Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating a cross-environment security alert in a SIEM console. The alert correlates web application server logs with cloud audit logs across a 5-minute timeframe:

Log Snippet 1 (Nginx Web Server Access Log):
`192.0.2.45 - - [27/Jul/2026:14:22:10 +0000] "GET /api/v1/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/AppRole HTTP/1.1" 200 1423 "-" "Mozilla/5.0"`

Log Snippet 2 (CloudTrail Security Audit Log):
`{"eventTime": "2026-07-27T14:25:04Z", "eventName": "ListBuckets", "userARN": "arn:aws:iam::123456789012:role/AppRole", "sourceIPAddress": "198.51.100.89", "userAgent": "aws-sdk-python/1.26.0"}`

Based on the correlated log telemetry, which of the following best describes the attack vector executed and the log indicator confirming successful exploitation?

  1. A Server-Side Request Forgery (SSRF) attack exfiltrated IAM temporary role credentials from the instance metadata service (IMDS), confirmed by CloudTrail logging API requests issued from an external IP address (198.51.100.89) using the compromised role.Answer
  2. B
    A SQL Injection (SQLi) attack targeted the backend database through the URL parameter, confirmed by the HTTP 200 response status containing database schema information in the response payload.
  3. C
    An authorization policy misconfiguration allowed an authenticated internal user to elevate privileges, confirmed by the HTTP 200 status code issued to the internal IP address (192.0.2.45).
  4. D
    A SIEM correlation rule misinterpretation caused a false positive alert by linking routine SDK administration traffic with normal web application image fetching.

Answer

A Server-Side Request Forgery (SSRF) attack exfiltrated IAM temporary role credentials from the instance metadata service (IMDS), confirmed by CloudTrail logging API requests issued from an external IP address (198.51.100.89) using the compromised role.
The correct answer accurately identifies Server-Side Request Forgery (SSRF) aimed at the internal cloud metadata address (169.254.169.254). The Nginx log demonstrates an attacker abusing a URL parameter to fetch temporary access tokens for the AppRole. The corresponding CloudTrail log confirms that the stolen temporary credentials were subsequently used by an external IP address (198.51.100.89) to execute the ListBuckets API call.

Step-by-Step Solution

1
Analyze Nginx access log snippet for web application vector
Identified a GET request to `/api/v1/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/AppRole` returning HTTP 200. This is a classic SSRF pattern targeting the cloud Instance Metadata Service (IMDS) to retrieve temporary security credentials.
The `url=` query parameter indicates the application fetches arbitrary external/internal URLs provided by user input without proper sanitization.
2
Analyze CloudTrail audit log snippet for credential usage
Event `ListBuckets` was called using `arn:aws:iam::123456789012:role/AppRole` from external source IP `198.51.100.89` via Python SDK (`aws-sdk-python`).
Instance roles are intended to be used directly by the EC2 instance host. Originating API calls from an unexpected external public IP indicates an attacker obtained the secret key/token from IMDS and configured local AWS CLI/SDK tools.
3
Correlate telemetry timeline and synthesize root cause
The web log entry at 14:22:10 UTC exfiltrated credentials, which were then used at 14:25:04 UTC by the attacker's workstation (198.51.100.89) to enumerate S3 buckets.
SIEM event correlation rules trigger on sequential events linking web application SSRF telemetry with anomalous external API calls using host-assigned IAM roles.

Key Concept

Log Correlation for Server-Side Request Forgery (SSRF) and Cloud Credential Theft
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic