An analyst is evaluating a compromised system and observes behavior consistent with an adversary attempting to maintain persistent access to a network resource. According to the MITRE ATT&CK framework, which tactic BEST describes this behavior?
Persistence
Exfiltration
Privilege Escalation
Defense Evasion