Examkin

Question

Difficulty: EasyLog Analysis and SIEM Management

A security analyst is reviewing the following firewall Syslog entries forwarded to a SIEM collector:

`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49152 DPT=22`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49153 DPT=80`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49154 DPT=443`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=3389 DPT=3389`

Which of the following network activities is best indicated by this log sequence?

  1. Port scanning targeting multiple standard service ports on a single hostAnswer
  2. B
    Cross-site scripting (XSS) payload execution against an exposed application
  3. C
    User authentication and authorization granting for an administrative session
  4. D
    SIEM correlation parser misinterpretation of encrypted log payloads

Answer

Port scanning targeting multiple standard service ports on a single host
The log entries show a single external source IP address (192.0.2.50) attempting connections to several well-known service ports (22 for SSH, 80 for HTTP, 443 for HTTPS, and 3389 for RDP) on a target host (10.0.1.10) at the exact same second. This pattern of rapidly probing multiple ports on a single host is the classic signature of a port scan.

Step-by-Step Solution

1
Examine the log source and event details
Identified packet drop entries ([FW_DROP]) logged by firewall host fw01.
Understanding the log component helps isolate network traffic events from application or host events.
2
Analyze source IP, destination IP, and timestamps across entries
Source IP 192.0.2.50 sent sequential packets to destination IP 10.0.1.10 at the exact same timestamp (10:15:01).
Rapid attempts from a single source host to a target host indicate automated reconnaissance.
3
Inspect destination ports (DPT) queried
Destinations include TCP ports 22 (SSH), 80 (HTTP), 443 (HTTPS), and 3389 (RDP).
Testing multiple well-known service ports sequentially is standard behavior for network port scanners.

Key Concept

Identifying port scanning behavior from firewall log parameters in SIEM monitoring
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic