Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: QakBot can identify whether it has been run previously on a host by checking for a specified folder.