Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.