Refer to the exhibit.

The stage of the threat kill chain indicated by the URIs of inbound web requests from known malicious Internet scanners is reconnaissance. During this stage, attackers are gathering information about the target system, looking for vulnerabilities or weak points that can be exploited. The URIs provided in the exhibit suggest attempts to discover administrative interfaces, exploit known vulnerabilities, and test for common web application weaknesses such as cross-site scripting (XSS) and SQL injection. These activities are characteristic of the reconnaissance phase, where attackers are probing and mapping out the target environment to plan their subsequent moves.