Examkin

Soru

Zorluk: ZorLog Analysis and SIEM Management

A security analyst is investigating an unalerted data breach involving an e-commerce platform. The SIEM correlated the following log snippets from the Web Application Firewall (WAF) and database server:

[WAF_LOG] 2026-07-27T14:22:10Z | src=198.51.100.45 | uri=/catalog.php?cat_id=5%20UNION%20SELECT%20usr,pwd_hash%20FROM%20admin-- | action=PASS | status=200
[DB_LOG] 2026-07-27T14:22:11Z | user=db_web_app | query="SELECT * FROM items WHERE cat_id=5 UNION SELECT usr,pwd_hash FROM admin--" | status=SUCCESS | rows_returned=4500

Based on these log entries, which of the following best describes the attack vector and the appropriate SIEM correlation enhancement required to detect future attempts?

  1. A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.Cevap
  2. B
    A stored Cross-Site Scripting (XSS) attack executed client-side code to harvest user password hashes; the SIEM correlation rule should be updated to detect unencoded script tags in web HTTP POST parameters.
  3. C
    An authentication failure occurred when the web service account db_web_app attempted to log into the database without administrative privileges; the SIEM correlation rule should be configured to flag failed login events in the AAA log stream.
  4. D
    The log pattern indicates a false positive created by timestamp clock drift between the WAF and database host systems during routine administrative reporting; the SIEM correlation rule tolerance window should be expanded.

Cevap

A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.
The log entries exhibit a classic SQL injection payload ('UNION SELECT usr,pwd_hash FROM admin--') that passed through the WAF and executed against the underlying database server, returning 4,500 records. Enhancing SIEM correlation rules to link successful web HTTP responses containing SQL manipulation patterns with abnormally high backend database row return counts provides effective detection for successful application-layer exfiltration.

Adım Adım Çözüm

1
Analyze the WAF log payload string
The parameter value '/catalog.php?cat_id=5 UNION SELECT usr,pwd_hash FROM admin--' contains SQL syntax intended to append database query commands.
Identifying SQL syntax structure confirms the attack is a SQL Injection (SQLi) attack.
2
Correlate WAF response with Database audit log
The WAF passed the request (action=PASS, status=200), and the database executed it successfully, returning 4,500 rows.
This confirms successful database data extraction despite WAF inspection.
3
Determine SIEM rule modification
Correlating successful HTTP status codes (200 OK) containing SQL input structures with high row count returns from the database backend effectively detects successful SQLi exfiltration.
Traditional single-event rules failed because WAF passed the traffic; multi-source correlation across web and DB logs bridges the detection gap.

Anahtar Kavram

Log Correlation across Web Firewall and Database Logs for SQL Injection Detection
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru