Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: BabyShark has executed the <code>reg query</code> command for <code>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default</code>.