A user received a malicious attachment but did not run it. Which category classifies the intrusion?

Weaponization is the stage where the attacker combines an exploit and a backdoor into a deliverable payload, occurring before delivery.

Reconnaissance is the initial stage where an attacker gathers information about the target, which happens long before a malicious attachment is sent.

Installation refers to the stage where the attacker installs persistent access to the victim's system, which requires the malicious attachment to be executed, which did not occur here.

Delivery is the stage in the Cyber Kill Chain where the attacker transmits the weaponized malware to the victim, such as via an email attachment, signifying successful delivery even if not executed.