Examkin

Question

Difficulty: MediumLog Analysis and SIEM Management

A security analyst is investigating a sequence of correlated Windows Event logs displayed in a SIEM dashboard:

text
2026-07-27T10:14:02Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC01 SubStatus=0xC000006A
2026-07-27T10:14:03Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC02 SubStatus=0xC000006A
2026-07-27T10:14:05Z EventID=4624 TargetUser=svc_sql Workstation=DC-01 LogonType=3
2026-07-27T10:14:12Z EventID=7045 ServiceName="PSEXESVC" ImagePath="C:\Windows\PSEXESVC.exe"

Based on the log telemetry shown above, which security event is occurring on the network?

  1. Lateral movement using compromised service account credentials followed by remote service creationAnswer
  2. B
    A Cross-Site Scripting (XSS) payload execution against an internal domain controller web application
  3. C
    An authorization policy failure where user access permissions were elevated without authentication
  4. D
    Local host privilege escalation resulting from an unpatched system service buffer overflow

Answer

Lateral movement using compromised service account credentials followed by remote service creation
The log sequence documents multiple failed authentication attempts (Event ID 4625), followed by a successful network authentication (Event ID 4624, LogonType 3) on DC-01, and immediate creation of the PsExec service (Event ID 7045). This correlated telemetry pattern is characteristic of credential misuse and lateral movement across systems.

Step-by-Step Solution

1
Analyze Event ID 4625 log entries
Identify password spraying or failed authentication attempts across workstations for user 'svc_sql'.
Event ID 4625 signifies a failed logon attempt, and substatus 0xC000006A indicates a bad password.
2
Analyze Event ID 4624 log entry
Confirm successful network logon (LogonType 3) to the DC-01 server using the 'svc_sql' account.
Event ID 4624 indicates successful authentication, and LogonType 3 indicates network authentication (e.g., SMB/PsExec).
3
Correlate with Event ID 7045 log entry
Recognize remote execution tool staging (PSEXESVC.exe) as a new service creation.
Event ID 7045 records the installation of a new system service, which Sysinternals PsExec uses for remote command execution.

Key Concept

Windows Event Log correlation for lateral movement detection
Estimated Time:1m 30s
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic