SIEM, Centralized Logging and Attack Detection

What it is

A Security Information and Event Management (SIEM) platform collects logs from many sources into one place, normalizes them and correlates events. An investigator can then follow one attacker across firewalls, servers and applications.

This page covers why central logging matters, the SIEM products to know and how to recognize common attacks in SIEM data.

How it works

Centralized logging using SIEM solutions

Logs kept only on the source device can be erased by an attacker who gains control of it. Sending them to a central, protected store preserves evidence and allows correlation.

Accurate time is essential. All sources should use NTP so events from different devices line up. Retention periods and integrity protection (hashing, write once storage, restricted access) also matter if the logs become evidence.

SIEM solutions

The exam focuses on what a SIEM does and which attack a pattern describes, not on product internals.

Brute force, DoS and malware activity

A correlation rule might read: more than 10 failed logons for one account within five minutes, followed by a successful logon from the same address, raises a high priority alert.

Data exfiltration through FTP

FTP is clear text, so commands and file names are visible. Indicators are large outbound transfers to an external server, STOR (upload) commands, transfers outside working hours, uploads from a database or file server, and use of an account that normally never uses FTP.

Evidence sources: firewall bytes sent, FTP server transfer logs, proxy logs, NetFlow records and packet captures. Compare the amount transferred with the size of the files that were accessed to help judge whether the theft is real.

Network scanning and ransomware

A scan shows one source touching many ports on one host (port scan) or one port on many hosts (sweep), with many SYNs answered by resets and short connections. ICMP sweeps show echo requests to a whole range.

Ransomware shows several stages in the log:

• Initial access: a phishing attachment or exposed service.
• Lateral movement: many SMB connections and remote logons.
• Preparation: backup services stopped and shadow copies deleted, visible as process creation events.
• Encryption: a flood of file writes and renames with a new extension.
• Ransom notes created in many folders and contact with a command server.

Detect a rogue DNS server (hijacking and spoofing)

DNS hijacking changes where names resolve, for example by altering a client or router DNS setting, running a rogue DHCP server that hands out a malicious DNS address, or changing records at the registrar. DNS spoofing (cache poisoning) injects false answers into a resolver's cache.

Countermeasures are DNSSEC, DNS over TLS or HTTPS, source port randomization, DHCP snooping, locked down router settings and monitoring resolver traffic.

A worked example

The SIEM raises an alert: 300 failed Windows logons for an account svc-backup in six minutes from one workstation, then a 4624 success, then a 7045 service install on a server. The analyst searches the SIEM for that source address and finds an earlier port scan across the subnet.

The sequence is consistent with scanning, brute force, successful access and persistence. The analyst exports the events with timestamps and hashes the export before handing it on.

How the exam asks about this

• "What does a SIEM do with logs from different devices?" -> Collects, normalizes and correlates them.
• "A host uploads gigabytes to an external server with STOR commands at 3 a.m. What is suspected?" -> Data exfiltration over FTP.
• "Clients receive wrong IP addresses for a bank site from a server that is not approved. What is it?" -> A rogue DNS server (DNS hijacking or spoofing).