Five years of access with no exfiltration objective. Pre-positioning breaks every response method that starts by asking what the intruder wanted.
Every playbook assumes an event. Pre-positioning has none — the adversary is deliberately behaving like an administrator.