Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.