Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security analyst investigates a SIEM alert triggered by the following sequential log entries collected from a Linux authentication server:

Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.44 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.44 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14210]: Failed password for user jdoe from 198.51.100.44 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14214]: Accepted password for user jdoe from 198.51.100.44 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jdoe : TTY=pts/1 ; PWD=/home/jdoe ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on these log entries, which of the following best describes the attack sequence and the correlation rule logic required to detect this incident?

  1. A brute-force or password guessing attempt succeeded against a valid user account, followed by privileged local access attempt; the correlation rule should link multiple failed authentication events from a single source IP with a successful logon and subsequent sudo execution within a short time window.Answer
  2. B
    An unauthorized client bypassed access control lists at the network boundary; the correlation rule should filter on network firewall deny logs and alert on authorization failures originating from external IP ranges.
  3. C
    A Cross-Site Scripting (XSS) attack compromised the session cookies of a web application administrator; the correlation rule should look for HTTP GET requests containing embedded script tags in web server access logs.
  4. D
    A rogue insider executed unapproved software; the SIEM rule should apply a compensating control to permanently disable sudo access for all unprivileged users across the enterprise network.

Answer

The attack sequence consists of an external password guessing or brute-force attack from IP 198.51.100.44 that succeeds against account 'jdoe', followed immediately by a privilege escalation attempt using sudo to read /etc/shadow. The correlation rule must aggregate sequential host authentication events across SSH and sudo logs within a tight temporal window.
The log sequence displays an external IP attempting passwords against multiple user accounts via SSH. After several failures, a login succeeds for user 'jdoe'. Within four seconds, 'jdoe' executes a sudo command to inspect /etc/shadow, which contains password hashes. Effective SIEM management requires linking these sequential events (failures -> success -> privileged command) from the same source into a unified incident alert.

Step-by-Step Solution

1
Analyze initial authentication attempts
Identified multiple SSH failed password attempts from external source IP 198.51.100.44 targeting invalid and valid user accounts (admin, root, jdoe).
Establishes the initial access vector (password guessing/brute force).
2
Analyze successful authentication and subsequent host activity
At 14:02:18, password authentication succeeds for 'jdoe' from the same source IP, followed 4 seconds later by a sudo execution targeting /etc/shadow.
Confirms account compromise and immediate privilege escalation/reconnaissance activity.
3
Formulate SIEM correlation rule criteria
Design a rule requiring: (Failed SSH Auth Count >= threshold from IP_X) AND (Successful SSH Auth from IP_X) AND (Sudo Execution by authenticated user) within Δt <= 60 seconds.
Captures the multi-stage attack context while suppressing single-event noise.

Key Concept

SIEM Event Correlation and Authentication Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic