Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: OilRig has used <code>reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”</code> on a victim to query the Registry.