The phases of the APT lifecycle include preparation initial intrusion, expansion and which of these?

Escalating privileges, exploitation, and covering tracks

Maintaining access, and clearing logs

Remediation, verification, and monitor

Persistence, search and exfitration, and cleanup