Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is inspecting SIEM alerts originating from an internal web server hosting an enterprise customer portal. The SIEM correlated the following sequential Sysmon process creation events:

text
EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:12.102
Image: C:\Windows\System32\inetsrv\w3wp.exe
CommandLine: w3wp.exe -ap "CustomerPortalPool"
User: NT AUTHORITY\NETWORK SERVICE

EventID: 1 (Process Create)
UtcTime: 2026-07-27 11:04:15.884
ParentImage: C:\Windows\System32\inetsrv\w3wp.exe
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -EncodedCommand aW52b2tlLXdlYnJlcXVlc3Q...
User: NT AUTHORITY\NETWORK SERVICE

Based on the log evidence provided, which of the following best describes the security incident taking place?

  1. A web application vulnerability was exploited to achieve remote code execution by spawning a command interpreter from the IIS worker process.Answer
  2. B
    A client-side Cross-Site Scripting (XSS) attack was successfully executed within an end user's web browser session.
  3. C
    An administrator logged in via SSH/RDP and launched a standard scheduled maintenance task within the application pool.
  4. D
    A brute-force authentication attack succeeded in elevating privileges to domain administrator via the web login page.

Answer

The incident represents web application exploitation resulting in server-side remote code execution, as demonstrated by the IIS web server process spawning a shell interpreter.
The correct analysis recognizes that `w3wp.exe` is the Internet Information Services (IIS) worker process responsible for serving web request code. When `w3wp.exe` acts as the parent process launching `cmd.exe` or `powershell.exe`, it signifies that an attacker exploited a web application flaw (such as command injection) to execute arbitrary commands on the host server.

Step-by-Step Solution

1
Analyze the parent-child process relationship in the Sysmon log entries.
The parent process is `w3wp.exe` (IIS Worker Process) and the child process is `cmd.exe` launching `powershell.exe`.
Web servers (`w3wp.exe`) should handle HTTP traffic and should not routinely launch interactive command prompt shells or PowerShell scripts.
2
Evaluate the command-line parameters and executed payload attributes.
The command includes `-nop -w hidden -EncodedCommand`, which are common evasive flags used to conceal malicious script execution.
Attackers frequently use Base64 encoding and hidden windows to bypass basic command-line monitoring.
3
Synthesize the log findings to classify the attack vector.
Spawning a system shell from a web daemon process confirms server-side Remote Code Execution (RCE) via web application vulnerability exploitation.
Exploits such as command injection or insecure deserialization force the web service account to execute arbitrary shell commands.

Key Concept

Identifying Remote Code Execution (RCE) and anomalous process lineage in web server and SIEM logs
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic