Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.