A threat actor has successfully breached a company's network and has installed malicious code on a compromised host. The threat actor is now operating the compromised host remotely and maintaining access to it over a period of time. The threat actor's activity is disguised as part of the network's regular traffic.

Detection of this type of activity usually depends on identifying anomalous connection endpoints.

Which stage of the cyberattack lifecycle does this scenario represent?

answer

Data exfiltration

Reconnaissance

Command and Control

Weaponization, delivery, and breach