Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.