A user received an email attachment named "Hr405-report2609-empl094.exe" but did not run it. Which category of the cyber kill chain should be assigned to this type of event?

The 'Installation' phase occurs after successful exploitation, when the attacker establishes persistence on the target system, which did not happen here as the file was not run.

The 'Reconnaissance' phase involves gathering information about the target, which happens before the delivery of a payload.

The 'Weaponization' phase involves combining an exploit with a payload into a deliverable package, which occurs before the delivery to the victim.

In the cyber kill chain, the 'Delivery' phase involves transmitting the weaponized artifact (the malicious executable attachment) to the target. Receiving the email attachment completes this phase, regardless of whether it was executed.