Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: APT41 created and modified startup files for persistence. APT41 added a registry key in <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost</code> to establish persistence for Cobalt Strike.