312-39V2: Certified SOC Analyst v2

Question

A SIEM alert is generated because of unusual network traffic involving NetBIOS. The System log indicates that “The TCP/IP NetBIOS Helper service entered the running state”. At the same time, Event Code 4624, “An account was successfully logged on”, appears on multiple machines within a short period. The logon type is identified as 3 (Network logon). Which of the following security incidents is the SIEM detecting?

Explanation

Windows Event ID 4624 with logon type 3 indicates a network logon. A burst of these logons across multiple hosts alongside unusual NetBIOS traffic indicates use of network services to access additional systems, which is a typical lateral-movement pattern.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ23

Community Discussion