Examkin

Question

Difficulty: Very hardLog Analysis and SIEM Management

Match each security log entry snippet extracted from enterprise monitoring systems to the corresponding attack vector or security incident type it accurately represents.

  • GET /products.php?id=12%20AND%201=CONVERT(int,(SELECT%20@@version)) HTTP/1.1 500 Internal Server ErrorError-Based SQL Injection (SQLi)
  • Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44500 DPT=21 FLAGS=SYN
    Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44501 DPT=22 FLAGS=SYN
    Jan 14 10:15:02 firewall kernel: DROP IN=eth0 OUT= SRC=192.168.1.50 DST=10.0.0.50 PROTO=TCP SPT=44502 DPT=23 FLAGS=SYN    Reconnaissance / Horizontal Port Scanning
  • EventID 4769: Service Name: MSSQLSvc/db01.corp:1433, Ticket Options: 0x40810000, Ticket Encryption Type: 0x17 (RC4-HMAC-MD5)Kerberoasting Credential Theft
  • POST /avatar_upload.php HTTP/1.1 200 OK
    Content-Type: multipart/form-data; boundary=----
    Content-Disposition: form-data; name="file"; filename="shell.php.png"

    <?php system($_GET['cmd']); ?>    Unrestricted File Upload / Web Shell Deployment

Answer

1. GET request with database CONVERT function syntax maps to Error-Based SQL Injection (SQLi).
2. Firewall drop logs showing rapid sequential destination port connection attempts map to Reconnaissance / Horizontal Port Scanning.
3. Windows Event ID 4769 requesting TGS tickets with RC4 encryption for SPNs maps to Kerberoasting Credential Theft.
4. Multipart POST request containing PHP command execution syntax inside image uploads maps to Unrestricted File Upload / Web Shell Deployment.
Each security log snippet exhibits unique protocol and event attributes: SQL execution syntax in HTTP GET parameters indicates Error-Based SQL Injection; sequential port probes in firewall logs indicate Horizontal Port Scanning; Windows Event ID 4769 with legacy RC4 encryption indicates Kerberoasting; and PHP command injection inside multipart uploads indicates Web Shell Deployment.

Step-by-Step Solution

1
Analyze the web request URL parameter containing SQL type conversion functions (`CONVERT`).
Identified as Error-Based SQL Injection.
Forcing database conversion errors forces backend SQL engines to output internal state data into application error pages.
2
Examine firewall drop events originating from a single source host probing sequential port numbers in sub-second intervals.
Identified as Horizontal Port Scanning.
Sequential attempts on standard service ports (FTP/21, SSH/22, Telnet/23) indicate active network reconnaissance.
3
Evaluate Active Directory Event ID 4769 requesting Kerberos service tickets for Service Principal Names (SPNs) using RC4-HMAC encryption.
Identified as Kerberoasting.
Requesting TGS tickets with legacy RC4 encryption enables threat actors to extract ticket hashes and crack service passwords offline.
4
Inspect the file upload POST payload containing raw PHP system call instructions within a disguised file extension.
Identified as Web Shell Deployment via Unrestricted File Upload.
Bypassing extension controls to write executable server scripts permits persistent remote administrative control.

Key Concept

SIEM Log Analysis and Threat Signature Pattern Matching
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic