Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.