Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst receives an automated SIEM alert indicating high-priority authentication anomalies on a critical domain server. The analyst extracts the following log entries from the SIEM console:

text
2026-07-27T14:02:11Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:13Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:15Z Hostname: SEC-DC01 EventID: 4625 Status: 0xC000006D User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:18Z Hostname: SEC-DC01 EventID: 4624 LogonType: 10 User: admin_jdoe SrcIP: 192.168.10.45
2026-07-27T14:02:19Z Hostname: SEC-DC01 EventID: 4672 User: admin_jdoe Privileges: SeDebugPrivilege

Based on these correlated log entries, which of the following security events has occurred?

  1. A successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.Answer
  2. B
    An authorization control failure where an authenticated low-privilege user was denied permission to execute a system process.
  3. C
    A SQL injection attack targeting the domain controller database engine to bypass application authentication.
  4. D
    A network-level denial of service attack flooding port 3389 to exhaust connection pools on the domain controller.

Answer

The log sequence represents a successful password guessing attempt resulting in an interactive Remote Desktop session with administrative privileges assigned.
The correct answer accurately interprets the chronological sequence of Windows Security Event IDs: multiple Event 4625 logs represent failed authentication attempts (brute force), immediately followed by Event 4624 with LogonType 10 indicating a successful Remote Desktop (RDP) session, and Event 4672 confirming administrative privilege elevation.

Step-by-Step Solution

1
Analyze initial failed authentication logs.
Multiple Windows Event ID 4625 entries occur in rapid succession from IP 192.168.10.45 for user admin_jdoe, indicating repeated failed logon attempts (credential guessing/brute force).
Event ID 4625 explicitly logs failed logon attempts in Windows Event Logs.
2
Analyze the subsequent successful logon entry.
Event ID 4624 indicates a successful logon. LogonType 10 specifies Remote Desktop (RDP) interactive network access from the same source IP.
LogonType 10 differentiates Remote Desktop logins from local interactive (LogonType 2) or network share (LogonType 3) logons.
3
Correlate privilege assignment.
Event ID 4672 immediately follows, logging special privileges assigned to the new user session (such as SeDebugPrivilege).
Event ID 4672 confirms the session has superuser or administrative control over the system.

Key Concept

Windows Security Event Correlation in SIEM (Event IDs 4625, 4624, and 4672)
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic