Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.