An analyst reviews an intrusion timeline. Weeks of port scans and scraping of staff profiles were followed by a phishing email that exploited a document-reader flaw. The newest event is a scheduled task that relaunches the attacker's beacon every time the host reboots. Which threat life cycle stage does the scheduled task represent?

Threats typically progress through a life cycle: reconnaissance to learn about the target, delivery and exploitation to gain a foothold, persistence to keep that access, then movement, privilege escalation and actions on objectives such as data theft or encryption. A scheduled task, service or startup entry that relaunches malicious code after a reboot is a classic persistence mechanism because its only purpose is to survive events that would otherwise end the attacker's session. Reconnaissance describes the earlier port scans and profile scraping, which collected information but did not touch the host's configuration. Initial exploitation describes the phishing email and the document-reader flaw, the step that first ran code on the machine; the scheduled task came afterward and depends on that foothold already existing. Exfiltration is the transfer of data out of the environment, and nothing in the described task moves data. Exam caveat: stages can overlap and some models name them differently, so match the observed behavior to its purpose rather than to a memorized label. Operational check: list scheduled tasks, services and autostart locations on the host, compare them with a known-good baseline, and remove any persistence entry before restoring the system to service.