Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.