Deleting an attacker's scheduled tasks on a victim host is something that would typically occur during which phase of incident handling?

Identification (also called Detection/Analysis) involves discovering and confirming that an incident has occurred, not removing attacker artifacts.

Recovery focuses on restoring systems to normal operation after eradication is complete, not on removing malicious artifacts.

Preparation occurs before any incident and involves building policies, tools, and response capabilities, not responding to active attacker activity.

Eradication is the incident handling phase focused on completely removing the attacker's presence and any mechanisms they used to maintain access or execute code, such as scheduled tasks, malware, or backdoors. Deleting scheduled tasks directly addresses persistence mechanisms the attacker installed. This phase follows Containment and precedes Recovery to ensure the environment is clean before restoration.