Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.