Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security team investigating a SIEM alert reviews the following syslog entries from a Linux authentication server:

text
2026-07-27T10:14:02Z auth-srv sshd[10421]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
2026-07-27T10:14:04Z auth-srv sshd[10423]: Failed password for invalid user guest from 198.51.100.45 port 49154 ssh2
2026-07-27T10:14:06Z auth-srv sshd[10425]: Failed password for user root from 198.51.100.45 port 49156 ssh2
2026-07-27T10:14:08Z auth-srv sshd[10428]: Accepted password for root from 198.51.100.45 port 49160 ssh2
2026-07-27T10:14:15Z auth-srv sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on the log snippet, which TWO conclusions accurately describe the activity taking place?

  1. A successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address.Cevap
  2. An authenticated root session executed a privileged command to inspect system password hashes.Cevap
  3. C
    The initial login attempts failed due to authorization policy restrictions rather than identity verification errors.
  4. D
    The log entries demonstrate a successful web application SQL injection payload targeting the authentication database.

Cevap

The logs indicate that a successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address, and that an authenticated root session executed a privileged command to inspect system password hashes.
The SSH service log lines confirm multiple failed password attempts from 198.51.100.45 followed by an accepted password log entry for root. Shortly after, the sudo log line records the execution of a command viewing `/etc/shadow`, confirming privilege execution for credential dumping.

Adım Adım Çözüm

1
Analyze the timestamp and source IP patterns in the sshd log entries.
Three failed password attempts occurred between 10:14:02Z and 10:14:06Z from IP 198.51.100.45, followed immediately by an accepted password entry for user root at 10:14:08Z from the same IP address.
This sequence demonstrates an SSH brute-force or credential guessing attempt resulting in successful access.
2
Analyze the subsequent sudo execution log entry.
At 10:14:15Z, the root user executed `/usr/bin/cat /etc/shadow` via sudo.
The file `/etc/shadow` contains hashed passwords; reading this file represents post-exploitation credential harvesting.

Anahtar Kavram

Log Analysis and SIEM Event Correlation
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru