Examkin

Soru

Zorluk: Çok zorLog Analysis and SIEM Management

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

  1. 1WAF / Web Server Log: 192.0.2.45 - - [14/Oct/2026:08:12:01 +0000] "POST /login.php HTTP/1.1" 200 4520 "' UNION SELECT 1,username,password_hash FROM users--" "Mozilla/5.0"
  2. 2EDR Process Line Log: [08:14:22 UTC] Parent: www-data (PID 1042) -> Child: cmd.exe /c "powershell.exe -NOP -W Hidden -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0..."
  3. 3Windows Security Event 4688: [08:17:05 UTC] Process Creation | New Process: rundll32.exe | Command Line: rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 624 C:\Windows\Temp\lsass.dmp full
  4. 4Windows Security Event 4624: [08:21:40 UTC] Logon Type 3 (Network) | Target User: DomainAdmin | Source IP: 10.0.4.15 | Workstation: WEB-SRV01 | Auth: NTLMv2
  5. 5Windows Security Event 4698: [08:25:12 UTC] Scheduled Task Created | Task Name: \Microsoft\Windows\Maintenance\Updater | Action: powershell.exe -e <encoded_payload>

Cevap

The correct chronological order of the intrusion progression is: (1) SQL injection web access log, (2) Obfuscated PowerShell execution from web daemon, (3) LSASS process memory dump via comsvcs.dll, (4) Network Logon Type 3 lateral movement using NTLMv2, and (5) Scheduled Task creation for persistence.
Analyzing log artifacts chronologically requires mapping specific event signatures to the Cyber Kill Chain / MITRE ATT&CK framework: 1. Web exploitation (SQL Injection in web access logs) provides Initial Access. 2. Web daemon spawning encoded PowerShell (EDR log) represents Execution. 3. Dumping LSASS memory via comsvcs.dll (Event 4688) represents Credential Access. 4. Using stolen credentials to log into an internal system via network authentication (Event 4624 Type 3) represents Lateral Movement. 5. Creating a scheduled task (Event 4698) on the internal target host represents Persistence.

Adım Adım Çözüm

1
Identify Initial Access / Exploitation phase
Recognize the web server log showing a HTTP POST request containing 'UNION SELECT SQL injection payload as the initial attack vector.
Attacks begin with initial perimeter exposure or application exploitation before internal execution can occur.
2
Identify Execution / Payload delivery phase
Locate EDR process creation log showing the web process (www-data) spawning cmd.exe and encoded PowerShell.
Exploitation of web vulnerabilities is immediately followed by shell command execution to establish operational control.
3
Identify Credential Access / Privilege Escalation phase
Identify Windows Event 4688 executing rundll32.exe comsvcs.dll MiniDump to dump LSASS memory.
Once on a host, attackers dump memory to extract cleartext credentials or hashes required for lateral movement.
4
Identify Lateral Movement phase
Correlate Windows Event 4624 (Logon Type 3) originating from the compromised web server (10.0.4.15) using DomainAdmin credentials.
Harvested credentials enable network authentication to access other internal enterprise systems.
5
Identify Persistence phase
Identify Windows Event 4698 indicating a scheduled task creation running an encoded PowerShell script.
After establishing access on internal high-value targets, persistent mechanisms (scheduled tasks, registry run keys) ensure continuous access.

Anahtar Kavram

Multi-Source Log Correlation and Attack Lifecycle Reconstruction
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru