Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is reviewing correlated alerts in a Security Information and Event Management (SIEM) dashboard following an automated high-severity trigger. The SIEM correlated the following two sequential event log entries captured from an internal workstation within a 5-second interval:

text EventID: 4624 Source: Microsoft-Windows-Security-Auditing Time: 2026-07-27T14:22:05Z Logon Type: 3 (Network) Account Name: admin_corp Workstation Name: WS-FINANCE-04 Source Network Address: 10.0.4.112 Elevated Token: Yes EventID: 7045 Source: Service Control Manager Time: 2026-07-27T14:22:10Z User: NT AUTHORITY\SYSTEM Service Name: PSEXESVC Service File Name: %SystemRoot%\PSEXESVC.exe Image Path: C:\Windows\PSEXESVC.exe Start Type: demand start

Which of the following attack vectors is most directly indicated by this log sequence?

  1. Lateral movement executing remote service installation via administrative credentialsAnswer
  2. B
    Cross-site scripting (XSS) payload injection into an internal service management web interface
  3. C
    Privilege escalation caused by broken authorization checks in an API authentication endpoint
  4. D
    Preventive security control failure due to misclassified firewall correlation rules

Answer

Lateral movement executing remote service installation via administrative credentials
The combination of Event ID 4624 showing a Logon Type 3 (Network logon) with an elevated token and Event ID 7045 logged 5 seconds later showing the installation of `PSEXESVC.exe` directly indicates remote execution via PsExec. Attackers frequently leverage PsExec with stolen administrative credentials to move laterally across workstations and servers.

Step-by-Step Solution

1
Analyze Event ID 4624 details
Identified a successful Network Logon (Logon Type 3) using an elevated account (`admin_corp`) initiated from remote host `10.0.4.112`.
Logon Type 3 indicates network authentication to host resources, such as SMB shares or administrative RPC interfaces.
2
Analyze Event ID 7045 details
Identified the installation of a new system service named `PSEXESVC` running executable `PSEXESVC.exe` under `NT AUTHORITY\SYSTEM`.
Event ID 7045 tracks new Windows service creations. `PSEXESVC` is the default service binary registered by Sysinternals PsExec during remote process execution.
3
Correlate both log events in temporal order
Confirmed network authentication followed within 5 seconds by remote service installation.
This specific log pairing is a high-confidence signature of PsExec-based lateral movement across enterprise Windows hosts.

Key Concept

Correlating Windows Security Event ID 4624 (Logon Type 3) and System Event ID 7045 (Service Installation) to detect remote administrative tool usage and lateral movement.
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic