312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ111

VerifiedUnderstanding Cyber Threats, IoCs, and Attack Methodology

While analyzing IDS logs, Jane, a security analyst, detected an event matching Regex /((\%3C)|<)((\%69)|i|(\%49))((\%6D)|m|(\%4D))((\%67)|g|(\%47))[^\n]+((\%3E)|>)/.

What does this event log indicate?

Explanation

The pattern detects literal or URL-encoded <img ...> HTML markup. Attackers can inject IMG elements and event-handler attributes such as onerror to execute browser-side code, making this a cross-site scripting (XSS) indicator. OWASP documents XSS vectors using IMG tags and encoded forms intended to bypass filters.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!