In the cyber attack lifecycle, What phase would be associated with an attacker adding a run key in the Windows registry?
1) Maintain presence
2) Internal Recon
3) Move laterally
4) Escalate privileges
5) Establish foothold