As a SOC Administrator at a mid-sized financial institution, you noticed intermittent network slowdowns and...

This scenario best aligns with Persistence because the attacker established mechanisms to maintain access over time after the initial compromise. The defining evidence is “unauthorized scheduled tasks executed during off-peak hours” running obfuscated scripts and connecting to a C2 server. Scheduled tasks and startup mechanisms are classic persistence techniques that allow an adversary to survive reboots, re-establish footholds, and perform recurring actions (beaconing, payload retrieval, credential harvesting) without continuous interactive access. The scenario explicitly states the adversary gained access months ago via compromised VPN credentials (initial intrusion), but what you are observing now is the long-lived foothold and automated re-entry capability. Cleanup would involve covering tracks and removing evidence; while obfuscation and potential log manipulation can be related, the core described behavior is recurring execution and ongoing C2 communication. Search and exfiltration would focus on data discovery and transfer; while network slowdowns could be related to exfiltration, the most direct indicators here are persistence mechanisms enabling continued control. For SOC response, this phase emphasizes removing persistence artifacts, rotating credentials, and validating no alternate footholds remain.