What are the phases of a computer attack?
Phase I: Reconnaissance Probing
During the first phase of a computer attack, the attacker will gather as much information as he can to identify the weakest points of entry on a network. It is important that he collects as much information as he can because this will determine how successful the attack will be. An attacker uses various tools found on the internet designed to exploit various targets. He will use those tools accordingly. Some of the tools are:
-DNS and ICMP tools within the TCP/IP protocol suite -Standard and customized SNMP tools -Port scanners and port mappers -Security probes
Attackers will use these tools to view detailed information about the network. By knowing a specific domain name, an attacker can easily find registered addresses, server names, and domain names via ICMP and WHOIS. Reverse DNS lookup and nslookup also provide searches for DNS information.
Phase II: Access and Privilege Escalation
Once the attacker has gathered the information they need to facilitate the attack he must make the connection or access the targeted system and gain administrative access. This can be done via secondary remote gateways and/or unattended modem boxes on the outside of an organizations building. An attacker can use a password cracker or install a Remote Administration Tool (RAT) Trojan on a computer and other various viruses and malicious software. RAT allows a hacker to maintain access to a compromised computer enabling them to corrupt files specifically the startup files.
Phase III: Covering Your Tracks
Avoiding detection is important for a successful attack. All files that may have been created need to be removed, and all changed files must be restored. Remove log file entries as these can and will provide evidence of an attack. Since most systems protect log files from being modified, he may have to attack the log files or auditing files to cover those tracks as well. Covering your tracks will make an attack hard to notice.

References
2012. Fundamentals of Information Systems Security. Sudbury: Jones and Bartlett Learning.