Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.