A SOC analyst reviews output from a predictive AI engine that scores network and host telemetry against learned attack patterns. The engine flags a high-confidence sequence beginning with an inbound email delivering a macro-enabled document, followed by a PowerShell process spawning from Word, then an outbound TLS connection to a newly registered domain. Based on this predicted sequence, which attack phase is the AI indicating is currently underway?