312-39V2: Certified SOC Analyst v2

A threat hunter investigating an infected endpoint observes that malicious processes repeatedly reappear after being terminated, making conventional remediation ineffective. The endpoint user reports occasional system slowdowns, unusual pop-ups, and unauthorized application launches. On deeper review, the threat hunter finds multiple scheduled tasks that run unknown scripts at specific intervals, as well as suspicious registry changes enabling automatic script execution at startup. Further investigation shows the endpoint has occasionally connected outbound to an unclassified external server, although the traffic is encrypted and intermittent. In addition, the organization recently had multiple failed login attempts against privileged accounts from the same subnet, creating concern about possible credential theft or lateral movement. Given the possibility of persistence mechanisms, lateral movement, or external C2 activity, which signs should the threat hunter watch for to confirm and mitigate the threat?