Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.