Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security analyst is investigating a high-priority correlation alert in a Security Information and Event Management (SIEM) dashboard. The analyst reviews the following sequential event logs collected from a Web Application Firewall (WAF), an Nginx web server, and a Linux host kernel audit subsystem (auditd):

text
[2026-07-27T14:22:01.104Z] WAF-ALERT rule_id=942100 severity=CRITICAL client_ip=198.51.100.44 uri="/api/v1/export?format=pdf&cmd=id" action=DETECTED_ONLY
[2026-07-27T14:22:01.108Z] HTTP-ACCESS client_ip=198.51.100.44 status=200 method=GET uri="/api/v1/export?format=pdf&cmd=%3B%20cat%20%2Fetc%2Fpasswd" bytes=4096
[2026-07-27T14:22:01.112Z] AUDITD type=EXECVE pid=88412 ppid=1420 (www-data) comm="sh" args="sh -c cat /etc/passwd"

Based on the provided log telemetry, which of the following conclusions and remediation requirements are correct? (Select TWO.)

  1. The Web Application Firewall was operating in a non-blocking inspection mode, allowing the command injection payload to reach the backend web server.Answer
  2. The attacker successfully executed arbitrary OS commands under the context of the unprivileged web service account (www-data).Answer
  3. C
    The log telemetry demonstrates a successful SQL injection attack that retrieved relational database credentials using URL encoding evasion.
  4. D
    The SOC analyst should reconfigure the WAF inline enforcement mode as a detective security control to prevent HTTP request processing.

Answer

The WAF was operating in detection-only mode, permitting the payload to pass, and the attacker successfully achieved remote OS command execution as the web service user.
Analyzing the log timestamps and fields reveals two key findings: First, the WAF log displays action=DETECTED_ONLY, meaning the WAF alerted on the threat signature but did not drop or reset the TCP connection. Second, the host system audit log (auditd EXECVE) confirms that the web application executed a shell command ('sh -c cat /etc/passwd') under the privileges of the web service account ('www-data').

Step-by-Step Solution

1
Analyze the WAF log entry for enforcement action and alert triggers.
Rule 942100 triggered a critical severity alert for client IP 198.51.100.44, but the action was logged as DETECTED_ONLY rather than BLOCKED.
Determines whether perimeter filtering inline controls prevented the malicious request.
2
Analyze the HTTP web server access log for response status and payload content.
The server returned HTTP status 200 OK with 4096 response bytes for a URI containing URL-encoded shell parameters (%3B%20cat%20%2Fetc%2Fpasswd).
Confirms the backend application accepted the HTTP request and processed it successfully.
3
Correlate host system audit logs (auditd) using process telemetry and timestamps.
Four milliseconds after the HTTP request, auditd logged an EXECVE execution event of 'sh -c cat /etc/passwd' originating from parent process ID 1420 owned by the 'www-data' service account.
Confirms root cause and successful execution of OS command injection on the host OS.

Key Concept

SIEM Correlation of WAF, Web, and Host Logs for Command Injection
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic