Which technique is used by attackers during the Installation phase of the cyber attack lifecycle...

The Installation phase occurs after exploitation, when an attacker attempts to establish persistence on the compromised system. A rootkit is a strong example because it can hide malicious processes, files, registry entries, drivers, or system changes from users and security tools. Its purpose is to maintain access while reducing the chance of detection. Exploiting web application vulnerabilities belongs to the exploitation phase. Brute force attacks against user accounts are credential attacks and may occur before or during compromise, but they are not the best example of installation persistence. Sending spear phishing emails is a delivery or social engineering activity. Persistence mechanisms may include rootkits, backdoors, scheduled tasks, malicious services, startup items, or modified authentication paths. Defenders counter this phase with endpoint detection, integrity monitoring, least privilege, hardening, and incident response procedures that remove persistence artifacts. Reference/topics: Cybersecurity 1.2, cyber attack lifecycle; Cybersecurity 1.3, malware and attack types.