Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

Match each telemetry log snippet to the corresponding security event or attack vector.

  • 192.168.1.105 - - [27/Jul/2026:14:22:01] "GET /products.php?id=1%20UNION%20SELECT%201,username,password%20FROM%20users-- HTTP/1.1" 200 4521Web application SQL injection (SQLi) attempt extracting database contents
  • Jul 27 14:25:03 auth-srv sshd[4102]: Failed password for root from 198.51.100.42 port 49152 ssh2 (repeated 150 times in 30s)High-velocity Secure Shell (SSH) authentication brute-force attack
  • EventID: 4624, LogonType: 10, TargetUserName: Admin_svc, WorkstationName: DESKTOP-7K9L2, IpAddress: 203.0.113.15Remote Desktop Protocol (RDP) remote interactive logon success
  • Jul 27 14:30:12 fw-edge firewall: DENY TCP src=192.168.1.50 dst=10.0.0.5 dst_port=445 flags=SYN (threshold exceeded: 5000 pkts/sec)Internal network traffic burst indicative of SMB port scanning or worm activity

Cevap

Log entry 1 matches SQL injection; Log entry 2 matches SSH brute-force; Log entry 3 matches RDP remote interactive logon; Log entry 4 matches SMB traffic burst scanning.
Each log archetype displays distinct key indicators: database commands inside HTTP query strings signify SQL injection; repeated rapid SSH password failures indicate brute-force login attempts; Event ID 4624 with LogonType 10 represents RDP remote logins; and high-volume blocked TCP 445 packets represent SMB scanning.

Adım Adım Çözüm

1
Analyze web access log parameters
Identify HTTP query string containing 'UNION SELECT 1,username,password FROM users--', confirming SQL injection.
Web server logs capture HTTP parameters that expose malicious payload structures.
2
Inspect authentication server syslog entries
Identify 150 failed password attempts within 30 seconds for root over SSH.
High frequency of failed SSH logons points directly to automated brute-force attacks.
3
Evaluate Windows Event ID and LogonType attributes
Confirm EventID 4624 with LogonType 10 corresponds to Remote Desktop Protocol (RDP) sessions.
LogonType 10 specifically designates RemoteInteractive access in Windows Security event logs.
4
Review firewall drop rules and destination ports
Associate DENY TCP traffic targeting port 445 in high bursts with SMB port scanning or automated lateral movement probes.
TCP port 445 is utilized for Server Message Block (SMB) services.

Anahtar Kavram

SIEM Log Pattern Recognition and Event Analysis
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru