Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key <code>SYSTEM\CurrentControlSet\Control\Lsa Name</code>.