QuestionQ9

Host-Based Analysis

Question Image

Refer to the exhibit. A SOC analyst is reviewing the Auth.log logs from one of the breached systems. What is a possible reason for this event log?

Explanation

Repeated SSH authentication failures for the root account from 10.10.10.10 indicate a brute-force password-guessing attack targeting a Linux system.

Community Discussion

No comments yet. Be the first to start the discussion!