A SOC analyst reviews output from a predictive AI engine that scores traffic patterns across the enterprise. Over a 48-hour window, the engine flags the following high-confidence sequence for a single workstation: (1) outbound DNS TXT queries to a newly registered domain, (2) encrypted beaconing at fixed 60-second intervals to the same domain, (3) SMB session establishment to three internal file servers the host has never contacted, and (4) a spike in outbound TLS traffic to a cloud storage provider. Based on this predicted event sequence, which stage of the attack does step 3 most accurately represent?