Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: BitPaymer has copied itself to the <code>:bin</code> alternate data stream of a newly created file.