Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

An internal audit of a web application server reveals the following entries within the web server access log file:

text
192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /api/v1/users?id=101%20OR%201=1 HTTP/1.1" 200 4520
192.168.1.105 - - [27/Jul/2026:14:22:15 +0000] "GET /api/v1/users?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20accounts HTTP/1.1" 200 8940
192.168.1.105 - - [27/Jul/2026:14:22:18 +0000] "POST /api/v1/users?id=101%20EXEC%20xp_cmdshell('whoami') HTTP/1.1" 500 230

Based on these log entries, which of the following attack types has occurred, and what SIEM correlation logic should be deployed to detect similar future attempts?

  1. SQL injection targeting back-end database queries, detectable by SIEM correlation rules that flag SQL syntax keywords within HTTP request parameters combined with successful HTTP 200 responses.Cevap
  2. B
    Cross-Site Scripting (XSS) targeting client browser contexts, detectable by SIEM correlation rules that identify client DOM modification events.
  3. C
    Broken authentication credential stuffing, detectable by SIEM correlation rules alerting on multiple HTTP 401 Unauthorized status responses from a single IP address.
  4. D
    Firewall misconfiguration permitting improper ingress traffic, detectable by SIEM correlation rules monitoring network layer control types and packet drop counts.

Cevap

SQL injection targeting back-end database queries, detectable by SIEM correlation rules that flag SQL syntax keywords within HTTP request parameters combined with successful HTTP 200 responses.
The web log snippet contains explicit database query manipulation patterns such as `OR 1=1`, `UNION SELECT`, and `EXEC xp_cmdshell`. These signatures confirm a SQL injection (SQLi) attack. In SIEM log management, detecting this activity requires parsing URI query strings for database reserved words and correlating them with HTTP 200 OK status responses to catch successful data exfiltration.

Adım Adım Çözüm

1
Analyze the request URI parameters in the log entries.
Identified URL-encoded SQL command structures: `%20OR%201=1` (boolean condition bypass), `%20UNION%20SELECT%20...` (data extraction), and `EXEC xp_cmdshell` (database system procedure invocation).
Log analysis requires inspecting raw string inputs to categorize attack signatures.
2
Differentiate the attack vector from other web vulnerabilities.
Confirmed the attack targets the back-end relational database (SQLi) rather than executing script code in a browser (XSS) or brute-forcing login endpoints (credential stuffing).
Proper threat classification ensures appropriate mitigation and correlation rules are implemented.
3
Formulate the SIEM correlation rule logic.
Combine HTTP request field parsing (looking for SQL keywords like `UNION`, `SELECT`, `EXEC`) with HTTP status code matching (`200 OK` indicating successful query execution and data return).
Effective SIEM rules correlate pattern indicators with response outcomes to minimize false positives.

Anahtar Kavram

SQL Injection Log Identification & SIEM Rule Logic
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru