Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is examining the following aggregated syslog entries ingested into a SIEM platform:

text
Jul 27 11:02:14 jump-srv01 sshd[14201]: Failed password for invalid user admin from 203.0.113.88 port 49152 ssh2
Jul 27 11:02:16 jump-srv01 sshd[14205]: Failed password for invalid user root from 203.0.113.88 port 49154 ssh2
Jul 27 11:02:19 jump-srv01 sshd[14210]: Accepted password for deployer from 203.0.113.88 port 49158 ssh2
Jul 27 11:02:22 jump-srv01 sudo: deployer : TTY=pts/1 ; PWD=/home/deployer ; USER=root ; COMMAND=/bin/bash

Based on the correlated log sequence above, which of the following conclusions accurately describes the security event?

  1. An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.Answer
  2. B
    The SSH daemon successfully prevented unauthorized access by rejecting authentication requests for invalid administrative user accounts.
  3. C
    An authorization failure occurred when the remote host failed to present valid identity credentials during the initial connection requests.
  4. D
    A detective security control failed to operate because the firewall did not implement preventive blocking for incoming remote connections.

Answer

An external IP address successfully authenticated using valid credentials for an existing account after failed login attempts, followed by root privilege escalation.
The log sequence demonstrates an attack timeline: initial failed authentication attempts for common administrative accounts ('admin', 'root') from IP 203.0.113.88, followed three seconds later by a successful SSH authentication for user 'deployer' from the same IP, and finally a `sudo` command execution spawning an interactive root shell (`/bin/bash`).

Step-by-Step Solution

1
Analyze initial log timestamps and event sources
Identified rapid, sequential SSH authentication failures from IP 203.0.113.88 targeting invalid usernames ('admin' and 'root').
Establishes baseline pattern of credential testing or automated brute-force activity.
2
Evaluate subsequent authentication logs
At 11:02:19, SSH accepted the password for the valid account 'deployer' from the same external IP address.
Confirms successful compromise of legitimate user account credentials.
3
Analyze post-authentication command execution telemetry
At 11:02:22, the 'deployer' user executed `sudo` to spawn `/bin/bash` as `root`.
Confirms successful local privilege escalation to root permissions immediately following remote access.

Key Concept

Sequential Log Correlation and Event Reconstruction
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic