Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.