An organization has just detected anomalous activity on its network suggesting the presence of an intruder. According to the Cyber Kill Chain framework, which stage is the organization most likely in, and what should be the key focus at this stage?
Reconnaissance: gathering information about the target
Intrusion: identifying and neutralizing the threat
Delivery: delivering the payload to the target network
Installation: deploying malware on the target system