CSA (312-39) SOC Simulation Lab
Welcome to the Tier 3 analysis queue. In this simulation, you will analyze web server telemetry and custom SIEM detection logic to identify an active application-layer attack pattern. Sharpen your payload decoding skills.
You are investigating alerts for an e-commerce platform. The application is hosted on IIS and sits behind an Azure Web Application Firewall (WAF). The WAF is currently in "Detection Mode" during a migration window, meaning traffic is logged but not blocked.
The SIEM has triggered a custom alert rule written by the Threat Hunting team. You need to review the logic to classify the alert correctly.
Log Source: W3C IIS HTTP Logs (Forwarded to SIEM via Splunk Universal Forwarder)
Sam, a security analyst with INFOSOL INC., while monitoring and analyzing IIS logs, detected an event matching regex
/\w*((\%27)|(\’))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ix
What does this event log indicate?
%27? What characters do %6F and %72 translate to? Look for the syntax string they form together.
What is happening?
The SIEM is evaluating HTTP request URIs against a regular expression designed to catch malicious syntax escaping out of application boundaries. Attackers frequently use URL-encoding (percent-encoding) to bypass basic WAF rules that only look for plaintext strings.
Why Answer A is Correct
This regular expression explicitly hunts for SQL Injection (SQLi) patterns, specifically boolean-based or authentication bypass attempts involving the SQL OR operator. Let's deconstruct the payload:
((\%27)|(\’))looks for a single quote, either URL-encoded (%27) or literal ('). This is used to break out of a SQL string parameter.((\%6F)|o|(\%4F))looks for the letter 'o' or 'O', URL-encoded or literal.((\%72)|r|(\%52))looks for the letter 'r' or 'R', URL-encoded or literal.
Combined, the regex matches strings like 'or, %27OR, or ' oR. This is the hallmark of an SQLi payload like ' OR 1=1--.
Why the others are wrong
- B. Parameter Tampering: Tampering usually involves modifying hidden fields, user IDs, or price values in the request. It relies on business logic flaws, not breaking database syntax with single quotes.
- C. XSS Attack: Cross-Site Scripting targets the browser. A detection rule for XSS would look for HTML tags or JavaScript handlers like
%3Cscript%3E(<script>),onload=, orjavascript:. - D. Directory Traversal: Traversal attacks attempt to read arbitrary files on the server OS. A regex for this would hunt for dot-dot-slash patterns like
../,%2e%2e%2f, or..\.
💡 Mini Lesson: The Cat-and-Mouse Game of SIEM Regex
As a SOC analyst, relying solely on exact string matches (e.g., searching Splunk for " OR 1=1") is a rookie mistake. Modern attackers use evasion techniques like:
- URL Encoding:
' OR 1=1becomes%27%20OR%201%3D1 - Mixed Case:
oR,Or,OR - Inline Comments:
'/**/OR/**/1=1
This is why the `\w*` and `/ix` (case-insensitive, expanded) flags are critical in custom SIEM logic. When reviewing alerts, always run the matched payload through a tool like CyberChef (URL Decode -> Magic) to see what the backend application actually processed.
Master the SOC Analyst Mindset
Enhance your log analysis and incident response skills.
Explore More CSA Simulations