installs an application-defined Windows hook to get notified when a network drive has been attached so it can then use the hook to call its RecordToFile file stealing method.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: installs an application-defined Windows hook to get notified when a network drive has been attached so it can then use the hook to call its RecordToFile file stealing method. ### Response: T1056.004.