CSA (312-39) SOC Simulation Lab
Scenario Context
You are a Tier 3 SOC Analyst reviewing an escalated ticket from a junior analyst. Microsoft Sentinel has triggered a "Multiple Failed Logins (Event ID 4625)" alert for the user j.smith@terabytes.local against an external-facing VPN gateway.
The L1 analyst notes: "Looks like a standard brute-force attack. Requesting IP block." You pull the raw logs to verify the attack type before implementing the block, as understanding the methodology helps predict the attacker's next move.
Security Environment (Telemetry)
Review the following extract from the SIEM's authentication logs detailing the failed attempts:
Question
Which attack works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?
Expert Insight
What is happening:
The threat actor is targeting a specific account using an automated script. However, instead of guessing every possible combination of characters (a true brute-force), they are leveraging a wordlist (dictionary) containing base words like "Spring" and "Company", and applying mutation rules to append numbers and symbols. Tools like Hashcat use "rule-based attacks" to automate this exact behavior.
Why Hybrid Attack (A) is correct:
A Hybrid Attack is specifically defined as combining a dictionary attack with brute-force techniques—namely, taking known words and permuting them by adding numbers, symbols, or changing capitalization. Note: Some legacy exam dumps incorrectly list "B" (Bruteforce) for this question. As a SOC analyst, you must know that the exact definition provided in the prompt describes a Hybrid Attack.
Why the others are wrong:
- Bruteforce Attack: A pure brute-force attack exhaustively tries all possible combinations of characters in a given keyspace (e.g., aaaa, aaab, aaac). It does not rely on a base dictionary word.
- Rainbow Table Attack: Uses massive precomputed tables of hashes to reverse a captured password hash. It is an offline attack against a database, not an online guessing attack against a login portal.
- Birthday Attack: A cryptographic attack that exploits the mathematics behind the birthday paradox to find hash collisions (two different inputs producing the same hash output). It is not used for guessing user passwords.
MINI LESSON: Why Hybrid Attacks Succeed & How to Detect Them
Hybrid attacks are incredibly successful because they weaponize standard corporate password policies.
- The Policy Flaw: When IT requires "at least one capital letter, one number, and one special character," users predictably create passwords like
Summer2026!orPassword123@. - The Attacker's Tooling: Attackers use tools like Hashcat or John the Ripper. They load a small dictionary of company-specific terms and apply a rule set (like the famous
best64.rule) that automatically generates these exact permutations. - SOC Detection Logic: Don't just alert on "X failed logins in Y minutes." Advanced SIEM logic should look for Pattern Similarities in failed login payloads (if available in logs) or correlate IP addresses cycling through seasonal passwords across multiple users (Password Spraying).