Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is investigating a high-priority alert in a SIEM platform. The following log snippet was captured from a Linux server's authentication system:

Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.45 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14209]: Failed password for valid user jsmith from 198.51.100.45 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14212]: Accepted password for valid user jsmith from 198.51.100.45 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jsmith : TTY=pts/1 ; PWD=/home/jsmith ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on the log sequence provided, which of the following best describes the nature of the security incident?

  1. An external entity performed a brute-force authentication attack, compromised a valid user account, and subsequently attempted privilege escalation to access system password hashes.Cevap
  2. B
    An authorized user successfully passed authorization checks but failed initial authentication while attempting to inspect system audit policies.
  3. C
    A web application firewall successfully detected and contained a Cross-Site Scripting (XSS) payload prior to root escalation.
  4. D
    An attacker executed a SQL injection attack against a backend database service to bypass local system authentication.

Cevap

An external entity performed a brute-force authentication attack, compromised a valid user account, and subsequently attempted privilege escalation to access system password hashes.
The sequence of log entries shows sequential password attempt failures from a single external IP address within seconds, followed by a successful SSH authentication for user 'jsmith'. Immediately after authenticating, the compromised session issued a sudo command to inspect /etc/shadow, which stores encrypted system password hashes. Correlating these events proves a successful brute-force compromise followed by privileged file access.

Adım Adım Çözüm

1
Analyze the initial authentication log entries
Multiple rapid SSH failure messages ('Failed password') are generated from IP address 198.51.100.45 targeting various account names ('admin', 'root', 'jsmith').
This behavior indicates automated password guessing or a brute-force authentication attack.
2
Analyze the successful authentication entry
At 14:02:18, an 'Accepted password' entry appears for user 'jsmith' from the exact same source IP (198.51.100.45).
This confirms that the brute-force attempt succeeded in compromising legitimate user credentials.
3
Analyze the post-authentication event log
Four seconds after login, the user executes 'sudo /usr/bin/cat /etc/shadow' as root.
Accessing /etc/shadow is an attempt to exfiltrate password hashes, representing immediate post-compromise privilege escalation and credential harvesting.

Anahtar Kavram

Correlating multi-stage authentication logs and privilege escalation indicators in SIEM analysis.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru