| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1082 | 系统信息发现 |
can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.[1] |
|
| Enterprise | T1033 | 系统所有者/用户发现 |
can collect the victim user name.[1] |
|
| Enterprise | T1105 | 输入工具传输 |
can download and execute a second-stage payload.[1] |
|