Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in <code>%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\</code>; the malicious file by the same name is saved in <code>%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\</code>.