Examkin

Question

Difficulty: Very hardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is reviewing SIEM log correlation logic designed to detect unauthorized administrative lateral movement. The SIEM rule requires three conditions to trigger a high-severity alert:
1. A Windows Event ID 4624 (Logon Type 3 - Network) for a service account.
2. A Windows Event ID 4672 (Special privileges assigned) for the same account occurring within 60 seconds60\text{ seconds} of the logon event.
3. A Sysmon Event ID 1 (Process Creation) where `ParentImage` is `services.exe` occurring within 30 seconds30\text{ seconds} of privilege assignment.

The analyst extracts the following log sequence from a compromised server:

text
[2026-07-27T14:10:02Z] Host=SRV-FIN01 EventID=4624 LogonType=3 TargetUserName=svc_backup WorkstationName=WKSTN-77
[2026-07-27T14:11:05Z] Host=SRV-FIN01 EventID=4672 TargetUserName=svc_backup PrivilegeList=SeDebugPrivilege
[2026-07-27T14:11:15Z] Host=SRV-FIN01 EventID=1 Image=C:\Windows\System32\cmd.exe ParentImage=C:\Windows\System32\services.exe

Despite malicious process execution occurring, no SIEM alert was generated. Which of the following best explains why the correlation rule failed to trigger?

  1. The elapsed time between Event ID 4624 and Event ID 4672 was 63 seconds, exceeding the 60-second correlation window.Answer
  2. B
    The correlation engine evaluated Logon Type 3 as a local interactive session rather than a network authentication event.
  3. C
    Event ID 4672 represents identity verification authentication rather than access privilege authorization.
  4. D
    The rule failed because Sysmon Event ID 1 acts as a preventive control rather than a detective monitoring source.

Answer

The elapsed time between the logon event (14:10:02Z) and the privilege assignment event (14:11:05Z) was 63 seconds, which exceeds the 60-second correlation window required by the rule.
The correct answer identifies the timestamp discrepancy between the initial logon log (14:10:02Z) and the privilege assignment log (14:11:05Z). The elapsed duration of 63 seconds exceeds the strict 60-second window configured in the correlation logic, causing the SIEM engine to drop the event sequence before evaluating subsequent conditions.

Step-by-Step Solution

1
Analyze the timestamps of the first two correlated events in the log sequence.
Event ID 4624 occurred at 14:10:02Z and Event ID 4672 occurred at 14:11:05Z.
SIEM correlation rules evaluate temporal relationships between consecutive events.
2
Calculate the time delta between Event ID 4624 and Event ID 4672.
Δt=14:11:05−14:10:02=63 seconds\Delta t = 14:11:05 - 14:10:02 = 63\text{ seconds}.
The rule explicitly requires the privilege assignment event to occur within 60 seconds of the logon event.
3
Evaluate the calculated time delta against the SIEM rule condition.
Since 63 seconds>60 seconds63\text{ seconds} > 60\text{ seconds}, condition 2 of the correlation rule failed, preventing alert generation.
Sliding correlation windows require all boolean conditions and time bounds to be satisfied simultaneously.

Key Concept

SIEM Temporal Event Correlation and Time Window Thresholds
Estimated Time:2m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic