While investigating a potential security breach on a Windows machine, you list the commands that have recently been executed from the command line and find the following: arp $-$a$,$ set username, set computername, net localgroup administrators, and tasklist. There are other commands as well.

You then check the running processes and see the output below in Task Manager. It is clear that someone has compromised the Windows machine.

What would you call the phase of the attack that you have found?