A SOC analyst is reviewing diverse log artifacts collected across enterprise infrastructure. Match each security log artifact signature to the corresponding incident activity or event type it indicates.
- Windows Security Event ID 4625 with Status Code 0xC000006AFailed user logon attempt resulting from an incorrect password
- HTTP 403 GET request containing `?file=../../../../etc/shadow`Directory traversal attack attempt targeting system configuration files
- NetFlow record showing high-frequency 53/UDP outbound flows with unusually large payload sizesPotential data exfiltration via DNS tunneling
- Linux auth.log entry: `pam_unix(sudo:auth): authentication failure; logname=jdoe uid=1001 euid=0`Unauthorized privilege escalation attempt using superuser execution commands
Cevap
Matching pairs: (1) Windows Event ID 4625 with Status Code 0xC000006A corresponds to a failed user logon attempt due to an incorrect password. (2) HTTP GET request with path traversal characters corresponds to a directory traversal attack attempt. (3) NetFlow record with high-frequency, large UDP 53 payloads corresponds to potential DNS tunneling exfiltration. (4) Linux pam_unix sudo auth failure corresponds to an unauthorized privilege escalation attempt.
Each log snippet exhibits unique protocol and system signatures: Event ID 4625 with status 0xC000006A explicitly flags bad password logons; relative path sequences indicate directory traversal; abnormally large UDP 53 packets reflect DNS covert tunneling; and PAM sudo failure messages record elevated privilege execution blocks.
Adım Adım Çözüm
Anahtar Kavram
Log Analysis and Event Correlation