Place the seven stages of the Mandiant Cyber Attack Lifecycle in chronological order from first to last.

### Why this is right The lifecycle begins with information gathering, followed by entry and establishment of a foothold. The attacker then seeks elevated access, examines the internal environment, moves between systems, and acts on the objective. ### The order 1. Reconnaissance: gather information about the target before the attack. 2. Initial compromise: gain entry, for example through phishing or an exposed weakness. 3. Phase two: establish a foothold that supports continued access. 4. Escalate privileges: seek permissions beyond those initially obtained. 5. Internal reconnaissance: investigate connections and resources inside the environment. 6. Move laterally: access additional systems within the environment. 7. Complete the mission: steal, change, remove, or destroy the targeted data. ### Terms - **Foothold**: An initial, persistent position inside a compromised environment. - **Lateral movement**: Movement from one system to another inside a network. ### Remember The attacker learns, enters, persists, expands access, explores, spreads, and acts.