An analyst is reviewing a security incident and needs to map the adversary's actions to the MITRE ATT&CK framework. The attack involved an initial spear phishing email with an attachment that, when opened, executed a malicious payload to establish persistence on the victim's system. What is the BEST classification for this tactic within the MITRE ATT&CK framework?
Reconnaissance
Defense Evasion
Lateral Movement
Persistence