312-39V2: Certified SOC Analyst v2

You are a Threat Hunter on the SOC team of a prestigious law firm that specializes in high-profile corporate cases. The firm recently experienced a data breach in which confidential client documents were leaked on a dark-web forum. As part of a proactive threat-hunting initiative, you analyze security logs, network traffic, and endpoint activity to trace the attacker’s actions by using the Cyber Kill Chain framework.

Your investigation shows that the attacker initially bypassed the firm’s multi-factor authentication (MFA) by posing as a legitimate user. After gaining access, they moved laterally through the internal network, accessed sensitive client records in a shared file repository, and exfiltrated the data over an extended period. You are tasked with identifying the attack phase in the Cyber Kill Chain framework to strengthen defenses against similar attacks. Implement proactive threat-hunting measures to detect future intrusions before data exfiltration occurs.

During which Cyber Kill Chain phase was the attack identified?