Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating a high-severity alert triggered by a SIEM correlation rule on an enterprise Linux server. The log stream displays the following chronologically ordered events:

text
Jul 27 14:15:02 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:05 auth-srv pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.45 user=root
Jul 27 14:15:09 auth-srv sshd[4102]: Accepted password for deploy_admin from 198.51.100.45 port 52144 ssh2
Jul 27 14:15:22 auth-srv sudo: deploy_admin : TTY=pts/1 ; PWD=/home/deploy_admin ; USER=root ; COMMAND=/usr/bin/useradd -m -g sudo backdoor_admin

Which of the following security incidents is most accurately indicated by this log telemetry?

  1. A successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.Answer
  2. B
    A Cross-Site Scripting (XSS) attack that injected malicious client-side scripts into the PAM authentication service to bypass user credentials.
  3. C
    An authorization boundary failure where the system granted root shell access without first completing identity verification.
  4. D
    A SIEM correlation rule misinterpretation caused by log collection tools classifying failed logins as a preventive firewall block action.

Answer

The log telemetry indicates a successful password-guessing attack against a valid user account followed by unauthorized administrative privilege escalation and local user creation.
The correct answer accurately synthesizes the event sequence across multiple host log entries. The initial entries demonstrate automated password guessing (brute force) targeting the root user from IP 198.51.100.45. Shortly after, the attacker successfully authenticates into the deploy_admin user account from the same IP address. Once logged in, the attacker executes a sudo command to create a new local account named backdoor_admin with administrative privileges, which represents post-exploitation activity.

Step-by-Step Solution

1
Analyze the authentication failure logs
Identified two failed SSH authentication attempts for the root user from source IP address 198.51.100.45 within a 3-second window.
Rapid sequential failed login attempts from a single IP indicate credential brute-forcing or password guessing.
2
Analyze the successful authentication log entry
Observed an accepted SSH password login for user deploy_admin four seconds later from the exact same source IP (198.51.100.45).
Correlation of the source IP connects the initial failed guessing attempts with the subsequent successful login into a valid account.
3
Evaluate the post-authentication command log entry
Determined that deploy_admin used sudo to run useradd with root privileges to create a new user named backdoor_admin.
Executing privileged commands immediately after a suspicious authentication event points to post-exploitation activity and privilege escalation.

Key Concept

SIEM Multi-Source Telemetry Correlation & Log Analysis
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic