Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security analyst is reviewing the following Linux authentication and system logs aggregated by an enterprise SIEM platform from host `srv-prod-02`:

syslog
2026-07-27T10:14:02Z srv-prod-02 sshd[8812]: Failed password for invalid user admin from 192.0.2.140 port 51102 ssh2
2026-07-27T10:14:05Z srv-prod-02 sshd[8815]: Failed password for invalid user root from 192.0.2.140 port 51106 ssh2
2026-07-27T10:14:12Z srv-prod-02 sshd[8820]: Accepted password for user svc_web from 192.0.2.140 port 51112 ssh2
2026-07-27T10:14:25Z srv-prod-02 sudo[8840]: svc_web : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'

Based on the SIEM event sequence above, which of the following statements correctly analyze the activity and impact of this security incident? (Select TWO.)

  1. The initial SSH activity shows a successful authentication following multiple rapid password failures from the same source IP address.Answer
  2. The sequence demonstrates horizontal initial access transitioning into privilege escalation to superuser (root) status via sudo.Answer
  3. C
    The failed password entries represent an authorization failure caused by missing file-level permissions for remote users.
  4. D
    The log output identifies a reflected cross-site scripting (XSS) exploit targeting the host web application server.

Answer

The incident involves a successful SSH authentication following multiple failed logon attempts from the same source IP, followed by privilege escalation to root via sudo.
The log sequence traces a classic intrusion trajectory starting with brute-force authentication attempts against SSH (failed logins from IP 192.0.2.140), leading to successful authentication as 'svc_web'. Subsequently, the attacker abuses sudo privileges to spawn a root shell using a Python PTY trick, completing privilege escalation.

Step-by-Step Solution

1
Analyze SSH authentication entries in the SIEM log snippet.
Identify multiple failed logins for invalid users ('admin', 'root') from source IP 192.0.2.140 followed by a successful login for 'svc_web' from the same IP.
This indicates a brute-force or credential stuffing attack that successfully gained initial access.
2
Analyze post-authentication command execution in the sudo logs.
Identify that account 'svc_web' executed `/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'` with `USER=root`.
Spawning an interactive shell via Python with sudo grants root administrative privileges, completing a privilege escalation attack vector.

Key Concept

Log Correlation & Incident Trajectory Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic