Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.