Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in <code>%PROGRAMDATA%\Windows\</code>.