Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.