Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing the following aggregated log entries from a SIEM alert involving an internal host (10.2.12.85):

[Log 1: Active Directory Domain Controller - Event ID 4768]
TargetUserName: svc_database
ServiceTicketOptions: 0x40810000
TicketEncryptionType: 0x17 (RC4-HMAC)
ClientAddress: 10.2.12.85

[Log 2: Host Endpoint Sysmon - Event ID 1]
ProcessID: 4820
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -e JABzAD0...
ParentImage: C:\Windows\System32\services.exe

[Log 3: Perimeter Firewall Log]
SrcIP: 10.2.12.85:51244 | DstIP: 198.51.100.72:443 | Protocol: TCP | SentBytes: 485200 | RecvBytes: 1420 | Action: ALLOW

Based on the log correlation above, which of the following cyber attack techniques is occurring?

  1. Kerberoasting combined with encoded command execution and covert data exfiltrationAnswer
  2. B
    Cross-Site Scripting (XSS) targeting a backend database service to manipulate SQL queries
  3. C
    Authorization bypass due to misconfigured access control lists on the perimeter firewall
  4. D
    A false positive alert resulting from misinterpreting a routine administrative batch script run

Answer

The correlated logs demonstrate Kerberoasting combined with encoded command execution and covert data exfiltration.
The combination of requesting RC4-encrypted Kerberos tickets for a service account (Event ID 4768), spawned obfuscated PowerShell processes (Sysmon Event ID 1), and a disproportionately large outbound network transfer points directly to Kerberoasting followed by automated payload execution and exfiltration.

Step-by-Step Solution

1
Analyze Log 1 (Active Directory Event ID 4768)
Identify a Kerberos TGS request for service account 'svc_database' using legacy RC4 encryption (0x17), indicative of Kerberoasting.
Attackers request Kerberos service tickets with RC4 encryption because they can be cracked offline to reveal service account passwords.
2
Analyze Log 2 (Sysmon Event ID 1)
Identify suspicious obfuscated command execution via PowerShell launched by cmd.exe.
Base64 encoded command arguments (-e / -encodedcommand) are frequently utilized by post-exploitation frameworks to bypass simple command line inspection.
3
Analyze Log 3 (Perimeter Firewall Log)
Identify anomalous outbound transfer (485KB sent vs 1.4KB received) over HTTPS.
A high ratio of sent bytes compared to received bytes to an external IP address signals data exfiltration.

Key Concept

Log Correlation and SIEM Multi-Source Threat Analysis
Estimated Time:2m 0s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic