Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is standardizing correlation rules in an enterprise Security Information and Event Management (SIEM) system. Match each log entry pattern on the left to its corresponding security event or attack vector on the right.

  • CEF:0|Security|SIEM|1.0|4625|Account Logon Failed|5|src=192.168.1.50 dst=10.0.0.5 suser=admin targetUser=admin count=450Automated brute-force authentication event
  • 192.168.1.88 - - [27/Jul/2026:11:04:15 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 5120In-band SQL injection (SQLi) attack
  • {"eventTime":"2026-07-27T10:15:30Z","eventSource":"iam.amazonaws.com","eventName":"PutUserPolicy","errorCode":"AccessDenied","user":"app_user"}Cloud IAM authorization policy failure
  • type=SYSCALL arch=c000003e syscall=59 success=yes exe="/bin/bash" euid=0 egid=0 auid=1002 key="root_shell"Local privilege escalation execution

Answer

Matching pairs: The Common Event Format (CEF) failed logon log corresponds to the Automated brute-force authentication event; the web access log containing UNION SELECT corresponds to the In-band SQL injection attack; the AWS CloudTrail log with AccessDenied corresponds to the Cloud IAM authorization policy failure; and the Linux auditd syscall log spawning root bash corresponds to the Local privilege escalation execution.
Each log archetype displays distinct header and payload indicators: Windows CEF Event ID 4625 with high event counts reflects brute-force authentication activity; UNION SELECT web requests signify SQL injection attempts; CloudTrail AccessDenied events on policy operations reflect authorization rule enforcement; and Linux syscall 59 launching bash with euid=0 from unprivileged auid=1002 demonstrates local privilege escalation.

Step-by-Step Solution

1
Analyze Windows Event ID 4625 and CEF aggregate fields in the first log entry.
Identify Event ID 4625 as a failed logon attempt and count=450 as rapid repeated failures indicative of automated credential brute-forcing.
High-frequency failed logon events targeting authentication endpoints reflect brute-force authentication attempts.
2
Inspect URI query parameters in the second log entry.
Recognize URL-encoded SQL keywords ('UNION SELECT', 'information_schema.tables') used to query database structures.
Injecting database commands into web input parameters is the core indicator of in-band SQL injection.
3
Examine AWS CloudTrail JSON fields in the third log entry.
Evaluate 'eventName: PutUserPolicy' paired with 'errorCode: AccessDenied' as an unauthorized permission modification attempt.
'AccessDenied' during an API authorization check demonstrates role permission enforcement stopping unauthorized policy attachments.
4
Analyze Linux auditd syscall log fields in the fourth log entry.
Correlate syscall 59 (execve) spawning binary '/bin/bash' with effective UID 0 (root) from unprivileged audit identity AUID 1002.
Transitioning execution context from an unprivileged user (auid=1002) to effective root privileges (euid=0) represents local privilege escalation.

Key Concept

Log Analysis and SIEM Correlation
Estimated Time:2m 0s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic