Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security analyst is investigating a sequence of correlated Windows Event logs displayed in a SIEM dashboard:

text
2026-07-27T10:14:02Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC01 SubStatus=0xC000006A
2026-07-27T10:14:03Z EventID=4625 TargetUser=svc_sql Workstation=FIN-PC02 SubStatus=0xC000006A
2026-07-27T10:14:05Z EventID=4624 TargetUser=svc_sql Workstation=DC-01 LogonType=3
2026-07-27T10:14:12Z EventID=7045 ServiceName="PSEXESVC" ImagePath="C:\Windows\PSEXESVC.exe"

Based on the log telemetry shown above, which security event is occurring on the network?

  1. Lateral movement using compromised service account credentials followed by remote service creationCevap
  2. B
    A Cross-Site Scripting (XSS) payload execution against an internal domain controller web application
  3. C
    An authorization policy failure where user access permissions were elevated without authentication
  4. D
    Local host privilege escalation resulting from an unpatched system service buffer overflow

Cevap

Lateral movement using compromised service account credentials followed by remote service creation
The log sequence documents multiple failed authentication attempts (Event ID 4625), followed by a successful network authentication (Event ID 4624, LogonType 3) on DC-01, and immediate creation of the PsExec service (Event ID 7045). This correlated telemetry pattern is characteristic of credential misuse and lateral movement across systems.

Adım Adım Çözüm

1
Analyze Event ID 4625 log entries
Identify password spraying or failed authentication attempts across workstations for user 'svc_sql'.
Event ID 4625 signifies a failed logon attempt, and substatus 0xC000006A indicates a bad password.
2
Analyze Event ID 4624 log entry
Confirm successful network logon (LogonType 3) to the DC-01 server using the 'svc_sql' account.
Event ID 4624 indicates successful authentication, and LogonType 3 indicates network authentication (e.g., SMB/PsExec).
3
Correlate with Event ID 7045 log entry
Recognize remote execution tool staging (PSEXESVC.exe) as a new service creation.
Event ID 7045 records the installation of a new system service, which Sysinternals PsExec uses for remote command execution.

Anahtar Kavram

Windows Event Log correlation for lateral movement detection
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru