During log correlation in a SIEM, an analyst notices: a firewall allows RDP from an external IP, followed 2 minutes later by a Windows Security log showing a successful logon for a service account, followed by execution of PowerShell with encoded commands. What attack phases does this sequence represent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because the sequence shows initial access via external RDP, use of a service account credential to authenticate, and then execution of obfuscated PowerShell — mapping to initial access, credential use, and execution phases. A is wrong because scanning would appear before successful authentication and does not include execution.
Full explanation below image
Full Explanation
C is correct because the sequence shows initial access via external RDP, use of a service account credential to authenticate, and then execution of obfuscated PowerShell — mapping to initial access, credential use, and execution phases. A is wrong because scanning would appear before successful authentication and does not include execution. B is wrong because exfiltration and impact occur later in the attack chain. D is wrong because PowerShell encoding is defense evasion but the sequence also clearly shows initial access and execution phases.