Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing raw log telemetry streams collected from web servers, authentication systems, and perimeter firewalls inside a SIEM environment. Match each log snippet pattern on the left with its corresponding attack vector or security event classification on the right.

  • GET /products.php?id=1%20UNION%20SELECT%201,username,password_hash%20FROM%20users-- HTTP/1.1 200 4520SQL Injection (SQLi) data exfiltration attempt
  • EventID=4625 Status=0xC000006D SubStatus=0xC000006A TargetUserName=svc_backup WorkstationName=WORKSTATION01 (occurring 400 times in 30 seconds across distinct target endpoints)Password spraying authentication attack
  • kernel: IPTables-DROP-FORWARD: IN=eth0 OUT=eth1 SRC=10.0.4.15 DST=192.168.10.50 PROTO=TCP SPT=49812 DPT=445 FLAGS=SYNInternal lateral movement network boundary drop
  • GET /user/profile?id=1042 HTTP/1.1 200 -> GET /user/profile?id=1043 HTTP/1.1 200 -> GET /user/profile?id=1044 HTTP/1.1 200 (from authenticated session Cookie: sessionid=a9f8b2)Insecure Direct Object Reference (IDOR) authorization bypass

Answer

Each log entry pattern corresponds to a specific attack taxonomy: Log 1 matches SQL Injection data exfiltration; Log 2 matches Password spraying authentication attack; Log 3 matches Internal lateral movement network boundary drop; Log 4 matches Insecure Direct Object Reference (IDOR) authorization bypass.
The correct matches accurately map log syntax and operational telemetry to their definitive attack classifications based on payload structure, protocol ports, and event codes.

Step-by-Step Solution

1
Analyze the web application log payload structure in the first log snippet.
Identified 'UNION SELECT' syntax targeting database tables, indicating SQL Injection.
URL parameters containing SQL syntax reveal attempts to force the database backend to execute arbitrary queries.
2
Evaluate the Windows Security Log event parameters and frequency in the second snippet.
Identified Event ID 4625 with SubStatus 0xC000006A repeated across multiple endpoints, indicating password spraying.
A single account attempted across many endpoints in a short window avoids single-host lockout policies while testing credentials broadly.
3
Inspect the network firewall drop log syntax in the third snippet.
Identified internal IP to internal IP traffic blocked on SMB port 445.
Internal segmentation drops on management/sharing ports indicate unauthorized lateral movement attempts within internal zones.
4
Examine the sequential URL access pattern in the fourth log snippet.
Identified automated/manual increment of object identifiers using a single authenticated session, indicating IDOR.
Accessing contiguous resource IDs without authorization parameter checks is a classic signature of broken object-level authorization.

Key Concept

Log Correlation and Telemetry Pattern Identification
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic