\u8005\u8FDB\u884C\u901A\u4FE1\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/004\/"},{"id":"T1588.005","name":"\u6F0F\u6D1E\u5229\u7528","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8D2D\u4E70\u3001\u7A83\u53D6\u6216\u4E0B\u8F7D\u53EF\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u7684\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\u3002\u6F0F\u6D1E\u5229\u7528\u662F\u6307\u5229\u7528\u7A0B\u5E8F\u4E2D\u7684\u9519\u8BEF\u6216\u5B89\u5168\u7F3A\u9677\uFF0C\u5BFC\u81F4\u8BA1\u7B97\u673A\u786C\u4EF6\u6216\u8F6F\u4EF6\u51FA\u73B0\u975E\u9884\u671F\u6216\u610F\u5916\u7684\u884C\u4E3A\u3002\u653B\u51FB\u8005\u53EF\u80FD\u4E0D\u4F1A\u81EA\u884C\u5F00\u53D1\u6F0F\u6D1E\u5229\u7528\u7A0B\u5E8F\uFF0C\u800C\u662F\u4ECE\u7F51\u4E0A\u67E5\u627E\/\u4FEE\u6539\u6216\u4ECE\u6F0F\u6D1E\u5229\u7528\u4F9B\u5E94\u5546\u5904\u8D2D\u4E70\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/005\/"},{"id":"T1588.006","name":"\u6F0F\u6D1E","description":"\u5BF9\u624B\u53EF\u80FD\u83B7\u53D6\u5173\u4E8E\u6F0F\u6D1E\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u3002\u6F0F\u6D1E\u662F\u8BA1\u7B97\u673A\u786C\u4EF6\u6216\u8F6F\u4EF6\u4E2D\u7684\u5F31\u70B9\uFF0C\u53EF\u80FD\u88AB\u5BF9\u624B\u5229\u7528\uFF0C\u5BFC\u81F4\u53D1\u751F\u975E\u9884\u671F\u6216\u610F\u5916\u7684\u884C\u4E3A\u3002\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u641C\u7D22\u5F00\u653E\u6570\u636E\u5E93\u6216\u83B7\u53D6\u8BBF\u95EE\u5C01\u95ED\u6F0F\u6D1E\u6570\u636E\u5E93\u6765\u53D1\u73B0\u6F0F\u6D1E\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/006\/"},{"id":"T1588.007","name":"\u4EBA\u5DE5\u667A\u80FD","description":"\u5BF9\u624B\u53EF\u80FD\u83B7\u53D6\u751F\u6210\u5F0F\u4EBA\u5DE5\u667A\u80FD\u5DE5\u5177\uFF0C\u5982\u5927\u578B\u8BED\u8A00\u6A21\u578B\uFF08LLMs\uFF09\uFF0C\u4EE5\u5728\u76EE\u6807\u653B\u51FB\u8FC7\u7A0B\u4E2D\u8F85\u52A9\u591A\u79CD\u6280\u672F\u624B\u6BB5\u3002\u8FD9\u4E9B\u5DE5\u5177\u53EF\u7528\u4E8E\u652F\u6301\u3001\u589E\u5F3A\u5E76\u5B9E\u73B0\u5404\u7C7B\u6076\u610F\u4EFB\u52A1\uFF0C\u5305\u62EC\u5B9E\u65BD\u4FA6\u5BDF\u3001\u7F16\u5199\u57FA\u7840\u811A\u672C\u3001\u534F\u52A9\u793E\u4F1A\u5DE5\u7A0B\u653B\u51FB\uFF0C\u751A\u81F3\u5F00\u53D1\u6076\u610F\u8F7D\u8377\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/007\/"},{"id":"T1588","name":"\u83B7\u53D6\u80FD\u529B","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u548C\/\u6216\u7A83\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u7684\u80FD\u529B\u3002\u4E0E\u5176\u81EA\u884C\u5F00\u53D1\u80FD\u529B\uFF0C\u5BF9\u624B\u53EF\u80FD\u4F1A\u8D2D\u4E70\u3001\u514D\u8D39\u4E0B\u8F7D\u6216\u7A83\u53D6\u8FD9\u4E9B\u80FD\u529B\u3002\u8FD9\u4E9B\u6D3B\u52A8\u53EF\u80FD\u5305\u62EC\u83B7\u53D6\u6076\u610F\u8F6F\u4EF6\u3001\u8F6F\u4EF6\uFF08\u5305\u62EC\u8BB8\u53EF\u8BC1\uFF09\u3001\u6F0F\u6D1E\u5229\u7528\u5DE5\u5177\u3001\u8BC1\u4E66\u4EE5\u53CA\u6709\u5173\u6F0F\u6D1E\u7684\u4FE1\u606F\u3002\u5BF9\u624B\u53EF\u80FD\u4F1A\u83B7\u53D6\u80FD\u529B\uFF0C\u4EE5\u652F\u6301\u5176\u5728\u5BF9\u624B\u751F\u547D\u5468\u671F\u7684\u591A\u4E2A\u9636\u6BB5\u4E2D\u7684\u64CD\u4F5C\u3002","sub-techniques":"T1588.001, T1588.002, T1588.003, T1588.004, T1588.005, T1588.006, T1588.007","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1588\/"},{"id":"T1589.001","name":"\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u53EF\u7528\u7684\u51ED\u8BC1\u3002\u4ED6\u4EEC\u6536\u96C6\u7684\u8D26\u6237\u51ED\u8BC1\u53EF\u80FD\u76F4\u63A5\u4E0E\u76EE\u6807\u53D7\u5BB3\u7EC4\u7EC7\u76F8\u5173\uFF0C\u6216\u8BD5\u56FE\u5229\u7528\u7528\u6237\u503E\u5411\u4E8E\u5728\u4E2A\u4EBA\u548C\u5546\u4E1A\u8D26\u6237\u4E2D\u4F7F\u7528\u76F8\u540C\u5BC6\u7801\u7684\u4E60\u60EF\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1589\/001\/"},{"id":"T1589.002","name":"\u7535\u5B50\u90AE\u4EF6\u5730\u5740","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u53EF\u7528\u7684\u7535\u5B50\u90AE\u4EF6\u5730\u5740\u3002\u5373\u4F7F\u5B58\u5728\u5185\u90E8\u5B9E\u4F8B\uFF0C\u7EC4\u7EC7\u4E5F\u53EF\u80FD\u62E5\u6709\u9762\u5411\u516C\u4F17\u7684\u7535\u5B50\u90AE\u4EF6\u57FA\u7840\u8BBE\u65BD\u548C\u5458\u5DE5\u5730\u5740\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1589\/002\/"},{"id":"T1589.003","name":"\u5458\u5DE5\u59D3\u540D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u5458\u5DE5\u59D3\u540D\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u5458\u5DE5\u59D3\u540D\u4E0D\u4EC5\u53EF\u7528\u4E8E\u63A8\u5BFC\u7535\u5B50\u90AE\u4EF6\u5730\u5740\uFF0C\u8FD8\u80FD\u8F85\u52A9\u5176\u4ED6\u4FA6\u5BDF\u6D3B\u52A8\uFF0C\u6216\u5236\u4F5C\u66F4\u5177\u6B3A\u9A97\u6027\u7684\u8BF1\u9975\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1589\/003\/"},{"id":"T1589","name":"\u6536\u96C6\u53D7\u5BB3\u8005\u8EAB\u4EFD\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u8EAB\u4EFD\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u5B9A\u5411\u653B\u51FB\u3002\u8EAB\u4EFD\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u4E2A\u4EBA\u6570\u636E\uFF08\u4F8B\u5982\uFF1A\u5458\u5DE5\u59D3\u540D\u3001\u7535\u5B50\u90AE\u4EF6\u5730\u5740\u3001\u5B89\u5168\u95EE\u9898\u7B54\u6848\u7B49\uFF09\u4EE5\u53CA\u654F\u611F\u7EC6\u8282\uFF0C\u5982\u51ED\u8BC1\u6216\u591A\u56E0\u7D20\u8EAB\u4EFD\u9A8C\u8BC1\uFF08MFA\uFF09\u914D\u7F6E\u3002","sub-techniques":"T1589.001, T1589.002, T1589.003","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1589\/"},{"id":"T1590.001","name":"\u57DF\u540D\u5C5E\u6027","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7F51\u7EDC\u57DF\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u5173\u4E8E\u57DF\u540D\u53CA\u5176\u5C5E\u6027\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u62EC\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u53D7\u5BB3\u8005\u62E5\u6709\u7684\u57DF\u540D\u3001\u7BA1\u7406\u6570\u636E\uFF08\u5982\u540D\u79F0\u3001\u6CE8\u518C\u5546\u7B49\uFF09\uFF0C\u4EE5\u53CA\u66F4\u76F4\u63A5\u53EF\u64CD\u4F5C\u7684\u4FE1\u606F\uFF0C\u5982\u8054\u7CFB\u4EBA\uFF08\u7535\u5B50\u90AE\u4EF6\u5730\u5740\u548C\u7535\u8BDD\u53F7\u7801\uFF09\u3001\u5546\u4E1A\u5730\u5740\u548C\u540D\u79F0\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/001\/"},{"id":"T1590.002","name":"\u57DF\u540D\u7CFB\u7EDF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u53D7\u5BB3\u8005\u7684DNS\u4FE1\u606F\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u8FD9\u4E9BDNS\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u6CE8\u518C\u7684\u57DF\u540D\u670D\u52A1\u5668\uFF0C\u4EE5\u53CA\u8BB0\u5F55\u76EE\u6807\u5B50\u57DF\u540D\u3001\u90AE\u4EF6\u670D\u52A1\u5668\u548C\u5176\u4ED6\u4E3B\u673A\u5730\u5740\u7684\u8BB0\u5F55\u3002\u6B64\u5916\uFF0CDNS\u7684MX\u3001TXT\u548CSPF\u8BB0\u5F55\u4E5F\u53EF\u80FD\u63ED\u793A\u76EE\u6807\u662F\u5426\u4F7F\u7528\u4E86\u7B2C\u4E09\u65B9\u4E91\u670D\u52A1\u548CSaaS\u63D0\u4F9B\u5546\uFF0C\u5982Office 365\u3001G Suite\u3001Salesforce\u6216Zendesk\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/002\/"},{"id":"T1590.003","name":"\u7F51\u7EDC\u4FE1\u4EFB\u4F9D\u8D56","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7F51\u7EDC\u4FE1\u4EFB\u4F9D\u8D56\u5173\u7CFB\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u7F51\u7EDC\u4FE1\u4EFB\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u5DF2\u8FDE\u63A5\uFF08\u4E14\u53EF\u80FD\u5177\u6709\u63D0\u5347\u6743\u9650\uFF09\u7F51\u7EDC\u8BBF\u95EE\u6743\u9650\u7684\u7B2C\u4E8C\u65B9\u6216\u7B2C\u4E09\u65B9\u7EC4\u7EC7\/\u57DF\uFF08\u4F8B\u5982\uFF1A\u6258\u7BA1\u670D\u52A1\u63D0\u4F9B\u5546\u3001\u627F\u5305\u5546\u7B49\uFF09\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/003\/"},{"id":"T1590.004","name":"\u7F51\u7EDC\u62D3\u6251\u7ED3\u6784","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7F51\u7EDC\u62D3\u6251\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u7F51\u7EDC\u62D3\u6251\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u5916\u90E8\u548C\u5185\u90E8\u7F51\u7EDC\u73AF\u5883\u7684\u7269\u7406\u548C\/\u6216\u903B\u8F91\u5E03\u5C40\u3002\u6B64\u7C7B\u4FE1\u606F\u8FD8\u53EF\u80FD\u6D89\u53CA\u7F51\u7EDC\u8BBE\u5907\uFF08\u7F51\u5173\u3001\u8DEF\u7531\u5668\u7B49\uFF09\u53CA\u5176\u4ED6\u57FA\u7840\u8BBE\u65BD\u7684\u5177\u4F53\u914D\u7F6E\u60C5\u51B5\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/004\/"},{"id":"T1590.005","name":"IP\u5730\u5740","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u53D7\u5BB3\u8005\u7684IP\u5730\u5740\uFF0C\u8FD9\u4E9B\u5730\u5740\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u516C\u5171IP\u5730\u5740\u901A\u5E38\u6309\u533A\u5757\u6216\u8FDE\u7EED\u5730\u5740\u8303\u56F4\u5206\u914D\u7ED9\u7EC4\u7EC7\u3002\u5173\u4E8E\u5DF2\u5206\u914DIP\u5730\u5740\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u54EA\u4E9BIP\u5730\u5740\u6B63\u5728\u4F7F\u7528\u4E2D\u3002IP\u5730\u5740\u8FD8\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u63A8\u65AD\u51FA\u53D7\u5BB3\u8005\u7684\u5176\u4ED6\u4FE1\u606F\uFF0C\u5982\u7EC4\u7EC7\u89C4\u6A21\u3001\u7269\u7406\u4F4D\u7F6E\u3001\u4E92\u8054\u7F51\u670D\u52A1\u63D0\u4F9B\u5546\uFF0C\u4EE5\u53CA\u5176\u9762\u5411\u516C\u4F17\u7684\u57FA\u7840\u8BBE\u65BD\u6258\u7BA1\u7684\u5730\u70B9\u548C\u65B9\u5F0F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/005\/"},{"id":"T1590.006","name":"\u7F51\u7EDC\u5B89\u5168\u8BBE\u5907","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7F51\u7EDC\u5B89\u5168\u8BBE\u5907\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u653B\u51FB\u3002\u8FD9\u4E9B\u4FE1\u606F\u53EF\u80FD\u6DB5\u76D6\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u5DF2\u90E8\u7F72\u7684\u9632\u706B\u5899\u3001\u5185\u5BB9\u8FC7\u6EE4\u5668\u4EE5\u53CA\u4EE3\u7406\/\u5821\u5792\u4E3B\u673A\u7684\u5B58\u5728\u4E0E\u5177\u4F53\u914D\u7F6E\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u9488\u5BF9\u53D7\u5BB3\u8005\u7684\u7F51\u7EDC\u5165\u4FB5\u68C0\u6D4B\u7CFB\u7EDF\uFF08NIDS\uFF09\u6216\u5176\u4ED6\u4E0E\u9632\u5FA1\u6027\u7F51\u7EDC\u5B89\u5168\u64CD\u4F5C\u76F8\u5173\u7684\u8BBE\u5907\u4FE1\u606F\u8FDB\u884C\u641C\u96C6\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/006\/"},{"id":"T1590","name":"\u6536\u96C6\u53D7\u5BB3\u8005\u7F51\u7EDC\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7F51\u7EDC\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u7684\u653B\u51FB\u884C\u52A8\u3002\u7F51\u7EDC\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u7BA1\u7406\u6570\u636E\uFF08\u4F8B\u5982\uFF1AIP\u5730\u5740\u8303\u56F4\u3001\u57DF\u540D\u7B49\uFF09\u4EE5\u53CA\u5176\u62D3\u6251\u7ED3\u6784\u548C\u8FD0\u884C\u60C5\u51B5\u7684\u5177\u4F53\u4FE1\u606F\u3002","sub-techniques":"T1590.001, T1590.002, T1590.003, T1590.004, T1590.005, T1590.006","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1590\/"},{"id":"T1591.001","name":"\u786E\u5B9A\u7269\u7406\u4F4D\u7F6E","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6536\u96C6\u53D7\u5BB3\u8005\u7684\u7269\u7406\u4F4D\u7F6E\u4FE1\u606F\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u5173\u4E8E\u76EE\u6807\u7EC4\u7EC7\u7269\u7406\u4F4D\u7F6E\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u5173\u952E\u8D44\u6E90\u548C\u57FA\u7840\u8BBE\u65BD\u7684\u6240\u5728\u5730\u3002\u7269\u7406\u4F4D\u7F6E\u8FD8\u53EF\u80FD\u63ED\u793A\u53D7\u5BB3\u8005\u8FD0\u8425\u6240\u5904\u7684\u6CD5\u5F8B\u7BA1\u8F96\u533A\u57DF\u548C\/\u6216\u76F8\u5173\u6743\u529B\u673A\u6784\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1591\/001\/"},{"id":"T1591.002","name":"\u5546\u4E1A\u5173\u7CFB","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u4E1A\u52A1\u5173\u7CFB\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u5173\u4E8E\u7EC4\u7EC7\u4E1A\u52A1\u5173\u7CFB\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u62EC\u5404\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u62E5\u6709\u8FDE\u63A5\uFF08\u4E14\u53EF\u80FD\u5177\u6709\u63D0\u5347\u6743\u9650\uFF09\u7F51\u7EDC\u8BBF\u95EE\u6743\u9650\u7684\u7B2C\u4E8C\u65B9\u6216\u7B2C\u4E09\u65B9\u7EC4\u7EC7\/\u57DF\u540D\uFF08\u4F8B\u5982\uFF1A\u6258\u7BA1\u670D\u52A1\u63D0\u4F9B\u5546\u3001\u627F\u5305\u5546\u7B49\uFF09\u3002\u8FD9\u4E9B\u4FE1\u606F\u8FD8\u53EF\u80FD\u63ED\u793A\u53D7\u5BB3\u8005\u786C\u4EF6\u548C\u8F6F\u4EF6\u8D44\u6E90\u7684\u4F9B\u5E94\u94FE\u53CA\u8FD0\u8F93\u8DEF\u5F84\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1591\/002\/"},{"id":"T1591.003","name":"\u8BC6\u522B\u4E1A\u52A1\u8282\u594F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u4E1A\u52A1\u8282\u594F\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u5173\u4E8E\u7EC4\u7EC7\u4E1A\u52A1\u8282\u594F\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u62EC\u5404\u79CD\u7EC6\u8282\uFF0C\u5982\u6BCF\u5468\u7684\u8FD0\u8425\u65F6\u95F4\/\u5929\u6570\u3002\u8FD9\u4E9B\u4FE1\u606F\u8FD8\u53EF\u80FD\u63ED\u793A\u53D7\u5BB3\u8005\u786C\u4EF6\u548C\u8F6F\u4EF6\u8D44\u6E90\u7684\u91C7\u8D2D\u548C\u53D1\u8D27\u65F6\u95F4\/\u65E5\u671F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1591\/003\/"},{"id":"T1591.004","name":"\u786E\u5B9A\u89D2\u8272","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6536\u96C6\u53D7\u5BB3\u8005\u7EC4\u7EC7\u5185\u90E8\u7684\u8EAB\u4EFD\u548C\u89D2\u8272\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u5B9A\u5411\u653B\u51FB\u3002\u5173\u4E8E\u4E1A\u52A1\u89D2\u8272\u7684\u4FE1\u606F\u53EF\u80FD\u63ED\u793A\u591A\u79CD\u53EF\u88AB\u5229\u7528\u7684\u7EC6\u8282\uFF0C\u5305\u62EC\u5173\u952E\u4EBA\u5458\u7684\u53EF\u8BC6\u522B\u4FE1\u606F\u4EE5\u53CA\u4ED6\u4EEC\u80FD\u591F\u8BBF\u95EE\u7684\u6570\u636E\u6216\u8D44\u6E90\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1591\/004\/"},{"id":"T1591","name":"\u6536\u96C6\u53D7\u5BB3\u8005\u7EC4\u7EC7\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u7EC4\u7EC7\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u7684\u5B9A\u5411\u653B\u51FB\u3002\u5173\u4E8E\u7EC4\u7EC7\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u62EC\u591A\u79CD\u7EC6\u8282\uFF0C\u5982\u90E8\u95E8\u540D\u79F0\u3001\u4E1A\u52A1\u8FD0\u8425\u7684\u5177\u4F53\u60C5\u51B5\uFF0C\u4EE5\u53CA\u5173\u952E\u5458\u5DE5\u7684\u89D2\u8272\u548C\u804C\u8D23\u3002","sub-techniques":"T1591.001, T1591.002, T1591.003, T1591.004","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1591\/"},{"id":"T1592.001","name":"\u786C\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u53D7\u5BB3\u8005\u4E3B\u673A\u786C\u4EF6\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u653B\u51FB\u5B9A\u5411\u3002\u786C\u4EF6\u57FA\u7840\u8BBE\u65BD\u76F8\u5173\u4FE1\u606F\u53EF\u80FD\u6DB5\u76D6\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u7279\u5B9A\u4E3B\u673A\u4E0A\u7684\u8BBE\u5907\u7C7B\u578B\u4E0E\u7248\u672C\uFF0C\u4EE5\u53CA\u53EF\u80FD\u6697\u793A\u989D\u5916\u9632\u5FA1\u4FDD\u62A4\u63AA\u65BD\u5B58\u5728\u7684\u9644\u52A0\u7EC4\u4EF6\uFF08\u4F8B\u5982\uFF1A\u667A\u80FD\u5361\/\u751F\u7269\u8BC6\u522B\u8BFB\u5361\u5668\u3001\u4E13\u7528\u52A0\u5BC6\u786C\u4EF6\u7B49\uFF09\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1592\/001\/"},{"id":"T1592.002","name":"\u8F6F\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u4E3B\u673A\u8F6F\u4EF6\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u5B9A\u5411\u653B\u51FB\u3002\u5DF2\u5B89\u88C5\u8F6F\u4EF6\u7684\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u7279\u5B9A\u4E3B\u673A\u4E0A\u7684\u7C7B\u578B\u548C\u7248\u672C\uFF0C\u4EE5\u53CA\u53EF\u80FD\u8868\u660E\u5B58\u5728\u989D\u5916\u9632\u5FA1\u4FDD\u62A4\uFF08\u5982\u9632\u75C5\u6BD2\u8F6F\u4EF6\u3001SIEM\u7CFB\u7EDF\u7B49\uFF09\u7684\u9644\u52A0\u7EC4\u4EF6\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1592\/002\/"},{"id":"T1592.003","name":"\u56FA\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u4E3B\u673A\u56FA\u4EF6\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u653B\u51FB\u3002\u4E3B\u673A\u56FA\u4EF6\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u4F8B\u5982\u7279\u5B9A\u4E3B\u673A\u7684\u7C7B\u578B\u548C\u7248\u672C\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u63A8\u65AD\u73AF\u5883\u4E2D\u4E3B\u673A\u7684\u66F4\u591A\u60C5\u51B5\uFF08\u4F8B\u5982\uFF1A\u914D\u7F6E\u3001\u7528\u9014\u3001\u4F7F\u7528\u5E74\u9650\/\u8865\u4E01\u7EA7\u522B\u7B49\uFF09\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1592\/003\/"},{"id":"T1592.004","name":"\u5BA2\u6237\u7AEF\u914D\u7F6E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u5BA2\u6237\u7AEF\u914D\u7F6E\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u653B\u51FB\u3002\u5BA2\u6237\u7AEF\u914D\u7F6E\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\u548C\u8BBE\u7F6E\uFF0C\u5305\u62EC\u64CD\u4F5C\u7CFB\u7EDF\/\u7248\u672C\u3001\u865A\u62DF\u5316\u60C5\u51B5\u3001\u67B6\u6784\uFF08\u4F8B\u598232\u4F4D\u621664\u4F4D\uFF09\u3001\u8BED\u8A00\u548C\/\u6216\u65F6\u533A\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1592\/004\/"},{"id":"T1592","name":"\u6536\u96C6\u53D7\u5BB3\u8005\u4E3B\u673A\u4FE1\u606F","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u6536\u96C6\u6709\u5173\u53D7\u5BB3\u8005\u4E3B\u673A\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u540E\u7EED\u653B\u51FB\u3002\u4E3B\u673A\u4FE1\u606F\u53EF\u80FD\u5305\u62EC\u591A\u79CD\u7EC6\u8282\uFF0C\u65E2\u6709\u7BA1\u7406\u6570\u636E\uFF08\u4F8B\u5982\uFF1A\u540D\u79F0\u3001\u5206\u914D\u7684IP\u5730\u5740\u3001\u529F\u80FD\u7B49\uFF09\uFF0C\u4E5F\u6709\u5176\u914D\u7F6E\u7684\u5177\u4F53\u4FE1\u606F\uFF08\u4F8B\u5982\uFF1A\u64CD\u4F5C\u7CFB\u7EDF\u3001\u8BED\u8A00\u7B49\uFF09\u3002","sub-techniques":"T1592.001, T1592.002, T1592.003, T1592.004","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1592\/"},{"id":"T1593.001","name":"\u793E\u4EA4\u5A92\u4F53","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u793E\u4EA4\u5A92\u4F53\u4E0A\u641C\u7D22\u6709\u5173\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u793E\u4EA4\u5A92\u4F53\u7F51\u7AD9\u53EF\u80FD\u5305\u542B\u53D7\u5BB3\u7EC4\u7EC7\u7684\u5404\u79CD\u4FE1\u606F\uFF0C\u4F8B\u5982\u4E1A\u52A1\u516C\u544A\u4EE5\u53CA\u5458\u5DE5\u7684\u89D2\u8272\u3001\u4F4D\u7F6E\u548C\u5174\u8DA3\u7B49\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1593\/001\/"},{"id":"T1593.002","name":"\u641C\u7D22\u5F15\u64CE","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u641C\u7D22\u5F15\u64CE\u6536\u96C6\u5173\u4E8E\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u641C\u7D22\u5F15\u64CE\u670D\u52A1\u901A\u5E38\u901A\u8FC7\u722C\u53D6\u5728\u7EBF\u7F51\u7AD9\u6765\u7D22\u5F15\u5185\u5BB9\uFF0C\u5E76\u53EF\u80FD\u4E3A\u7528\u6237\u63D0\u4F9B\u4E13\u95E8\u7684\u8BED\u6CD5\u6765\u641C\u7D22\u7279\u5B9A\u5173\u952E\u8BCD\u6216\u7279\u5B9A\u7C7B\u578B\u7684\u5185\u5BB9\uFF08\u4F8B\u5982\u6587\u4EF6\u7C7B\u578B\uFF09\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1593\/002\/"},{"id":"T1593.003","name":"\u4EE3\u7801\u4ED3\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u516C\u5171\u4EE3\u7801\u4ED3\u5E93\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u9488\u5BF9\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\u3002\u53D7\u5BB3\u8005\u53EF\u80FD\u5C06\u4EE3\u7801\u5B58\u50A8\u5728\u8BF8\u5982GitHub\u3001GitLab\u3001SourceForge\u548CBitBucket\u7B49\u7B2C\u4E09\u65B9\u7F51\u7AD9\u7684\u4ED3\u5E93\u4E2D\u3002\u7528\u6237\u901A\u5E38\u901A\u8FC7Web\u5E94\u7528\u7A0B\u5E8F\u6216\u5982git\u7B49\u547D\u4EE4\u884C\u5DE5\u5177\u4E0E\u4EE3\u7801\u4ED3\u5E93\u8FDB\u884C\u4EA4\u4E92\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1593\/003\/"},{"id":"T1593","name":"\u641C\u7D22\u5F00\u653E\u7F51\u7AD9\/\u57DF\u540D","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u5728\u53EF\u81EA\u7531\u8BBF\u95EE\u7684\u7F51\u7AD9\u548C\/\u6216\u57DF\u540D\u4E2D\u641C\u7D22\u5173\u4E8E\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u5B9A\u4F4D\u8FC7\u7A0B\u4E2D\u4F7F\u7528\u3002\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\u53EF\u80FD\u51FA\u73B0\u5728\u5404\u79CD\u5728\u7EBF\u7AD9\u70B9\u4E0A\uFF0C\u4F8B\u5982\u793E\u4EA4\u5A92\u4F53\u3001\u65B0\u95FB\u7F51\u7AD9\uFF0C\u6216\u90A3\u4E9B\u53D1\u5E03\u4E1A\u52A1\u8FD0\u8425\u4FE1\u606F\u7684\u7F51\u7AD9\uFF0C\u5982\u62DB\u8058\u4FE1\u606F\u6216\u62DB\u6807\/\u4E2D\u6807\u5408\u540C\u3002","sub-techniques":"T1593.001, T1593.002, T1593.003","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1593\/"},{"id":"T1594","name":"\u641C\u7D22\u53D7\u5BB3\u8005\u62E5\u6709\u7684\u7F51\u7AD9","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u53D7\u5BB3\u8005\u62E5\u6709\u7684\u7F51\u7AD9\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u4FE1\u606F\u3002\u8FD9\u4E9B\u7F51\u7AD9\u53EF\u80FD\u5305\u542B\u5404\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u90E8\u95E8\/\u5206\u90E8\u7684\u540D\u79F0\u3001\u7269\u7406\u4F4D\u7F6E\u4EE5\u53CA\u5173\u952E\u5458\u5DE5\u7684\u6570\u636E\uFF0C\u5982\u59D3\u540D\u3001\u89D2\u8272\u548C\u8054\u7CFB\u4FE1\u606F\uFF08\u4F8B\u5982\uFF1A\u7535\u5B50\u90AE\u4EF6\u5730\u5740\uFF09\u3002\u8FD9\u4E9B\u7F51\u7AD9\u8FD8\u53EF\u80FD\u5305\u542B\u7A81\u51FA\u663E\u793A\u4E1A\u52A1\u8FD0\u8425\u548C\u5173\u7CFB\u7684\u8BE6\u7EC6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1594\/"},{"id":"T1595.001","name":"\u626B\u63CFIP\u5730\u5740\u5757","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u626B\u63CF\u53D7\u5BB3\u8005\u7684IP\u5730\u5740\u5757\uFF0C\u4EE5\u6536\u96C6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u4FE1\u606F\u3002\u516C\u5171IP\u5730\u5740\u901A\u5E38\u6309\u5757\u6216\u8FDE\u7EED\u5730\u5740\u8303\u56F4\u5206\u914D\u7ED9\u7EC4\u7EC7\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1595\/001\/"},{"id":"T1595.002","name":"\u6F0F\u6D1E\u626B\u63CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u626B\u63CF\u53D7\u5BB3\u8005\u7684\u6F0F\u6D1E\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u52A0\u4EE5\u5229\u7528\u3002\u6F0F\u6D1E\u626B\u63CF\u901A\u5E38\u68C0\u67E5\u76EE\u6807\u4E3B\u673A\u6216\u5E94\u7528\u7A0B\u5E8F\u7684\u914D\u7F6E\uFF08\u4F8B\u5982\u8F6F\u4EF6\u53CA\u5176\u7248\u672C\uFF09\uFF0C\u662F\u5426\u53EF\u80FD\u4E0E\u653B\u51FB\u8005\u8BD5\u56FE\u5229\u7528\u7684\u7279\u5B9A\u6F0F\u6D1E\u76EE\u6807\u76F8\u7B26\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1595\/002\/"},{"id":"T1595.003","name":"\u8BCD\u8868\u626B\u63CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u66B4\u529B\u7834\u89E3\u548C\u722C\u866B\u6280\u672F\u5BF9\u57FA\u7840\u8BBE\u65BD\u8FDB\u884C\u8FED\u4EE3\u63A2\u6D4B\u3002\u5C3D\u7BA1\u8BE5\u6280\u672F\u4E0E\u66B4\u529B\u7834\u89E3\u91C7\u7528\u76F8\u4F3C\u624B\u6BB5\uFF0C\u4F46\u5176\u76EE\u6807\u5728\u4E8E\u8BC6\u522B\u5185\u5BB9\u548C\u57FA\u7840\u8BBE\u65BD\uFF0C\u800C\u975E\u53D1\u73B0\u6709\u6548\u51ED\u636E\u3002\u6B64\u7C7B\u626B\u63CF\u6240\u4F7F\u7528\u7684\u8BCD\u8868\u53EF\u80FD\u5305\u542B\u901A\u7528\u7684\u5E38\u89C1\u540D\u79F0\u3001\u6587\u4EF6\u6269\u5C55\u540D\uFF0C\u6216\u9488\u5BF9\u7279\u5B9A\u8F6F\u4EF6\u7684\u672F\u8BED\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u5229\u7528\u5176\u4ED6\u4FA6\u5BDF\u6280\u672F\uFF08\u4F8B\u5982\uFF1A\u6536\u96C6\u53D7\u5BB3\u7EC4\u7EC7\u4FE1\u606F\u6216\u641C\u7D22\u53D7\u5BB3\u8005\u62E5\u6709\u7684\u7F51\u7AD9\uFF09\u83B7\u53D6\u7684\u6570\u636E\uFF0C\u521B\u5EFA\u5B9A\u5236\u5316\u7684\u9488\u5BF9\u6027\u8BCD\u8868\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1595\/003\/"},{"id":"T1595","name":"\u4E3B\u52A8\u626B\u63CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6267\u884C\u4E3B\u52A8\u4FA6\u5BDF\u626B\u63CF\uFF0C\u4EE5\u6536\u96C6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u4FE1\u606F\u3002\u4E3B\u52A8\u626B\u63CF\u662F\u6307\u653B\u51FB\u8005\u901A\u8FC7\u7F51\u7EDC\u6D41\u91CF\u63A2\u6D4B\u53D7\u5BB3\u8005\u57FA\u7840\u8BBE\u65BD\u7684\u884C\u4E3A\uFF0C\u8FD9\u4E0E\u4E0D\u6D89\u53CA\u76F4\u63A5\u4EA4\u4E92\u7684\u5176\u4ED6\u4FA6\u5BDF\u5F62\u5F0F\u5F62\u6210\u5BF9\u6BD4\u3002","sub-techniques":"T1595.001, T1595.002, T1595.003","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1595\/"},{"id":"T1596.001","name":"DNS\/\u88AB\u52A8DNS","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22DNS\u6570\u636E\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u53D7\u5BB3\u8005\u4FE1\u606F\u3002DNS\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u591A\u79CD\u7EC6\u8282\uFF0C\u5305\u62EC\u5DF2\u6CE8\u518C\u7684\u540D\u79F0\u670D\u52A1\u5668\uFF0C\u4EE5\u53CA\u6982\u8FF0\u76EE\u6807\u5B50\u57DF\u3001\u90AE\u4EF6\u670D\u52A1\u5668\u548C\u5176\u4ED6\u4E3B\u673A\u5730\u5740\u7684\u8BB0\u5F55\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/001\/"},{"id":"T1596.002","name":"WHOIS\uFF08\u53D1\u97F3\u4E3A\u201Cwho is\u201D\uFF09\u662F\u4E00\u79CD\u7528\u4E8E\u67E5\u8BE2\u4E92\u8054\u7F51\u57DF\u540D\u3001IP\u5730\u5740\u4EE5\u53CA\u76F8\u5173\u6CE8\u518C\u4FE1\u606F\u7684\u534F\u8BAE\u3002\u901A\u8FC7WHOIS\u670D\u52A1\uFF0C\u7528\u6237\u53EF\u4EE5\u83B7\u53D6\u57DF\u540D\u6240\u6709\u8005\u7684\u8054\u7CFB\u4FE1\u606F\u3001\u6CE8\u518C\u548C\u5230\u671F\u65E5\u671F\u3001\u57DF\u540D\u670D\u52A1\u5668\u8BE6\u60C5\u7B49\u6570\u636E\u3002\u8BE5\u534F\u8BAE\u5E7F\u6CDB\u5E94\u7528\u4E8E\u7F51\u7EDC\u7BA1\u7406\u3001\u7F51\u7EDC\u5B89\u5168\u8C03\u67E5\u4EE5\u53CA\u57DF\u540D\u4EA4\u6613\u7B49\u9886\u57DF\u3002","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u516C\u5F00\u7684WHOIS\u6570\u636E\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u53D7\u5BB3\u8005\u4FE1\u606F\u3002WHOIS\u6570\u636E\u7531\u8D1F\u8D23\u5206\u914D\u4E92\u8054\u7F51\u8D44\u6E90\uFF08\u5982\u57DF\u540D\uFF09\u7684\u533A\u57DF\u4E92\u8054\u7F51\u6CE8\u518C\u7BA1\u7406\u673A\u6784\uFF08RIR\uFF09\u5B58\u50A8\u3002\u4EFB\u4F55\u4EBA\u90FD\u53EF\u4EE5\u67E5\u8BE2WHOIS\u670D\u52A1\u5668\uFF0C\u83B7\u53D6\u6709\u5173\u5DF2\u6CE8\u518C\u57DF\u540D\u7684\u4FE1\u606F\uFF0C\u4F8B\u5982\u5206\u914D\u7684IP\u5730\u5740\u5757\u3001\u8054\u7CFB\u4FE1\u606F\u548CDNS\u540D\u79F0\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/002\/"},{"id":"T1596.003","name":"\u6570\u5B57\u8BC1\u4E66","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u641C\u7D22\u516C\u5171\u6570\u5B57\u8BC1\u4E66\u6570\u636E\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u53D7\u5BB3\u8005\u4FE1\u606F\u3002\u6570\u5B57\u8BC1\u4E66\u7531\u8BC1\u4E66\u9881\u53D1\u673A\u6784\uFF08CA\uFF09\u7B7E\u53D1\uFF0C\u7528\u4E8E\u52A0\u5BC6\u9A8C\u8BC1\u7B7E\u540D\u5185\u5BB9\u7684\u6765\u6E90\u3002\u8FD9\u4E9B\u8BC1\u4E66\uFF0C\u4F8B\u5982\u7528\u4E8E\u52A0\u5BC6\u7F51\u7EDC\u6D41\u91CF\uFF08HTTPS SSL\/TLS\u901A\u4FE1\uFF09\u7684\u8BC1\u4E66\uFF0C\u5305\u542B\u6CE8\u518C\u7EC4\u7EC7\u7684\u76F8\u5173\u4FE1\u606F\uFF0C\u5982\u540D\u79F0\u548C\u4F4D\u7F6E\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/003\/"},{"id":"T1596.004","name":"\u5185\u5BB9\u5206\u53D1\u7F51\u7EDC","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u5173\u4E8E\u53D7\u5BB3\u8005\u7684\u5185\u5BB9\u5206\u53D1\u7F51\u7EDC\uFF08CDN\uFF09\u6570\u636E\uFF0C\u8FD9\u4E9B\u6570\u636E\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002CDN\u5141\u8BB8\u7EC4\u7EC7\u901A\u8FC7\u5206\u5E03\u5F0F\u3001\u8D1F\u8F7D\u5747\u8861\u7684\u670D\u52A1\u5668\u9635\u5217\u6258\u7BA1\u5185\u5BB9\u3002CDN\u8FD8\u53EF\u80FD\u5141\u8BB8\u7EC4\u7EC7\u6839\u636E\u8BF7\u6C42\u8005\u7684\u5730\u7406\u4F4D\u7F6E\u5B9A\u5236\u5185\u5BB9\u5206\u53D1\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/004\/"},{"id":"T1596.005","name":"\u626B\u63CF\u6570\u636E\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u516C\u5171\u626B\u63CF\u6570\u636E\u5E93\u4E2D\u641C\u7D22\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u53D7\u5BB3\u8005\u4FE1\u606F\u3002\u5404\u79CD\u5728\u7EBF\u670D\u52A1\u6301\u7EED\u53D1\u5E03\u4E92\u8054\u7F51\u626B\u63CF\/\u8C03\u67E5\u7ED3\u679C\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u901A\u5E38\u5305\u62EC\u6D3B\u8DC3IP\u5730\u5740\u3001\u4E3B\u673A\u540D\u3001\u5F00\u653E\u7AEF\u53E3\u3001\u8BC1\u4E66\uFF0C\u751A\u81F3\u670D\u52A1\u5668\u6807\u8BC6\u7B49\u6570\u636E\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/005\/"},{"id":"T1596","name":"\u641C\u7D22\u5F00\u653E\u6280\u672F\u6570\u636E\u5E93","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u641C\u7D22\u516C\u5F00\u7684\u6280\u672F\u6570\u636E\u5E93\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u53D7\u5BB3\u8005\u4FE1\u606F\u3002\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\u53EF\u80FD\u5B58\u5728\u4E8E\u5728\u7EBF\u6570\u636E\u5E93\u548C\u5B58\u50A8\u5E93\u4E2D\uFF0C\u4F8B\u5982\u57DF\u540D\/\u8BC1\u4E66\u6CE8\u518C\u4FE1\u606F\uFF0C\u4EE5\u53CA\u4ECE\u6D41\u91CF\u548C\/\u6216\u626B\u63CF\u4E2D\u6536\u96C6\u7684\u7F51\u7EDC\u6570\u636E\/\u5DE5\u4EF6\u7684\u516C\u5171\u96C6\u5408\u3002","sub-techniques":"T1596.001, T1596.002, T1596.003, T1596.004, T1596.005","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1596\/"},{"id":"T1597.001","name":"\u5A01\u80C1\u60C5\u62A5\u4F9B\u5E94\u5546","description":"\u5BF9\u624B\u53EF\u80FD\u4F1A\u4ECE\u5A01\u80C1\u60C5\u62A5\u4F9B\u5E94\u5546\u5904\u641C\u7D22\u79C1\u4EBA\u6570\u636E\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u4FE1\u606F\u3002\u5A01\u80C1\u60C5\u62A5\u4F9B\u5E94\u5546\u53EF\u80FD\u63D0\u4F9B\u4ED8\u8D39\u4FE1\u606F\u6D41\u6216\u95E8\u6237\u7F51\u7AD9\uFF0C\u8FD9\u4E9B\u6E20\u9053\u63D0\u4F9B\u7684\u6570\u636E\u6BD4\u516C\u5F00\u62A5\u544A\u66F4\u4E3A\u8BE6\u5C3D\u3002\u5C3D\u7BA1\u654F\u611F\u7EC6\u8282\uFF08\u5982\u5BA2\u6237\u540D\u79F0\u548C\u5176\u4ED6\u6807\u8BC6\u7B26\uFF09\u53EF\u80FD\u88AB\u9690\u53BB\uFF0C\u4F46\u8FD9\u4E9B\u4FE1\u606F\u53EF\u80FD\u5305\u542B\u6709\u5173\u5B89\u5168\u6F0F\u6D1E\u7684\u8D8B\u52BF\uFF0C\u4F8B\u5982\u76EE\u6807\u884C\u4E1A\u3001\u5F52\u56E0\u58F0\u660E\u4EE5\u53CA\u6210\u529F\u7684\u6218\u672F\u3001\u6280\u672F\u548C\u7A0B\u5E8F\uFF08TTPs\uFF09\u6216\u5E94\u5BF9\u63AA\u65BD\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1597\/001\/"},{"id":"T1597.002","name":"\u8D2D\u4E70\u6280\u672F\u8D44\u6599","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u8D2D\u4E70\u6709\u5173\u53D7\u5BB3\u8005\u7684\u6280\u672F\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\u53EF\u80FD\u901A\u8FC7\u4FE1\u8A89\u826F\u597D\u7684\u79C1\u4EBA\u6765\u6E90\u548C\u6570\u636E\u5E93\u8D2D\u4E70\uFF0C\u4F8B\u5982\u626B\u63CF\u6570\u636E\u5E93\u6216\u5176\u4ED6\u6570\u636E\u805A\u5408\u670D\u52A1\u7684\u4ED8\u8D39\u8BA2\u9605\u3002\u653B\u51FB\u8005\u4E5F\u53EF\u80FD\u4ECE\u4FE1\u8A89\u8F83\u4F4E\u7684\u6765\u6E90\u8D2D\u4E70\u4FE1\u606F\uFF0C\u5982\u6697\u7F51\u6216\u7F51\u7EDC\u72AF\u7F6A\u9ED1\u5E02\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1597\/002\/"},{"id":"T1597","name":"\u641C\u7D22\u5C01\u95ED\u8D44\u6E90","description":"\u5BF9\u624B\u53EF\u80FD\u4ECE\u5C01\u95ED\uFF08\u4F8B\u5982\u4ED8\u8D39\u3001\u79C1\u6709\u6216\u975E\u514D\u8D39\u63D0\u4F9B\uFF09\u7684\u6765\u6E90\u4E2D\u641C\u7D22\u548C\u6536\u96C6\u5173\u4E8E\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u53D7\u5BB3\u8005\u7684\u4FE1\u606F\u53EF\u80FD\u53EF\u4EE5\u4ECE\u4FE1\u8A89\u826F\u597D\u7684\u79C1\u4EBA\u6765\u6E90\u548C\u6570\u636E\u5E93\u4E2D\u8D2D\u4E70\uFF0C\u4F8B\u5982\u6280\u672F\/\u5A01\u80C1\u60C5\u62A5\u6570\u636E\u7684\u4ED8\u8D39\u8BA2\u9605\u3002\u5BF9\u624B\u4E5F\u53EF\u80FD\u4ECE\u58F0\u8A89\u8F83\u4F4E\u7684\u6765\u6E90\u8D2D\u4E70\u4FE1\u606F\uFF0C\u5982\u6697\u7F51\u6216\u7F51\u7EDC\u72AF\u7F6A\u9ED1\u5E02\u3002","sub-techniques":"T1597.001, T1597.002","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1597\/"},{"id":"T1598.001","name":"\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u670D\u52A1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u7B2C\u4E09\u65B9\u670D\u52A1\u53D1\u9001\u9C7C\u53C9\u5F0F\u9493\u9C7C\u4FE1\u606F\uFF0C\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u654F\u611F\u4FE1\u606F\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u9493\u9C7C\u662F\u4E00\u79CD\u8BD5\u56FE\u8BF1\u9A97\u76EE\u6807\u6CC4\u9732\u4FE1\u606F\u7684\u884C\u4E3A\uFF0C\u901A\u5E38\u662F\u51ED\u8BC1\u6216\u5176\u4ED6\u53EF\u64CD\u4F5C\u4FE1\u606F\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u9493\u9C7C\u5E38\u6D89\u53CA\u793E\u4F1A\u5DE5\u7A0B\u6280\u672F\uFF0C\u4F8B\u5982\u4F2A\u88C5\u6210\u6709\u7406\u7531\u6536\u96C6\u4FE1\u606F\u7684\u6765\u6E90\uFF08\u4F8B\u5982\uFF1A\u5EFA\u7ACB\u8D26\u6237\u6216\u5165\u4FB5\u8D26\u6237\uFF09\u548C\/\u6216\u53D1\u9001\u591A\u6761\u770B\u4F3C\u7D27\u6025\u7684\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1598\/001\/"},{"id":"T1598.002","name":"\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u9644\u4EF6","description":"\u5BF9\u624B\u53EF\u80FD\u53D1\u9001\u5E26\u6709\u6076\u610F\u9644\u4EF6\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u4FE1\u606F\uFF0C\u4EE5\u8BF1\u53D6\u654F\u611F\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u653B\u51FB\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u662F\u4E00\u79CD\u8BD5\u56FE\u8BF1\u9A97\u76EE\u6807\u6CC4\u9732\u4FE1\u606F\u7684\u624B\u6BB5\uFF0C\u901A\u5E38\u662F\u51ED\u8BC1\u6216\u5176\u4ED6\u53EF\u64CD\u4F5C\u4FE1\u606F\u3002\u6B64\u7C7B\u653B\u51FB\u5E38\u91C7\u7528\u793E\u4F1A\u5DE5\u7A0B\u6280\u672F\uFF0C\u4F8B\u5982\u4F2A\u88C5\u6210\u6709\u7406\u7531\u6536\u96C6\u4FE1\u606F\u7684\u6765\u6E90\uFF08\u4F8B\u5982\uFF1A\u5EFA\u7ACB\u8D26\u6237\u6216\u5165\u4FB5\u8D26\u6237\uFF09\u548C\/\u6216\u53D1\u9001\u591A\u6761\u770B\u4F3C\u7D27\u6025\u7684\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1598\/002\/"},{"id":"T1598.003","name":"\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u94FE\u63A5","description":"\u5BF9\u624B\u53EF\u80FD\u53D1\u9001\u5E26\u6709\u6076\u610F\u94FE\u63A5\u7684\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u4FE1\u606F\uFF0C\u4EE5\u8BF1\u53D6\u654F\u611F\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u662F\u4E00\u79CD\u8BD5\u56FE\u8BF1\u9A97\u76EE\u6807\u6CC4\u9732\u4FE1\u606F\u7684\u884C\u4E3A\uFF0C\u901A\u5E38\u662F\u51ED\u636E\u6216\u5176\u4ED6\u53EF\u64CD\u4F5C\u4FE1\u606F\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u5E38\u6D89\u53CA\u793E\u4F1A\u5DE5\u7A0B\u6280\u672F\uFF0C\u4F8B\u5982\u4F2A\u88C5\u6210\u6709\u7406\u7531\u6536\u96C6\u4FE1\u606F\u7684\u6765\u6E90\uFF08\u4F8B\u5982\uFF1A\u5EFA\u7ACB\u8D26\u6237\u6216\u5165\u4FB5\u8D26\u6237\uFF09\u548C\/\u6216\u53D1\u9001\u591A\u6761\u770B\u4F3C\u7D27\u6025\u7684\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1598\/003\/"},{"id":"T1598.004","name":"\u9C7C\u53C9\u5F0F\u8BED\u97F3\u9493\u9C7C","description":"\u5BF9\u624B\u53EF\u80FD\u5229\u7528\u8BED\u97F3\u901A\u4FE1\u6765\u8BF1\u53D6\u654F\u611F\u4FE1\u606F\uFF0C\u8FD9\u4E9B\u4FE1\u606F\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u662F\u4E00\u79CD\u8BD5\u56FE\u8BF1\u9A97\u76EE\u6807\u6CC4\u9732\u4FE1\u606F\u7684\u5C1D\u8BD5\uFF0C\u901A\u5E38\u662F\u51ED\u8BC1\u6216\u5176\u4ED6\u53EF\u64CD\u4F5C\u4FE1\u606F\u3002\u4FE1\u606F\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u7ECF\u5E38\u6D89\u53CA\u793E\u4F1A\u5DE5\u7A0B\u6280\u672F\uFF0C\u4F8B\u5982\u5192\u5145\u6709\u7406\u7531\u6536\u96C6\u4FE1\u606F\u7684\u6765\u6E90\uFF08\u4F8B\u5982\uFF1A\u5192\u5145\u8EAB\u4EFD\uFF09\u548C\/\u6216\u5236\u9020\u63A5\u6536\u8005\u7684\u7D27\u8FEB\u611F\u6216\u8B66\u89C9\u611F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1598\/004\/"},{"id":"T1598","name":"\u4FE1\u606F\u9493\u9C7C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u53D1\u9001\u9493\u9C7C\u4FE1\u606F\u4EE5\u83B7\u53D6\u53EF\u7528\u4E8E\u76EE\u6807\u5B9A\u4F4D\u7684\u654F\u611F\u4FE1\u606F\u3002\u4FE1\u606F\u9493\u9C7C\u662F\u4E00\u79CD\u8BD5\u56FE\u8BF1\u9A97\u76EE\u6807\u6CC4\u9732\u4FE1\u606F\u7684\u884C\u4E3A\uFF0C\u901A\u5E38\u662F\u51ED\u8BC1\u6216\u5176\u4ED6\u53EF\u64CD\u4F5C\u4FE1\u606F\u3002\u4FE1\u606F\u9493\u9C7C\u4E0E\u666E\u901A\u9493\u9C7C\u7684\u533A\u522B\u5728\u4E8E\uFF0C\u5176\u76EE\u7684\u662F\u4ECE\u53D7\u5BB3\u8005\u90A3\u91CC\u6536\u96C6\u6570\u636E\uFF0C\u800C\u975E\u6267\u884C\u6076\u610F\u4EE3\u7801\u3002","sub-techniques":"T1598.001, T1598.002, T1598.003, T1598.004","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1598\/"},{"id":"T1599.001","name":"\u7F51\u7EDC\u5730\u5740\u8F6C\u6362\u7A7F\u8D8A","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u7F51\u7EDC\u8BBE\u5907\u7684\u7F51\u7EDC\u5730\u5740\u8F6C\u6362\uFF08NAT\uFF09\u914D\u7F6E\u6765\u8DE8\u8D8A\u7F51\u7EDC\u8FB9\u754C\u3002\u5BF9NAT\u7684\u6076\u610F\u4FEE\u6539\u53EF\u4F7F\u653B\u51FB\u8005\u7ED5\u8FC7\u6D41\u91CF\u8DEF\u7531\u9650\u5236\uFF0C\u4ECE\u800C\u7A81\u7834\u53EF\u4FE1\u4E0E\u4E0D\u53EF\u4FE1\u7F51\u7EDC\u4E4B\u95F4\u7684\u9694\u79BB\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1599\/001\/"},{"id":"T1599","name":"\u7F51\u7EDC\u8FB9\u754C\u6865\u63A5","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5165\u4FB5\u8FB9\u754C\u7F51\u7EDC\u8BBE\u5907\u6216\u8D1F\u8D23\u7F51\u7EDC\u5206\u6BB5\u7684\u5185\u90E8\u8BBE\u5907\u6765\u6865\u63A5\u7F51\u7EDC\u8FB9\u754C\u3002\u7A81\u7834\u8FD9\u4E9B\u8BBE\u5907\u53EF\u80FD\u4F7F\u653B\u51FB\u8005\u7ED5\u8FC7\u6D41\u91CF\u8DEF\u7531\u7684\u9650\u5236\uFF0C\u8FD9\u4E9B\u9650\u5236\u539F\u672C\u7528\u4E8E\u9694\u79BB\u53EF\u4FE1\u4E0E\u4E0D\u53EF\u4FE1\u7F51\u7EDC\u3002","sub-techniques":"T1599.001","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1599\/"},{"id":"T1600.001","name":"\u51CF\u5C11\u5BC6\u94A5\u7A7A\u95F4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u964D\u4F4E\u52A0\u5BC6\u901A\u4FE1\u7684\u5BC6\u7801\u5F3A\u5EA6\uFF0C\u6765\u51CF\u5C11\u89E3\u5BC6\u901A\u8FC7\u7F51\u7EDC\u4F20\u8F93\u6570\u636E\u6240\u9700\u7684\u5DE5\u4F5C\u91CF\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1600\/001\/"},{"id":"T1600.002","name":"\u7981\u7528\u52A0\u5BC6\u786C\u4EF6","description":"\u653B\u51FB\u8005\u7981\u7528\u7F51\u7EDC\u8BBE\u5907\u7684\u4E13\u7528\u786C\u4EF6\u52A0\u5BC6\u529F\u80FD\uFF0C\u6B64\u4E3E\u53EF\u80FD\u4F7F\u4ED6\u4EEC\u80FD\u591F\u5229\u7528\u8F6F\u4EF6\u52A0\u5BC6\u4E2D\u7684\u5F31\u70B9\uFF0C\u4ECE\u800C\u964D\u4F4E\u6536\u96C6\u3001\u7BE1\u6539\u548C\u7A83\u53D6\u4F20\u8F93\u6570\u636E\u6240\u9700\u7684\u5DE5\u4F5C\u91CF\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1600\/002\/"},{"id":"T1600","name":"\u524A\u5F31\u52A0\u5BC6","description":"\u5BF9\u624B\u53EF\u80FD\u7834\u574F\u7F51\u7EDC\u8BBE\u5907\u7684\u52A0\u5BC6\u529F\u80FD\uFF0C\u4EE5\u7ED5\u8FC7\u539F\u672C\u7528\u4E8E\u4FDD\u62A4\u6570\u636E\u901A\u4FE1\u7684\u52A0\u5BC6\u63AA\u65BD\u3002","sub-techniques":"T1600.001, T1600.002","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1600\/"},{"id":"T1601.001","name":"\u8865\u4E01\u7CFB\u7EDF\u6620\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u7F51\u7EDC\u8BBE\u5907\u7684\u64CD\u4F5C\u7CFB\u7EDF\uFF0C\u4EE5\u5F15\u5165\u65B0\u529F\u80FD\u6216\u524A\u5F31\u73B0\u6709\u9632\u5FA1\u3002\u67D0\u4E9B\u7F51\u7EDC\u8BBE\u5907\u91C7\u7528\u5355\u4F53\u67B6\u6784\u8BBE\u8BA1\uFF0C\u6574\u4E2A\u64CD\u4F5C\u7CFB\u7EDF\u53CA\u8BBE\u5907\u7684\u5927\u90E8\u5206\u529F\u80FD\u90FD\u96C6\u6210\u5728\u5355\u4E00\u6587\u4EF6\u4E2D\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5728\u5B58\u50A8\u4E2D\u66F4\u6539\u6B64\u6587\u4EF6\uFF0C\u4EE5\u4FBF\u5728\u4E0B\u6B21\u542F\u52A8\u65F6\u52A0\u8F7D\uFF0C\u6216\u5728\u8FD0\u884C\u65F6\u4E8E\u5185\u5B58\u4E2D\u76F4\u63A5\u4FEE\u6539\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1601\/001\/"},{"id":"T1601.002","name":"\u964D\u7EA7\u7CFB\u7EDF\u6620\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5728\u7F51\u7EDC\u8BBE\u5907\u4E0A\u5B89\u88C5\u65E7\u7248\u672C\u7684\u64CD\u4F5C\u7CFB\u7EDF\u4EE5\u524A\u5F31\u5B89\u5168\u6027\u3002\u7F51\u7EDC\u8BBE\u5907\u4E0A\u7684\u65E7\u7248\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u91C7\u7528\u8F83\u5F31\u7684\u52A0\u5BC6\u7B97\u6CD5\uFF0C\u5E76\u4E14\u6574\u4F53\u4E0A\u9632\u5FA1\u529F\u80FD\u66F4\u65B0\u8F83\u5C11\u6216\u8F83\u5F31\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1601\/002\/"},{"id":"T1601","name":"\u4FEE\u6539\u7CFB\u7EDF\u6620\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4FEE\u6539\u5D4C\u5165\u5F0F\u7F51\u7EDC\u8BBE\u5907\u7684\u64CD\u4F5C\u7CFB\u7EDF\uFF0C\u4EE5\u524A\u5F31\u5176\u9632\u5FA1\u80FD\u529B\uFF0C\u5E76\u4E3A\u81EA\u8EAB\u63D0\u4F9B\u65B0\u7684\u529F\u80FD\u3002\u8FD9\u7C7B\u8BBE\u5907\u7684\u64CD\u4F5C\u7CFB\u7EDF\u901A\u5E38\u662F\u5355\u4E00\u67B6\u6784\uFF0C\u8BBE\u5907\u7684\u5927\u90E8\u5206\u529F\u80FD\u548C\u80FD\u529B\u90FD\u96C6\u6210\u5728\u4E00\u4E2A\u6587\u4EF6\u4E2D\u3002","sub-techniques":"T1601.001, T1601.002","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1601\/"},{"id":"T1602.001","name":"SNMP\uFF08MIB\u8F6C\u50A8\uFF09","description":"\u653B\u51FB\u8005\u53EF\u80FD\u9488\u5BF9\u7BA1\u7406\u4FE1\u606F\u5E93\uFF08MIB\uFF09\u8FDB\u884C\u653B\u51FB\uFF0C\u4EE5\u6536\u96C6\u548C\/\u6216\u6316\u6398\u4F7F\u7528\u7B80\u5355\u7F51\u7EDC\u7BA1\u7406\u534F\u8BAE\uFF08SNMP\uFF09\u7BA1\u7406\u7684\u7F51\u7EDC\u4E2D\u7684\u6709\u4EF7\u503C\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1602\/001\/"},{"id":"T1602.002","name":"\u7F51\u7EDC\u8BBE\u5907\u914D\u7F6E\u8F6C\u50A8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8BBF\u95EE\u7F51\u7EDC\u914D\u7F6E\u6587\u4EF6\u6765\u6536\u96C6\u6709\u5173\u8BBE\u5907\u548C\u7F51\u7EDC\u7684\u654F\u611F\u6570\u636E\u3002\u7F51\u7EDC\u914D\u7F6E\u6587\u4EF6\u5305\u542B\u51B3\u5B9A\u8BBE\u5907\u8FD0\u884C\u53C2\u6570\u7684\u8BBE\u7F6E\u3002\u8BBE\u5907\u5728\u8FD0\u884C\u671F\u95F4\u901A\u5E38\u4F1A\u5728\u5185\u5B58\u4E2D\u4FDD\u5B58\u914D\u7F6E\u7684\u526F\u672C\uFF0C\u5E76\u5728\u975E\u6613\u5931\u6027\u5B58\u50A8\u5668\u4E2D\u5B58\u50A8\u72EC\u7ACB\u7684\u914D\u7F6E\uFF0C\u4EE5\u4FBF\u5728\u8BBE\u5907\u91CD\u7F6E\u540E\u52A0\u8F7D\u3002\u653B\u51FB\u8005\u53EF\u4EE5\u901A\u8FC7\u68C0\u67E5\u8FD9\u4E9B\u914D\u7F6E\u6587\u4EF6\uFF0C\u83B7\u53D6\u76EE\u6807\u7F51\u7EDC\u53CA\u5176\u5E03\u5C40\u3001\u7F51\u7EDC\u8BBE\u5907\u53CA\u5176\u8F6F\u4EF6\u4FE1\u606F\uFF0C\u6216\u8BC6\u522B\u51FA\u5408\u6CD5\u7684\u8D26\u6237\u548C\u51ED\u636E\u4EE5\u4F9B\u540E\u7EED\u5229\u7528\u3002","sub-techniques":"","tactic":"\u6536\u85CF","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1602\/002\/"},{"id":"T1602","name":"\u914D\u7F6E\u5B58\u50A8\u5E93\u6570\u636E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4ECE\u914D\u7F6E\u5B58\u50A8\u5E93\u4E2D\u6536\u96C6\u4E0E\u6258\u7BA1\u8BBE\u5907\u76F8\u5173\u7684\u6570\u636E\u3002\u914D\u7F6E\u5B58\u50A8\u5E93\u88AB\u7BA1\u7406\u7CFB\u7EDF\u7528\u4E8E\u914D\u7F6E\u3001\u7BA1\u7406\u548C\u63A7\u5236\u8FDC\u7A0B\u7CFB\u7EDF\u4E0A\u7684\u6570\u636E\u3002\u914D\u7F6E\u5B58\u50A8\u5E93\u8FD8\u53EF\u80FD\u4FC3\u8FDB\u8BBE\u5907\u7684\u8FDC\u7A0B\u8BBF\u95EE\u548C\u7BA1\u7406\u3002","sub-techniques":"T1602.001, T1602.002","tactic":"\u6536\u85CF","platforms":"\u7F51\u7EDC\u8BBE\u5907","permalink":"https:\/\/attack.mitre.org\/techniques\/T1602\/"},{"id":"T1606.001","name":"\u7F51\u7EDCCookie","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F2A\u9020\u7F51\u7EDCCookie\uFF0C\u7528\u4EE5\u83B7\u53D6\u5BF9\u7F51\u7EDC\u5E94\u7528\u7A0B\u5E8F\u6216\u4E92\u8054\u7F51\u670D\u52A1\u7684\u8BBF\u95EE\u6743\u9650\u3002\u7F51\u7EDC\u5E94\u7528\u7A0B\u5E8F\u548C\u670D\u52A1\uFF08\u6258\u7BA1\u5728\u4E91SaaS\u73AF\u5883\u6216\u672C\u5730\u670D\u52A1\u5668\u4E0A\uFF09\u901A\u5E38\u4F7F\u7528\u4F1A\u8BDDCookie\u6765\u9A8C\u8BC1\u548C\u6388\u6743\u7528\u6237\u8BBF\u95EE\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1606\/001\/"},{"id":"T1606.002","name":"SAML\u4EE4\u724C","description":"\u653B\u51FB\u8005\u82E5\u6301\u6709\u6709\u6548\u7684SAML\u4EE4\u724C\u7B7E\u540D\u8BC1\u4E66\uFF0C\u4FBF\u53EF\u4F2A\u9020\u5177\u6709\u4EFB\u610F\u6743\u9650\u58F0\u660E\u548C\u6709\u6548\u671F\u7684SAML\u4EE4\u724C\u3002SAML\u4EE4\u724C\u7684\u9ED8\u8BA4\u6709\u6548\u671F\u4E3A1\u5C0F\u65F6\uFF0C\u4F46\u5176\u6709\u6548\u671F\u53EF\u901A\u8FC7\u4EE4\u724C\u4E2D\u6761\u4EF6...\u5143\u7D20\u7684NotOnOrAfter\u503C\u8FDB\u884C\u8BBE\u5B9A\u3002\u8BE5\u503C\u53EF\u901A\u8FC7LifetimeTokenPolicy\u4E2D\u7684AccessTokenLifetime\u8FDB\u884C\u8C03\u6574\u3002\u4F2A\u9020\u7684SAML\u4EE4\u724C\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u5728\u91C7\u7528SAML 2.0\u4F5C\u4E3A\u5355\u70B9\u767B\u5F55\uFF08SSO\uFF09\u673A\u5236\u7684\u670D\u52A1\u95F4\u8FDB\u884C\u8EAB\u4EFD\u9A8C\u8BC1\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1606\/002\/"},{"id":"T1606","name":"\u4F2A\u9020\u7F51\u7EDC\u51ED\u8BC1","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F2A\u9020\u53EF\u7528\u4E8E\u8BBF\u95EE\u7F51\u7EDC\u5E94\u7528\u7A0B\u5E8F\u6216\u4E92\u8054\u7F51\u670D\u52A1\u7684\u51ED\u8BC1\u6750\u6599\u3002\u7F51\u7EDC\u5E94\u7528\u7A0B\u5E8F\u548C\u670D\u52A1\uFF08\u6258\u7BA1\u5728\u4E91SaaS\u73AF\u5883\u6216\u672C\u5730\u670D\u52A1\u5668\u4E0A\uFF09\u901A\u5E38\u4F7F\u7528\u4F1A\u8BDDcookie\u3001\u4EE4\u724C\u6216\u5176\u4ED6\u6750\u6599\u6765\u9A8C\u8BC1\u548C\u6388\u6743\u7528\u6237\u8BBF\u95EE\u3002","sub-techniques":"T1606.001, T1606.002","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1606\/"},{"id":"T1608.001","name":"\u4E0A\u4F20\u6076\u610F\u8F6F\u4EF6","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u6076\u610F\u8F6F\u4EF6\u4E0A\u4F20\u81F3\u7B2C\u4E09\u65B9\u6216\u7531\u653B\u51FB\u8005\u63A7\u5236\u7684\u57FA\u7840\u8BBE\u65BD\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u80FD\u591F\u8BBF\u95EE\u3002\u6076\u610F\u8F6F\u4EF6\u53EF\u5305\u542B\u6709\u6548\u8F7D\u8377\u3001\u6295\u653E\u5668\u3001\u5165\u4FB5\u540E\u5DE5\u5177\u3001\u540E\u95E8\u7A0B\u5E8F\u4EE5\u53CA\u5176\u4ED6\u591A\u79CD\u6076\u610F\u5185\u5BB9\u3002\u653B\u51FB\u8005\u4E0A\u4F20\u6076\u610F\u8F6F\u4EF6\u65E8\u5728\u652F\u6301\u5176\u64CD\u4F5C\uFF0C\u4F8B\u5982\u5C06\u6709\u6548\u8F7D\u8377\u7F6E\u4E8E\u53EF\u901A\u8FC7\u4E92\u8054\u7F51\u8BBF\u95EE\u7684Web\u670D\u52A1\u5668\u4E0A\uFF0C\u4F7F\u5176\u5BF9\u53D7\u5BB3\u7F51\u7EDC\u53EF\u7528\uFF0C\u4ECE\u800C\u5B9E\u73B0\u5165\u4FB5\u5DE5\u5177\u4F20\u8F93\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/001\/"},{"id":"T1608.002","name":"\u4E0A\u4F20\u5DE5\u5177","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u5DE5\u5177\u4E0A\u4F20\u81F3\u7B2C\u4E09\u65B9\u6216\u7531\u653B\u51FB\u8005\u63A7\u5236\u7684\u57FA\u7840\u8BBE\u65BD\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u80FD\u591F\u8BBF\u95EE\u8FD9\u4E9B\u5DE5\u5177\u3002\u8FD9\u4E9B\u5DE5\u5177\u53EF\u4EE5\u662F\u5F00\u6E90\u6216\u95ED\u6E90\u7684\uFF0C\u514D\u8D39\u6216\u5546\u4E1A\u7684\u3002\u867D\u7136\u8FD9\u4E9B\u5DE5\u5177\u53EF\u80FD\u88AB\u653B\u51FB\u8005\u7528\u4E8E\u6076\u610F\u76EE\u7684\uFF08\u4F8B\u5982PsExec\uFF09\uFF0C\u4F46\uFF08\u4E0E\u6076\u610F\u8F6F\u4EF6\u4E0D\u540C\uFF09\u5B83\u4EEC\u672C\u8EAB\u5E76\u975E\u4E3A\u6B64\u7C7B\u76EE\u7684\u800C\u8BBE\u8BA1\u3002\u653B\u51FB\u8005\u4E0A\u4F20\u5DE5\u5177\u65E8\u5728\u652F\u6301\u5176\u64CD\u4F5C\uFF0C\u4F8B\u5982\u5C06\u5DE5\u5177\u653E\u7F6E\u5728\u53EF\u516C\u5F00\u8BBF\u95EE\u7684\u7F51\u7EDC\u670D\u52A1\u5668\u4E0A\uFF0C\u4F7F\u5176\u5728\u53D7\u5BB3\u7F51\u7EDC\u4E2D\u53EF\u7528\uFF0C\u4ECE\u800C\u4FBF\u4E8E\u8FDB\u884C\u5DE5\u5177\u4F20\u8F93\u5165\u4FB5\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/002\/"},{"id":"T1608.003","name":"\u5B89\u88C5\u6570\u5B57\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5B89\u88C5SSL\/TLS\u8BC1\u4E66\uFF0C\u4EE5\u4FBF\u5728\u76EE\u6807\u653B\u51FB\u4E2D\u4F7F\u7528\u3002SSL\/TLS\u8BC1\u4E66\u662F\u53EF\u5728\u670D\u52A1\u5668\u4E0A\u5B89\u88C5\u7684\u6587\u4EF6\uFF0C\u7528\u4E8E\u5B9E\u73B0\u7CFB\u7EDF\u95F4\u7684\u5B89\u5168\u901A\u4FE1\u3002\u6570\u5B57\u8BC1\u4E66\u5305\u542B\u5BC6\u94A5\u4FE1\u606F\u3001\u6240\u6709\u8005\u8EAB\u4EFD\u4FE1\u606F\u4EE5\u53CA\u9A8C\u8BC1\u8BC1\u4E66\u5185\u5BB9\u6B63\u786E\u7684\u5B9E\u4F53\u6570\u5B57\u7B7E\u540D\u3002\u5982\u679C\u7B7E\u540D\u6709\u6548\uFF0C\u4E14\u68C0\u67E5\u8BC1\u4E66\u7684\u4EBA\u4FE1\u4EFB\u7B7E\u540D\u8005\uFF0C\u90A3\u4E48\u4ED6\u4EEC\u5C31\u77E5\u9053\u53EF\u4EE5\u4F7F\u7528\u8BE5\u5BC6\u94A5\u4E0E\u6240\u6709\u8005\u8FDB\u884C\u5B89\u5168\u901A\u4FE1\u3002\u8BC1\u4E66\u53EF\u4EE5\u4E0A\u4F20\u5230\u670D\u52A1\u5668\uFF0C\u7136\u540E\u914D\u7F6E\u670D\u52A1\u5668\u4F7F\u7528\u8BE5\u8BC1\u4E66\u4EE5\u542F\u7528\u52A0\u5BC6\u901A\u4FE1\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/003\/"},{"id":"T1608.004","name":"\u8DEF\u8FC7\u76EE\u6807","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u51C6\u5907\u4E00\u4E2A\u64CD\u4F5C\u73AF\u5883\uFF0C\u6765\u611F\u67D3\u5728\u6B63\u5E38\u6D4F\u89C8\u8FC7\u7A0B\u4E2D\u8BBF\u95EE\u7279\u5B9A\u7F51\u7AD9\u7684\u7CFB\u7EDF\u3002\u7EC8\u7AEF\u7CFB\u7EDF\u53EF\u80FD\u56E0\u6D4F\u89C8\u53D7\u653B\u51FB\u8005\u63A7\u5236\u7684\u7F51\u7AD9\u800C\u906D\u5230\u5165\u4FB5\uFF0C\u8FD9\u79CD\u60C5\u51B5\u7C7B\u4F3C\u4E8E\u201C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u201D\u653B\u51FB\u3002\u5728\u6B64\u7C7B\u653B\u51FB\u4E2D\uFF0C\u7528\u6237\u7F51\u9875\u6D4F\u89C8\u5668\u901A\u5E38\u662F\u4E3B\u8981\u7684\u5229\u7528\u76EE\u6807\uFF08\u901A\u5E38\u4E00\u65E6\u8BBF\u95EE\u8BE5\u7F51\u7AD9\uFF0C\u65E0\u9700\u7528\u6237\u989D\u5916\u4EA4\u4E92\u5373\u53EF\u89E6\u53D1\uFF09\uFF0C\u4F46\u653B\u51FB\u8005\u4E5F\u53EF\u80FD\u8BBE\u7ACB\u7F51\u7AD9\u7528\u4E8E\u975E\u5229\u7528\u6027\u884C\u4E3A\uFF0C\u4F8B\u5982\u83B7\u53D6\u5E94\u7528\u7A0B\u5E8F\u8BBF\u95EE\u4EE4\u724C\u3002\u5728\u5B9E\u65BD\u201C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u201D\u653B\u51FB\u4E4B\u524D\uFF0C\u653B\u51FB\u8005\u5FC5\u987B\u9884\u5148\u90E8\u7F72\u5FC5\u8981\u7684\u8D44\u6E90\uFF0C\u4EE5\u4FBF\u5411\u6D4F\u89C8\u5176\u63A7\u5236\u7F51\u7AD9\u7684\u7528\u6237\u4F20\u9012\u6F0F\u6D1E\u5229\u7528\u4EE3\u7801\u3002\u8FD9\u4E9B\u7528\u4E8E\u201C\u8DEF\u8FC7\u5F0F\u4E0B\u8F7D\u201D\u7684\u5185\u5BB9\u53EF\u4EE5\u90E8\u7F72\u5728\u653B\u51FB\u8005\u901A\u8FC7\u8D2D\u4E70\uFF08\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF09\u6216\u5148\u524D\u5165\u4FB5\uFF08\u5165\u4FB5\u57FA\u7840\u8BBE\u65BD\uFF09\u6240\u63A7\u5236\u7684\u670D\u52A1\u5668\u4E0A\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/004\/"},{"id":"T1608.005","name":"\u94FE\u63A5\u76EE\u6807","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u90E8\u7F72\u901A\u8FC7\u94FE\u63A5\u5F15\u7528\u7684\u8D44\u6E90\uFF0C\u8FD9\u4E9B\u94FE\u63A5\u53EF\u5728\u5B9A\u5411\u653B\u51FB\u4E2D\u4F7F\u7528\u3002\u653B\u51FB\u8005\u53EF\u80FD\u4F9D\u8D56\u7528\u6237\u70B9\u51FB\u6076\u610F\u94FE\u63A5\u6765\u6CC4\u9732\u4FE1\u606F\uFF08\u5305\u62EC\u51ED\u8BC1\uFF09\u6216\u83B7\u53D6\u6267\u884C\u6743\u9650\uFF0C\u5982\u6076\u610F\u94FE\u63A5\u653B\u51FB\u6240\u793A\u3002\u94FE\u63A5\u53EF\u7528\u4E8E\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\uFF0C\u4F8B\u5982\u53D1\u9001\u9644\u5E26\u793E\u4F1A\u5DE5\u7A0B\u5B66\u6587\u672C\u7684\u7535\u5B50\u90AE\u4EF6\uFF0C\u8BF1\u4F7F\u7528\u6237\u4E3B\u52A8\u70B9\u51FB\u6216\u5C06URL\u590D\u5236\u7C98\u8D34\u5230\u6D4F\u89C8\u5668\u4E2D\u3002\u5728\u8FDB\u884C\u4FE1\u606F\u9493\u9C7C\uFF08\u5982\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u94FE\u63A5\uFF09\u6216\u4E3A\u83B7\u53D6\u7CFB\u7EDF\u521D\u59CB\u8BBF\u95EE\u6743\u9650\u7684\u9493\u9C7C\u653B\u51FB\uFF08\u5982\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u94FE\u63A5\uFF09\u4E4B\u524D\uFF0C\u653B\u51FB\u8005\u5FC5\u987B\u4E3A\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\u94FE\u63A5\u8BBE\u7F6E\u94FE\u63A5\u76EE\u6807\u8D44\u6E90\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/005\/"},{"id":"T1608.006","name":"SEO\u6295\u6BD2","description":"\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u6C61\u67D3\u5F71\u54CD\u641C\u7D22\u5F15\u64CE\u4F18\u5316\uFF08SEO\uFF09\u7684\u673A\u5236\uFF0C\u8FDB\u4E00\u6B65\u8BF1\u5BFC\u6F5C\u5728\u53D7\u5BB3\u8005\u63A5\u89E6\u9884\u8BBE\u7684\u6076\u610F\u529F\u80FD\u3002\u641C\u7D22\u5F15\u64CE\u901A\u5E38\u6839\u636E\u8D2D\u4E70\u7684\u5E7F\u544A\u4EE5\u53CA\u5176\u7F51\u7EDC\u722C\u866B\u548C\u7B97\u6CD5\u8BA1\u7B97\u7684\u7F51\u7AD9\u6392\u540D\/\u8BC4\u5206\/\u58F0\u8A89\u5411\u7528\u6237\u5C55\u793A\u7ED3\u679C\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/006\/"},{"id":"T1608","name":"\u821E\u53F0\u80FD\u529B","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u4E0A\u4F20\u3001\u5B89\u88C5\u6216\u4EE5\u5176\u4ED6\u65B9\u5F0F\u8BBE\u7F6E\u53EF\u5728\u76EE\u6807\u653B\u51FB\u671F\u95F4\u4F7F\u7528\u7684\u80FD\u529B\u3002\u4E3A\u652F\u6301\u5176\u884C\u52A8\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u9700\u8981\u5C06\u5DF2\u5F00\u53D1\uFF08\u5F00\u53D1\u80FD\u529B\uFF09\u6216\u83B7\u53D6\uFF08\u83B7\u53D6\u80FD\u529B\uFF09\u7684\u80FD\u529B\u90E8\u7F72\u5230\u5176\u63A7\u5236\u7684\u57FA\u7840\u8BBE\u65BD\u4E0A\u3002\u8FD9\u4E9B\u80FD\u529B\u53EF\u80FD\u88AB\u90E8\u7F72\u5728\u653B\u51FB\u8005\u5148\u524D\u8D2D\u4E70\/\u79DF\u7528\u7684\u57FA\u7840\u8BBE\u65BD\uFF08\u83B7\u53D6\u57FA\u7840\u8BBE\u65BD\uFF09\u4E0A\uFF0C\u6216\u662F\u88AB\u5176\u653B\u9677\u7684\u57FA\u7840\u8BBE\u65BD\uFF08\u653B\u9677\u57FA\u7840\u8BBE\u65BD\uFF09\u4E0A\u3002\u80FD\u529B\u4E5F\u53EF\u80FD\u88AB\u90E8\u7F72\u5728\u8BF8\u5982GitHub\u6216Pastebin\u7B49\u7F51\u7EDC\u670D\u52A1\u4E0A\uFF0C\u6216\u662F\u5E73\u53F0\u5373\u670D\u52A1\uFF08PaaS\uFF09\u4EA7\u54C1\u4E0A\uFF0C\u8FD9\u4E9B\u670D\u52A1\u4F7F\u7528\u6237\u80FD\u591F\u8F7B\u677E\u914D\u7F6E\u5E94\u7528\u7A0B\u5E8F\u3002","sub-techniques":"T1608.001, T1608.002, T1608.003, T1608.004, T1608.005, T1608.006","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1608\/"},{"id":"T1609","name":"\u5BB9\u5668\u7BA1\u7406\u547D\u4EE4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u5BB9\u5668\u7BA1\u7406\u670D\u52A1\u5728\u5BB9\u5668\u5185\u6267\u884C\u547D\u4EE4\u3002\u8BF8\u5982Docker\u5B88\u62A4\u8FDB\u7A0B\u3001Kubernetes API\u670D\u52A1\u5668\u6216kubelet\u7B49\u5BB9\u5668\u7BA1\u7406\u670D\u52A1\uFF0C\u53EF\u80FD\u5141\u8BB8\u8FDC\u7A0B\u7BA1\u7406\u73AF\u5883\u4E2D\u7684\u5BB9\u5668\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1609\/"},{"id":"T1610","name":"\u90E8\u7F72\u5BB9\u5668","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u73AF\u5883\u4E2D\u90E8\u7F72\u5BB9\u5668\u4EE5\u4FC3\u8FDB\u6267\u884C\u6216\u89C4\u907F\u9632\u5FA1\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u90E8\u7F72\u65B0\u5BB9\u5668\u6765\u6267\u884C\u4E0E\u7279\u5B9A\u955C\u50CF\u6216\u90E8\u7F72\u76F8\u5173\u7684\u8FDB\u7A0B\uFF0C\u4F8B\u5982\u6267\u884C\u6216\u4E0B\u8F7D\u6076\u610F\u8F6F\u4EF6\u7684\u8FDB\u7A0B\u3002\u5728\u5176\u4ED6\u60C5\u51B5\u4E0B\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u90E8\u7F72\u672A\u914D\u7F6E\u7F51\u7EDC\u89C4\u5219\u3001\u7528\u6237\u9650\u5236\u7B49\u7684\u65B0\u5BB9\u5668\uFF0C\u4EE5\u7ED5\u8FC7\u73AF\u5883\u4E2D\u7684\u73B0\u6709\u9632\u5FA1\u3002\u5728Kubernetes\u73AF\u5883\u4E2D\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u5C06\u7279\u6743\u6216\u6613\u53D7\u653B\u51FB\u7684\u5BB9\u5668\u90E8\u7F72\u5230\u7279\u5B9A\u8282\u70B9\uFF0C\u4EE5\u4FBF\u9003\u9038\u5230\u4E3B\u673A\u5E76\u8BBF\u95EE\u5728\u8BE5\u8282\u70B9\u4E0A\u8FD0\u884C\u7684\u5176\u4ED6\u5BB9\u5668\u3002","sub-techniques":"","tactic":"\u6267\u884C,\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1610\/"},{"id":"T1611","name":"\u9003\u5F80\u4E1C\u9053\u56FD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7A81\u7834\u5BB9\u5668\u6216\u865A\u62DF\u5316\u73AF\u5883\uFF0C\u4EE5\u83B7\u53D6\u5BF9\u5E95\u5C42\u4E3B\u673A\u7684\u8BBF\u95EE\u6743\u9650\u3002\u8FD9\u4F7F\u653B\u51FB\u8005\u80FD\u591F\u4ECE\u4E3B\u673A\u5C42\u9762\u8BBF\u95EE\u5176\u4ED6\u5BB9\u5668\u5316\u6216\u865A\u62DF\u5316\u8D44\u6E90\uFF0C\u751A\u81F3\u76F4\u63A5\u63A7\u5236\u4E3B\u673A\u672C\u8EAB\u3002\u539F\u5219\u4E0A\uFF0C\u5BB9\u5668\u5316\/\u865A\u62DF\u5316\u8D44\u6E90\u5E94\u63D0\u4F9B\u6E05\u6670\u7684\u5E94\u7528\u7A0B\u5E8F\u529F\u80FD\u5206\u79BB\uFF0C\u5E76\u4E0E\u4E3B\u673A\u73AF\u5883\u4FDD\u6301\u9694\u79BB\u3002","sub-techniques":"","tactic":"\u6743\u9650\u63D0\u5347","platforms":"\u5BB9\u5668,ESXi,Linux,Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1611\/"},{"id":"T1612","name":"\u5728\u4E3B\u673A\u4E0A\u6784\u5EFA\u955C\u50CF","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u76F4\u63A5\u5728\u4E3B\u673A\u4E0A\u6784\u5EFA\u5BB9\u5668\u955C\u50CF\uFF0C\u4EE5\u7ED5\u8FC7\u90A3\u4E9B\u76D1\u63A7\u4ECE\u516C\u5171\u6CE8\u518C\u8868\u83B7\u53D6\u6076\u610F\u955C\u50CF\u7684\u9632\u5FA1\u673A\u5236\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5411Docker API\u53D1\u9001\u8FDC\u7A0B\u6784\u5EFA\u8BF7\u6C42\uFF0C\u5176\u4E2D\u5305\u542B\u4E00\u4E2ADockerfile\uFF0C\u8BE5\u6587\u4EF6\u4F1A\u4ECE\u516C\u5171\u6216\u672C\u5730\u6CE8\u518C\u8868\u62C9\u53D6\u4E00\u4E2A\u7EAF\u51C0\u7684\u57FA\u7840\u955C\u50CF\uFF08\u4F8B\u5982alpine\uFF09\uFF0C\u7136\u540E\u5728\u6B64\u57FA\u7840\u4E0A\u6784\u5EFA\u81EA\u5B9A\u4E49\u955C\u50CF\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1612\/"},{"id":"T1613","name":"\u5BB9\u5668\u4E0E\u8D44\u6E90\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u53D1\u73B0\u5BB9\u5668\u73AF\u5883\u4E2D\u53EF\u7528\u7684\u5BB9\u5668\u53CA\u5176\u4ED6\u8D44\u6E90\u3002\u5176\u4ED6\u8D44\u6E90\u53EF\u80FD\u5305\u62EC\u955C\u50CF\u3001\u90E8\u7F72\u3001Pod\u3001\u8282\u70B9\u4EE5\u53CA\u96C6\u7FA4\u72B6\u6001\u7B49\u5176\u4ED6\u4FE1\u606F\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u5BB9\u5668","permalink":"https:\/\/attack.mitre.org\/techniques\/T1613\/"},{"id":"T1614.001","name":"\u7CFB\u7EDF\u8BED\u8A00\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u6536\u96C6\u53D7\u5BB3\u8005\u7684\u7CFB\u7EDF\u8BED\u8A00\u4FE1\u606F\uFF0C\u4EE5\u63A8\u65AD\u8BE5\u4E3B\u673A\u7684\u5B9E\u9645\u5730\u7406\u4F4D\u7F6E\u3002\u6B64\u7C7B\u60C5\u62A5\u53EF\u7528\u4E8E\u89C4\u5212\u540E\u7EED\u653B\u51FB\u884C\u4E3A\uFF0C\u5305\u62EC\u662F\u5426\u5BF9\u76EE\u6807\u5B9E\u65BD\u611F\u67D3\u6216\u5C1D\u8BD5\u7279\u5B9A\u64CD\u4F5C\u3002\u6076\u610F\u8F6F\u4EF6\u5F00\u53D1\u8005\u4E0E\u8FD0\u8425\u8005\u5E38\u91C7\u7528\u8FD9\u79CD\u7B56\u7565\uFF0C\u4EE5\u964D\u4F4E\u5F15\u8D77\u7279\u5B9A\u6267\u6CD5\u673A\u6784\u6CE8\u610F\u6216\u906D\u53D7\u5176\u4ED6\u5B9E\u4F53\u8FFD\u67E5\/\u5BA1\u67E5\u7684\u98CE\u9669\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1614\/001\/"},{"id":"T1614","name":"\u7CFB\u7EDF\u4F4D\u7F6E\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u6536\u96C6\u4FE1\u606F\u6765\u5C1D\u8BD5\u8BA1\u7B97\u53D7\u5BB3\u4E3B\u673A\u7684\u7269\u7406\u4F4D\u7F6E\u3002\u5728\u81EA\u52A8\u5316\u63A2\u6D4B\u8FC7\u7A0B\u4E2D\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5229\u7528\u7CFB\u7EDF\u4F4D\u7F6E\u53D1\u73B0\u6240\u83B7\u5F97\u7684\u4FE1\u606F\u6765\u8C03\u6574\u540E\u7EED\u884C\u52A8\u7B56\u7565\uFF0C\u5305\u62EC\u51B3\u5B9A\u662F\u5426\u5BF9\u76EE\u6807\u5B9E\u65BD\u5168\u9762\u611F\u67D3\u53CA\u5C1D\u8BD5\u7279\u5B9A\u64CD\u4F5C\u3002","sub-techniques":"T1614.001","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1614\/"},{"id":"T1615","name":"\u7EC4\u7B56\u7565\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6536\u96C6\u7EC4\u7B56\u7565\u8BBE\u7F6E\u4FE1\u606F\uFF0C\u4EE5\u8BC6\u522B\u6743\u9650\u63D0\u5347\u8DEF\u5F84\u3001\u57DF\u5185\u5E94\u7528\u7684\u5B89\u5168\u63AA\u65BD\uFF0C\u5E76\u53D1\u73B0\u53EF\u88AB\u64CD\u7EB5\u6216\u7528\u4E8E\u5728\u73AF\u5883\u4E2D\u9690\u853D\u7684\u57DF\u5BF9\u8C61\u6A21\u5F0F\u3002\u7EC4\u7B56\u7565\u5141\u8BB8\u5728\u6D3B\u52A8\u76EE\u5F55\uFF08AD\uFF09\u4E2D\u96C6\u4E2D\u7BA1\u7406\u7528\u6237\u548C\u8BA1\u7B97\u673A\u8BBE\u7F6E\u3002\u7EC4\u7B56\u7565\u5BF9\u8C61\uFF08GPO\uFF09\u662F\u7EC4\u7B56\u7565\u8BBE\u7F6E\u7684\u5BB9\u5668\uFF0C\u7531\u5B58\u50A8\u5728\u53EF\u9884\u6D4B\u7F51\u7EDC\u8DEF\u5F84<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\\u4E2D\u7684\u6587\u4EF6\u6784\u6210\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1615\/"},{"id":"T1619","name":"\u4E91\u5B58\u50A8\u5BF9\u8C61\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u679A\u4E3E\u4E91\u5B58\u50A8\u57FA\u7840\u8BBE\u65BD\u4E2D\u7684\u5BF9\u8C61\u3002\u4ED6\u4EEC\u53EF\u80FD\u5728\u81EA\u52A8\u5316\u53D1\u73B0\u8FC7\u7A0B\u4E2D\u5229\u7528\u8FD9\u4E9B\u4FE1\u606F\u6765\u89C4\u5212\u540E\u7EED\u884C\u4E3A\uFF0C\u5305\u62EC\u4ECE\u4E91\u5B58\u50A8\u8BF7\u6C42\u5168\u90E8\u6216\u7279\u5B9A\u5BF9\u8C61\u3002\u7C7B\u4F3C\u4E8E\u672C\u5730\u4E3B\u673A\u4E0A\u7684\u6587\u4EF6\u548C\u76EE\u5F55\u53D1\u73B0\uFF0C\u5728\u8BC6\u522B\u51FA\u53EF\u7528\u7684\u5B58\u50A8\u670D\u52A1\uFF08\u5373\u4E91\u57FA\u7840\u8BBE\u65BD\u53D1\u73B0\uFF09\u540E\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u8BBF\u95EE\u5B58\u50A8\u5728\u4E91\u57FA\u7840\u8BBE\u65BD\u4E2D\u7684\u5185\u5BB9\u6216\u5BF9\u8C61\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1619\/"},{"id":"T1620","name":"\u53CD\u5C04\u5F0F\u4EE3\u7801\u52A0\u8F7D","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5C06\u4EE3\u7801\u53CD\u5C04\u5F0F\u52A0\u8F7D\u5230\u8FDB\u7A0B\u4E2D\uFF0C\u4EE5\u9690\u85CF\u6076\u610F\u8F7D\u8377\u7684\u6267\u884C\u3002\u53CD\u5C04\u5F0F\u52A0\u8F7D\u6D89\u53CA\u5728\u8FDB\u7A0B\u5185\u5B58\u4E2D\u76F4\u63A5\u5206\u914D\u5E76\u6267\u884C\u8F7D\u8377\uFF0C\u800C\u4E0D\u662F\u901A\u8FC7\u78C1\u76D8\u4E0A\u7684\u6587\u4EF6\u8DEF\u5F84\uFF08\u4F8B\u5982\u5171\u4EAB\u6A21\u5757\uFF09\u521B\u5EFA\u7EBF\u7A0B\u6216\u8FDB\u7A0B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1620\/"},{"id":"T1621","name":"\u591A\u56E0\u7D20\u8BA4\u8BC1\u8BF7\u6C42\u751F\u6210","description":"\u653B\u51FB\u8005\u53EF\u80FD\u8BD5\u56FE\u901A\u8FC7\u751F\u6210\u53D1\u9001\u7ED9\u7528\u6237\u7684\u591A\u56E0\u7D20\u8BA4\u8BC1\uFF08MFA\uFF09\u8BF7\u6C42\uFF0C\u6765\u7ED5\u8FC7MFA\u673A\u5236\u5E76\u83B7\u53D6\u8D26\u6237\u8BBF\u95EE\u6743\u9650\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1621\/"},{"id":"T1622","name":"\u8C03\u8BD5\u5668\u89C4\u907F","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u591A\u79CD\u624B\u6BB5\u6765\u68C0\u6D4B\u548C\u89C4\u907F\u8C03\u8BD5\u5668\u3002\u8C03\u8BD5\u5668\u901A\u5E38\u88AB\u9632\u5FA1\u8005\u7528\u4E8E\u8FFD\u8E2A\u548C\/\u6216\u5206\u6790\u6F5C\u5728\u6076\u610F\u8F6F\u4EF6\u8D1F\u8F7D\u7684\u6267\u884C\u8FC7\u7A0B\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F,\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1622\/"},{"id":"T1647","name":"Plist \u6587\u4EF6\u4FEE\u6539","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4FEE\u6539\u5C5E\u6027\u5217\u8868\u6587\u4EF6\uFF08plist\u6587\u4EF6\uFF09\u4EE5\u542F\u7528\u5176\u4ED6\u6076\u610F\u6D3B\u52A8\uFF0C\u540C\u65F6\u53EF\u80FD\u89C4\u907F\u548C\u7ED5\u8FC7\u7CFB\u7EDF\u9632\u5FA1\u3002macOS\u5E94\u7528\u7A0B\u5E8F\u4F7F\u7528plist\u6587\u4EF6\uFF08\u5982info.plist\u6587\u4EF6\uFF09\u6765\u5B58\u50A8\u5C5E\u6027\u548C\u914D\u7F6E\u8BBE\u7F6E\uFF0C\u8FD9\u4E9B\u8BBE\u7F6E\u544A\u77E5\u64CD\u4F5C\u7CFB\u7EDF\u5728\u8FD0\u884C\u65F6\u5982\u4F55\u5904\u7406\u5E94\u7528\u7A0B\u5E8F\u3002Plist\u6587\u4EF6\u662F\u57FA\u4E8E\u82F9\u679C\u6838\u5FC3\u57FA\u7840DTD\u4EE5XML\u683C\u5F0F\u7EC4\u7EC7\u7684\u952E\u503C\u5BF9\u7ED3\u6784\u5316\u5143\u6570\u636E\u3002Plist\u6587\u4EF6\u53EF\u4EE5\u4FDD\u5B58\u4E3A\u6587\u672C\u6216\u4E8C\u8FDB\u5236\u683C\u5F0F\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1647\/"},{"id":"T1648","name":"\u65E0\u670D\u52A1\u5668\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u65E0\u670D\u52A1\u5668\u8BA1\u7B97\u3001\u96C6\u6210\u548C\u81EA\u52A8\u5316\u670D\u52A1\uFF0C\u5728\u4E91\u73AF\u5883\u4E2D\u6267\u884C\u4EFB\u610F\u4EE3\u7801\u3002\u8BB8\u591A\u4E91\u670D\u52A1\u63D0\u4F9B\u5546\u63D0\u4F9B\u591A\u79CD\u65E0\u670D\u52A1\u5668\u8D44\u6E90\uFF0C\u5305\u62EC\u8BA1\u7B97\u5F15\u64CE\u3001\u5E94\u7528\u96C6\u6210\u670D\u52A1\u548C\u7F51\u7EDC\u670D\u52A1\u5668\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1648\/"},{"id":"T1649","name":"\u7A83\u53D6\u6216\u4F2A\u9020\u8EAB\u4EFD\u9A8C\u8BC1\u8BC1\u4E66","description":"\u653B\u51FB\u8005\u53EF\u80FD\u7A83\u53D6\u6216\u4F2A\u9020\u7528\u4E8E\u8BA4\u8BC1\u7684\u8BC1\u4E66\uFF0C\u4EE5\u8BBF\u95EE\u8FDC\u7A0B\u7CFB\u7EDF\u6216\u8D44\u6E90\u3002\u6570\u5B57\u8BC1\u4E66\u901A\u5E38\u7528\u4E8E\u7B7E\u540D\u548C\u52A0\u5BC6\u6D88\u606F\u53CA\/\u6216\u6587\u4EF6\uFF0C\u540C\u65F6\u4E5F\u4F5C\u4E3A\u8EAB\u4EFD\u9A8C\u8BC1\u6750\u6599\u4F7F\u7528\u3002\u4F8B\u5982\uFF0CEntra ID\u8BBE\u5907\u8BC1\u4E66\u548CActive Directory\u8BC1\u4E66\u670D\u52A1\uFF08AD CS\uFF09\u8BC1\u4E66\u4E0E\u8EAB\u4EFD\u7ED1\u5B9A\uFF0C\u53EF\u4F5C\u4E3A\u57DF\u8D26\u6237\u7684\u51ED\u636E\u3002","sub-techniques":"","tactic":"\u51ED\u8BC1\u8BBF\u95EE","platforms":"\u8EAB\u4EFD\u63D0\u4F9B\u8005,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1649\/"},{"id":"T1650","name":"\u83B7\u53D6\u8BBF\u95EE\u6743\u9650","description":"\u5BF9\u624B\u53EF\u80FD\u8D2D\u4E70\u6216\u4EE5\u5176\u4ED6\u65B9\u5F0F\u83B7\u53D6\u5BF9\u76EE\u6807\u7CFB\u7EDF\u6216\u7F51\u7EDC\u7684\u73B0\u6709\u8BBF\u95EE\u6743\u9650\u3002\u5404\u79CD\u5728\u7EBF\u670D\u52A1\u548C\u521D\u59CB\u8BBF\u95EE\u4EE3\u7406\u7F51\u7EDC\u53EF\u63D0\u4F9B\u5148\u524D\u88AB\u5165\u4FB5\u7CFB\u7EDF\u7684\u8BBF\u95EE\u6743\u9650\u51FA\u552E\u3002\u5728\u67D0\u4E9B\u60C5\u51B5\u4E0B\uFF0C\u654C\u5BF9\u56E2\u4F53\u53EF\u80FD\u7ED3\u6210\u4F19\u4F34\u5173\u7CFB\uFF0C\u76F8\u4E92\u5171\u4EAB\u88AB\u5165\u4FB5\u7684\u7CFB\u7EDF\u3002","sub-techniques":"","tactic":"\u8D44\u6E90\u5F00\u53D1","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1650\/"},{"id":"T1651","name":"\u4E91\u7BA1\u7406\u547D\u4EE4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528\u4E91\u7BA1\u7406\u670D\u52A1\u5728\u865A\u62DF\u673A\u5185\u6267\u884C\u547D\u4EE4\u3002\u8BF8\u5982AWS Systems Manager\u3001Azure RunCommand\u548CRunbooks\u7B49\u8D44\u6E90\u5141\u8BB8\u7528\u6237\u901A\u8FC7\u5229\u7528\u5DF2\u5B89\u88C5\u7684\u865A\u62DF\u673A\u4EE3\u7406\uFF0C\u8FDC\u7A0B\u5728\u865A\u62DF\u673A\u4E2D\u8FD0\u884C\u811A\u672C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1651\/"},{"id":"T1652","name":"\u8BBE\u5907\u9A71\u52A8\u7A0B\u5E8F\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5C1D\u8BD5\u679A\u4E3E\u53D7\u5BB3\u4E3B\u673A\u4E0A\u7684\u672C\u5730\u8BBE\u5907\u9A71\u52A8\u7A0B\u5E8F\u3002\u8BBE\u5907\u9A71\u52A8\u7A0B\u5E8F\u7684\u4FE1\u606F\u53EF\u80FD\u63ED\u793A\u591A\u79CD\u5173\u952E\u4FE1\u606F\uFF0C\u4ECE\u800C\u5F71\u54CD\u540E\u7EED\u653B\u51FB\u884C\u4E3A\uFF0C\u4F8B\u5982\u4E3B\u673A\u7684\u529F\u80FD\u6216\u7528\u9014\u3001\u5F53\u524D\u7684\u5B89\u5168\u5DE5\u5177\uFF08\u5373\u5B89\u5168\u8F6F\u4EF6\u53D1\u73B0\uFF09\u6216\u5176\u4ED6\u9632\u5FA1\u63AA\u65BD\uFF08\u4F8B\u5982\u865A\u62DF\u5316\/\u6C99\u7BB1\u89C4\u907F\uFF09\uFF0C\u4EE5\u53CA\u6F5C\u5728\u7684\u53EF\u5229\u7528\u6F0F\u6D1E\uFF08\u4F8B\u5982\u7528\u4E8E\u6743\u9650\u63D0\u5347\u7684\u6F0F\u6D1E\u5229\u7528\uFF09\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1652\/"},{"id":"T1653","name":"\u7535\u6E90\u8BBE\u7F6E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u524A\u5F31\u7CFB\u7EDF\u7684\u4F11\u7720\u3001\u91CD\u542F\u6216\u5173\u673A\u80FD\u529B\uFF0C\u4EE5\u5EF6\u957F\u5BF9\u53D7\u611F\u67D3\u673A\u5668\u7684\u8BBF\u95EE\u6743\u9650\u3002\u5F53\u8BA1\u7B97\u673A\u8FDB\u5165\u4F11\u7720\u72B6\u6001\u65F6\uFF0C\u90E8\u5206\u6216\u5168\u90E8\u8F6F\u786C\u4EF6\u53EF\u80FD\u505C\u6B62\u8FD0\u884C\uFF0C\u8FD9\u4F1A\u5E72\u6270\u6076\u610F\u6D3B\u52A8\u7684\u8FDB\u884C\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1653\/"},{"id":"T1654","name":"\u65E5\u5FD7\u679A\u4E3E","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u679A\u4E3E\u7CFB\u7EDF\u548C\u670D\u52A1\u7684\u65E5\u5FD7\u6765\u5BFB\u627E\u6709\u7528\u6570\u636E\u3002\u8FD9\u4E9B\u65E5\u5FD7\u53EF\u80FD\u63ED\u793A\u5BF9\u653B\u51FB\u8005\u5177\u6709\u4EF7\u503C\u7684\u5404\u7C7B\u4FE1\u606F\uFF0C\u4F8B\u5982\u7528\u6237\u8EAB\u4EFD\u9A8C\u8BC1\u8BB0\u5F55\uFF08\u8D26\u6237\u53D1\u73B0\uFF09\u3001\u5B89\u5168\u6216\u6613\u53D7\u653B\u51FB\u7684\u8F6F\u4EF6\uFF08\u8F6F\u4EF6\u53D1\u73B0\uFF09\uFF0C\u6216\u662F\u53D7\u611F\u67D3\u7F51\u7EDC\u5185\u7684\u4E3B\u673A\uFF08\u8FDC\u7A0B\u7CFB\u7EDF\u53D1\u73B0\uFF09\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1654\/"},{"id":"T1656","name":"\u5192\u5145","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5192\u5145\u53EF\u4FE1\u7684\u4E2A\u4EBA\u6216\u7EC4\u7EC7\uFF0C\u4EE5\u8BF4\u670D\u5E76\u8BF1\u9A97\u76EE\u6807\u4EE3\u8868\u4ED6\u4EEC\u6267\u884C\u67D0\u4E9B\u64CD\u4F5C\u3002\u4F8B\u5982\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u5192\u5145\u5DF2\u77E5\u53D1\u4EF6\u4EBA\uFF08\u5982\u9AD8\u7BA1\u3001\u540C\u4E8B\u6216\u7B2C\u4E09\u65B9\u4F9B\u5E94\u5546\uFF09\u7684\u540C\u65F6\u4E0E\u53D7\u5BB3\u8005\u8FDB\u884C\u901A\u4FE1\uFF08\u901A\u8FC7\u4FE1\u606F\u9493\u9C7C\u3001\u7F51\u7EDC\u9493\u9C7C\u6216\u5185\u90E8\u9C7C\u53C9\u5F0F\u7F51\u7EDC\u9493\u9C7C\uFF09\u3002\u968F\u540E\uFF0C\u53EF\u4EE5\u5229\u7528\u5DF2\u5EFA\u7ACB\u7684\u4FE1\u4EFB\u6765\u5B9E\u73B0\u653B\u51FB\u8005\u7684\u6700\u7EC8\u76EE\u6807\uFF0C\u53EF\u80FD\u9488\u5BF9\u591A\u4E2A\u53D7\u5BB3\u8005\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1656\/"},{"id":"T1657","name":"\u91D1\u878D\u76D7\u7A83","description":"\u5BF9\u624B\u53EF\u80FD\u901A\u8FC7\u52D2\u7D22\u3001\u793E\u4F1A\u5DE5\u7A0B\u3001\u6280\u672F\u76D7\u7A83\u6216\u5176\u4ED6\u624B\u6BB5\uFF0C\u4ECE\u76EE\u6807\u5904\u7A83\u53D6\u8D44\u91D1\u8D44\u6E90\uFF0C\u65E8\u5728\u727A\u7272\u53D7\u5BB3\u8005\u7684\u8D44\u6E90\u53EF\u7528\u6027\u6765\u83B7\u53D6\u81EA\u8EAB\u7ECF\u6D4E\u5229\u76CA\u3002\u91D1\u878D\u76D7\u7A83\u662F\u591A\u79CD\u6D41\u884C\u653B\u51FB\u6D3B\u52A8\u7684\u6700\u7EC8\u76EE\u6807\uFF0C\u5305\u62EC\u52D2\u7D22\u8F6F\u4EF6\u6572\u8BC8\u3001\u5546\u52A1\u7535\u90AE\u5165\u4FB5\u4E0E\u6B3A\u8BC8\u3001\"\u6740\u732A\u76D8\"\u8BC8\u9A97\u3001\u94F6\u884C\u7CFB\u7EDF\u5165\u4FB5\u4EE5\u53CA\u52A0\u5BC6\u8D27\u5E01\u7F51\u7EDC\u6F0F\u6D1E\u5229\u7528\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1657\/"},{"id":"T1659","name":"\u5185\u5BB9\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5728\u7EBF\u7F51\u7EDC\u6D41\u91CF\u5411\u7CFB\u7EDF\u6CE8\u5165\u6076\u610F\u5185\u5BB9\uFF0C\u4ECE\u800C\u83B7\u53D6\u8BBF\u95EE\u6743\u9650\u5E76\u4E0E\u53D7\u5BB3\u8005\u6301\u7EED\u901A\u4FE1\u3002\u4E0E\u8BF1\u4F7F\u53D7\u5BB3\u8005\u8BBF\u95EE\u6258\u7BA1\u5728\u53D7\u611F\u67D3\u7F51\u7AD9\u4E0A\u7684\u6076\u610F\u8D1F\u8F7D\uFF08\u5373\u901A\u8FC7\"\u8DEF\u8FC7\u5F0F\u76EE\u6807\"\u540E\u63A5\"\u8DEF\u8FC7\u5F0F\u5165\u4FB5\"\uFF09\u4E0D\u540C\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u9996\u5148\u901A\u8FC7\u53D7\u635F\u7684\u6570\u636E\u4F20\u8F93\u901A\u9053\u8BBF\u95EE\u53D7\u5BB3\u8005\uFF0C\u5728\u6B64\u8FC7\u7A0B\u4E2D\u4ED6\u4EEC\u53EF\u4EE5\u64CD\u7EB5\u6D41\u91CF\u548C\/\u6216\u6CE8\u5165\u81EA\u5DF1\u7684\u5185\u5BB9\u3002\u8FD9\u4E9B\u88AB\u653B\u9677\u7684\u5728\u7EBF\u7F51\u7EDC\u901A\u9053\u4E5F\u53EF\u7528\u4E8E\u5411\u5DF2\u53D7\u611F\u67D3\u7684\u7CFB\u7EDF\u4F20\u9012\u989D\u5916\u8D1F\u8F7D\uFF08\u5373\"\u5165\u53E3\u5DE5\u5177\u4F20\u8F93\"\uFF09\u53CA\u5176\u4ED6\u6570\u636E\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE,\u6307\u6325\u4E0E\u63A7\u5236","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1659\/"},{"id":"T1665","name":"\u9690\u85CF\u57FA\u7840\u8BBE\u65BD","description":"\u653B\u51FB\u8005\u53EF\u80FD\u64CD\u7EB5\u7F51\u7EDC\u6D41\u91CF\u4EE5\u9690\u85CF\u5176C2\u57FA\u7840\u8BBE\u65BD\u5E76\u89C4\u907F\u68C0\u6D4B\u3002\u8FD9\u53EF\u901A\u8FC7\u8BC6\u522B\u5E76\u8FC7\u6EE4\u6765\u81EA\u9632\u5FA1\u5DE5\u5177\u7684\u6D41\u91CF\u3001\u4F2A\u88C5\u6076\u610F\u57DF\u540D\u4EE5\u6DF7\u6DC6\u81EA\u52A8\u5316\u626B\u63CF\u5DE5\u5177\u548C\u5B89\u5168\u7814\u7A76\u4EBA\u5458\u5BF9\u771F\u5B9E\u76EE\u7684\u5730\u7684\u5224\u65AD\uFF0C\u4EE5\u53CA\u9690\u85CF\u6076\u610F\u75D5\u8FF9\u6765\u5B9E\u73B0\uFF0C\u4ECE\u800C\u5EF6\u8FDF\u53D1\u73B0\u5E76\u5EF6\u957F\u5BF9\u624B\u57FA\u7840\u8BBE\u65BD\u7684\u6709\u6548\u671F\uFF0C\u5426\u5219\u8FD9\u4E9B\u57FA\u7840\u8BBE\u65BD\u53EF\u80FD\u88AB\u8BC6\u522B\u3001\u963B\u6B62\u6216\u5B8C\u5168\u6E05\u9664\u3002","sub-techniques":"","tactic":"\u6307\u6325\u4E0E\u63A7\u5236","platforms":"ESXi,Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1665\/"},{"id":"T1666","name":"\u4FEE\u6539\u4E91\u8D44\u6E90\u5C42\u7EA7\u7ED3\u6784","description":"\u5BF9\u624B\u53EF\u80FD\u8BD5\u56FE\u4FEE\u6539\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1\uFF08IaaS\uFF09\u73AF\u5883\u4E2D\u7684\u5C42\u7EA7\u7ED3\u6784\uFF0C\u4EE5\u89C4\u907F\u9632\u5FA1\u63AA\u65BD\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1666\/"},{"id":"T1667","name":"\u90AE\u4EF6\u8F70\u70B8","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u5411\u76EE\u6807\u90AE\u7BB1\u53D1\u9001\u6D77\u91CF\u90AE\u4EF6\uFF0C\u5BFC\u81F4\u6B63\u5E38\u90AE\u4EF6\u88AB\u5783\u573E\u4FE1\u606F\u6DF9\u6CA1\uFF0C\u4ECE\u800C\u5E72\u6270\u4F01\u4E1A\u6B63\u5E38\u8FD0\u8425\u3002","sub-techniques":"","tactic":"\u5F71\u54CD","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1667\/"},{"id":"T1668","name":"\u72EC\u5BB6\u63A7\u5236","description":"\u6210\u529F\u5165\u4FB5\u7CFB\u7EDF\u7684\u5BF9\u624B\u53EF\u80FD\u4F1A\u8BD5\u56FE\u901A\u8FC7\"\u5173\u95E8\"\u6765\u7EF4\u6301\u5176\u6301\u4E45\u6027\u2014\u2014\u4E5F\u5C31\u662F\u8BF4\uFF0C\u963B\u6B62\u5176\u4ED6\u5A01\u80C1\u884C\u4E3A\u8005\u6700\u521D\u8BBF\u95EE\u6216\u7EF4\u6301\u5728\u540C\u4E00\u4E2A\u7CFB\u7EDF\u4E0A\u7684\u7ACB\u8DB3\u70B9\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1668\/"},{"id":"T1669","name":"Wi-Fi\u7F51\u7EDC","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u8FDE\u63A5\u65E0\u7EBF\u7F51\u7EDC\u83B7\u5F97\u5BF9\u76EE\u6807\u7CFB\u7EDF\u7684\u521D\u59CB\u8BBF\u95EE\u6743\u9650\u3002\u4ED6\u4EEC\u53EF\u4EE5\u5229\u7528\u76EE\u6807\u8BBE\u5907\u4F7F\u7528\u7684\u5F00\u653EWi-Fi\u7F51\u7EDC\uFF0C\u6216\u8BBF\u95EE\u5C5E\u4E8E\u76EE\u6807\u7EC4\u7EC7\u7684\u53D7\u4FDD\u62A4Wi-Fi\u7F51\u7EDC\uFF08\u9700\u8981\u6709\u6548\u8D26\u6237\uFF09\u6765\u5B9E\u73B0\u8FD9\u4E00\u76EE\u7684\u3002\u5EFA\u7ACB\u4E0EWi-Fi\u63A5\u5165\u70B9\u7684\u8FDE\u63A5\u9700\u8981\u4E00\u5B9A\u7684\u63A5\u8FD1\u7A0B\u5EA6\uFF0C\u4EE5\u4FBF\u53D1\u73B0\u5E76\u7EF4\u6301\u7A33\u5B9A\u7684\u7F51\u7EDC\u8FDE\u63A5\u3002","sub-techniques":"","tactic":"\u521D\u59CB\u8BBF\u95EE","platforms":"Linux,\u7F51\u7EDC\u8BBE\u5907,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1669\/"},{"id":"T1671","name":"\u4E91\u5E94\u7528\u96C6\u6210","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5229\u7528\u8F6F\u4EF6\u5373\u670D\u52A1\u73AF\u5883\u4E2D\u7684OAuth\u5E94\u7528\u7A0B\u5E8F\u96C6\u6210\u6765\u5B9E\u73B0\u6301\u4E45\u6027\u3002\u4ED6\u4EEC\u53EF\u80FD\u521B\u5EFA\u81EA\u5B9A\u4E49\u5E94\u7528\u7A0B\u5E8F\u3001\u5C06\u5408\u6CD5\u5E94\u7528\u7A0B\u5E8F\u6DFB\u52A0\u81F3\u73AF\u5883\u4E2D\uFF0C\u751A\u81F3\u7BE1\u6539\u73B0\u6709\u96C6\u6210\u4EE5\u8FBE\u5230\u6076\u610F\u76EE\u7684\u3002","sub-techniques":"","tactic":"\u575A\u6301","platforms":"\u529E\u516C\u5957\u4EF6,\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1671\/"},{"id":"T1672","name":"\u7535\u5B50\u90AE\u4EF6\u4F2A\u9020","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u4FEE\u6539\u76F8\u5173\u7535\u5B50\u90AE\u4EF6\u6807\u5934\u7684\u503C\u6765\u4F2A\u9020\u6216\u5192\u5145\u53D1\u4EF6\u4EBA\u8EAB\u4EFD\uFF0C\u4EE5\u6B64\u5728\u865A\u5047\u524D\u63D0\u4E0B\u4E0E\u53D7\u5BB3\u8005\u5EFA\u7ACB\u8054\u7CFB\u3002\u9664\u4E86\u5B9E\u9645\u7684\u90AE\u4EF6\u5185\u5BB9\u5916\uFF0C\u7535\u5B50\u90AE\u4EF6\u6807\u5934\uFF08\u4F8B\u5982\u5305\u542B\u53D1\u4EF6\u4EBA\u90AE\u7BB1\u5730\u5740\u7684\u201C\u53D1\u4EF6\u4EBA\u201D\u6807\u5934\uFF09\u4E5F\u53EF\u80FD\u88AB\u7BE1\u6539\u3002\u5F53\u90AE\u4EF6\u51FA\u73B0\u5728\u53D7\u5BB3\u8005\u7684\u6536\u4EF6\u7BB1\u65F6\uFF0C\u90AE\u4EF6\u5BA2\u6237\u7AEF\u4F1A\u663E\u793A\u8FD9\u4E9B\u6807\u5934\uFF0C\u8FD9\u53EF\u80FD\u5BFC\u81F4\u88AB\u7BE1\u6539\u7684\u90AE\u4EF6\u770B\u8D77\u6765\u50CF\u662F\u6765\u81EA\u88AB\u5192\u5145\u7684\u5B9E\u4F53\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,\u529E\u516C\u5957\u4EF6,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1672\/"},{"id":"T1673","name":"\u865A\u62DF\u673A\u53D1\u73B0","description":"\u653B\u51FB\u8005\u5728\u83B7\u5F97\u4E3B\u673A\u6216\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u7684\u8BBF\u95EE\u6743\u9650\u540E\uFF0C\u53EF\u80FD\u4F1A\u5C1D\u8BD5\u679A\u4E3E\u6B63\u5728\u8FD0\u884C\u7684\u865A\u62DF\u673A\uFF08VMs\uFF09\u3002\u4F8B\u5982\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u4F7F\u7528\u865A\u62DF\u673A\u7BA1\u7406\u7A0B\u5E8F\u547D\u4EE4\u884C\u754C\u9762\uFF08\u5982esxcli\u6216vim-cmd\uFF09\u6765\u679A\u4E3EESXi\u7BA1\u7406\u7A0B\u5E8F\u4E0A\u7684\u865A\u62DF\u673A\u5217\u8868\uFF08\u4F8B\u5982\uFF0C\u6267\u884Cesxcli vm process list\u6216vim-cmd vmsvc\/getallvms\u547D\u4EE4\uFF09\u3002\u653B\u51FB\u8005\u8FD8\u53EF\u80FD\u76F4\u63A5\u5229\u7528\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF0C\u5982VMware vCenter\uFF0C\u6765\u67E5\u770B\u4E3B\u673A\u4E0A\u7684\u865A\u62DF\u673A\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1673\/"},{"id":"T1674","name":"\u8F93\u5165\u6CE8\u5165","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u591A\u79CD\u65B9\u5F0F\u6A21\u62DF\u53D7\u5BB3\u8BA1\u7B97\u673A\u4E0A\u7684\u51FB\u952E\u64CD\u4F5C\uFF0C\u4EE5\u4EE3\u8868\u7528\u6237\u6267\u884C\u5404\u7C7B\u884C\u52A8\uFF0C\u4F8B\u5982\u4F7F\u7528\u952E\u76D8\u5FEB\u6377\u952E\u542F\u52A8\u547D\u4EE4\u89E3\u91CA\u5668\u3001\u8F93\u5165\u5F85\u6267\u884C\u7684\u5185\u8054\u811A\u672C\uFF0C\u6216\u76F4\u63A5\u4E0E\u57FA\u4E8E\u56FE\u5F62\u7528\u6237\u754C\u9762\uFF08GUI\uFF09\u7684\u5E94\u7528\u7A0B\u5E8F\u4EA4\u4E92\u3002\u8FD9\u4E9B\u64CD\u4F5C\u53EF\u9884\u5148\u7F16\u7A0B\u81F3\u653B\u51FB\u5DE5\u5177\u4E2D\uFF0C\u6216\u901A\u8FC7\u7269\u7406\u8BBE\u5907\uFF08\u5982\u4EBA\u673A\u63A5\u53E3\u8BBE\u5907HID\uFF09\u6267\u884C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1674\/"},{"id":"T1675","name":"ESXi \u7BA1\u7406\u547D\u4EE4","description":"\u653B\u51FB\u8005\u53EF\u80FD\u6EE5\u7528ESXi\u7BA1\u7406\u670D\u52A1\uFF0C\u5728ESXi\u865A\u62DF\u73AF\u5883\u5185\u6258\u7BA1\u7684\u5BA2\u6237\u673A\u4E0A\u6267\u884C\u547D\u4EE4\u3002ESXi\u6258\u7BA1\u865A\u62DF\u673A\u4E0A\u7684\u6301\u4E45\u6027\u540E\u53F0\u670D\u52A1\uFF08\u5982VMware Tools\u5B88\u62A4\u8FDB\u7A0B\u670D\u52A1\uFF09\u5141\u8BB8\u4ECEESXi\u670D\u52A1\u5668\u8FDB\u884C\u8FDC\u7A0B\u7BA1\u7406\u3002\u8BE5\u5DE5\u5177\u5B88\u62A4\u8FDB\u7A0B\u670D\u52A1\u5728Windows\u5BA2\u6237\u64CD\u4F5C\u7CFB\u7EDF\u4E2D\u4EE5vmtoolsd.exe\u8FD0\u884C\uFF0C\u5728macOS\u4E0A\u4EE5vmware-tools-daemon\u8FD0\u884C\uFF0C\u5728Linux\u4E0A\u5219\u4EE5vmtoolsd\u8FD0\u884C\u3002","sub-techniques":"","tactic":"\u6267\u884C","platforms":"ESXi","permalink":"https:\/\/attack.mitre.org\/techniques\/T1675\/"},{"id":"T1677","name":"\u4E2D\u6BD2\u6D41\u6C34\u7EBF\u6267\u884C","description":"\u653B\u51FB\u8005\u53EF\u80FD\u901A\u8FC7\u5411\u6784\u5EFA\u6D41\u7A0B\u6CE8\u5165\u6076\u610F\u4EE3\u7801\u6765\u64CD\u7EB5\u6301\u7EED\u96C6\u6210\/\u6301\u7EED\u5F00\u53D1\uFF08CI\/CD\uFF09\u6D41\u7A0B\u3002\u6C61\u67D3\u6D41\u6C34\u7EBF\u5B58\u5728\u591A\u79CD\u673A\u5236\uFF1A","sub-techniques":"","tactic":"\u6267\u884C","platforms":"\u8F6F\u4EF6\u5373\u670D\u52A1","permalink":"https:\/\/attack.mitre.org\/techniques\/T1677\/"},{"id":"T1678","name":"\u5EF6\u8FDF\u6267\u884C","description":"\u5BF9\u624B\u53EF\u80FD\u91C7\u7528\u5404\u79CD\u57FA\u4E8E\u65F6\u95F4\u7684\u65B9\u6CD5\u6765\u89C4\u907F\u68C0\u6D4B\u548C\u5206\u6790\u3002\u8FD9\u4E9B\u6280\u672F\u901A\u5E38\u5229\u7528\u7CFB\u7EDF\u65F6\u949F\u3001\u5EF6\u8FDF\u6216\u5B9A\u65F6\u673A\u5236\u6765\u63A9\u76D6\u6076\u610F\u6D3B\u52A8\uFF0C\u4F7F\u5176\u4E0E\u6B63\u5E38\u6D3B\u52A8\u6DF7\u4E3A\u4E00\u4F53\uFF0C\u4ECE\u800C\u9003\u907F\u5BA1\u67E5\u3002\u5BF9\u624B\u53EF\u4EE5\u5728\u865A\u62DF\u5316\/\u6C99\u7BB1\u73AF\u5883\u4E2D\u6216\u76F4\u63A5\u5728\u4E3B\u673A\u7CFB\u7EDF\u4E0A\u5B9E\u65BD\u6B64\u7C7B\u884C\u4E3A\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1678\/"},{"id":"T1679","name":"\u9009\u62E9\u6027\u6392\u9664","description":"\u653B\u51FB\u8005\u53EF\u80FD\u5728\u6267\u884C\u52D2\u7D22\u8F6F\u4EF6\u6216\u6076\u610F\u8D1F\u8F7D\u65F6\uFF0C\u6545\u610F\u6392\u9664\u67D0\u4E9B\u6587\u4EF6\u3001\u6587\u4EF6\u5939\u3001\u76EE\u5F55\u3001\u6587\u4EF6\u7C7B\u578B\u6216\u7CFB\u7EDF\u7EC4\u4EF6\uFF0C\u4E0D\u5BF9\u5176\u8FDB\u884C\u52A0\u5BC6\u6216\u7BE1\u6539\u3002\u653B\u51FB\u8005\u53EF\u80FD\u907F\u514D\u52A0\u5BC6\u7684\u6587\u4EF6\u6269\u5C55\u540D\u5305\u62EC.dll\u3001.exe\u548C.lnk\u3002","sub-techniques":"","tactic":"\u9632\u5FA1\u89C4\u907F","platforms":"Windows","permalink":"https:\/\/attack.mitre.org\/techniques\/T1679\/"},{"id":"T1680","name":"\u672C\u5730\u5B58\u50A8\u53D1\u73B0","description":"\u653B\u51FB\u8005\u53EF\u80FD\u4F1A\u679A\u4E3E\u672C\u5730\u9A71\u52A8\u5668\u3001\u78C1\u76D8\u548C\/\u6216\u5377\u53CA\u5176\u5C5E\u6027\uFF0C\u5982\u603B\u7A7A\u95F4\u3001\u53EF\u7528\u7A7A\u95F4\u548C\u5377\u5E8F\u5217\u53F7\u3002\u6B64\u4E3E\u53EF\u7528\u4E8E\u51C6\u5907\u52D2\u7D22\u8F6F\u4EF6\u76F8\u5173\u7684\u52A0\u5BC6\u64CD\u4F5C\u3001\u5B9E\u65BD\u6A2A\u5411\u79FB\u52A8\uFF0C\u6216\u4F5C\u4E3A\u76F4\u63A5\u5377\u8BBF\u95EE\u7684\u524D\u5146\u3002","sub-techniques":"","tactic":"\u53D1\u73B0","platforms":"ESXi,\u57FA\u7840\u8BBE\u65BD\u5373\u670D\u52A1,Linux,Windows,macOS","permalink":"https:\/\/attack.mitre.org\/techniques\/T1680\/"},{"id":"T1681","name":"\u641C\u7D22\u5A01\u80C1\u4F9B\u5E94\u5546\u6570\u636E","description":"\u5A01\u80C1\u884C\u4E3A\u8005\u53EF\u80FD\u4F1A\u4ECE\u5C01\u95ED\u6216\u5F00\u653E\u7684\u5A01\u80C1\u60C5\u62A5\u6765\u6E90\u4E2D\uFF0C\u641C\u96C6\u5173\u4E8E\u5176\u81EA\u8EAB\u884C\u52A8\u4EE5\u53CA\u5176\u4ED6\u5BF9\u624B\u6D3B\u52A8\u7684\u4FE1\u606F\u6216\u6307\u6807\uFF0C\u8FD9\u4E9B\u6D3B\u52A8\u53EF\u80FD\u4E0E\u4ED6\u4EEC\u7684\u76EE\u6807\u884C\u4E1A\u3001\u80FD\u529B\/\u76EE\u6807\u6216\u5176\u4ED6\u64CD\u4F5C\u5173\u6CE8\u70B9\u76F8\u7B26\u3002\u8FD9\u4E9B\u62A5\u544A\u53EF\u80FD\u5305\u62EC\u884C\u4E3A\u63CF\u8FF0\u3001\u653B\u51FB\u7684\u8BE6\u7EC6\u5206\u6790\u3001\u539F\u5B50\u6307\u6807\uFF08\u5982\u6076\u610F\u8F6F\u4EF6\u54C8\u5E0C\u503C\u6216IP\u5730\u5740\uFF09\u3001\u7EC4\u7EC7\u6D3B\u52A8\u7684\u65F6\u95F4\u7EBF\u7B49\u3002\u5BF9\u624B\u5728\u89C4\u5212\u672A\u6765\u884C\u52A8\u65F6\uFF0C\u53EF\u80FD\u4F1A\u6539\u53D8\u5176\u884C\u4E3A\u6A21\u5F0F\u3002","sub-techniques":"","tactic":"\u4FA6\u5BDF","platforms":"PRE","permalink":"https:\/\/attack.mitre.org\/techniques\/T1681\/"}]}