During host analysis of a compromised workstation, an analyst reviews Autoruns output and finds a new value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to C:\Users\jsmith\AppData\Roaming\svchost.exe. The file was created three days ago and is not signed. Which MITRE ATT&CK tactic does this indicator most directly represent?