If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?
Covering tracks
Expanding access
Gaining persistence
Performing reconnaissance
Submit