An analyst uses Zeek's http.log and notices a request where uri is '/wp-admin/admin-ajax.php' and user_agent is 'sqlmap/1.0'. What is the most appropriate immediate action?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because sqlmap is an automated SQL injection tool; requests from it to the WordPress admin interface indicate either an authorized penetration test or an active attack. The first step is checking whether a pentest is authorized before escalating as a security incident.
Full explanation below image
Full Explanation
B is correct because sqlmap is an automated SQL injection tool; requests from it to the WordPress admin interface indicate either an authorized penetration test or an active attack. The first step is checking whether a pentest is authorized before escalating as a security incident. A is wrong because while sqlmap can be used by authorized testers, its presence requires verification; ignoring it risks missing a real attack. C is wrong because blocking the user agent globally is a reactive control but does not address whether the attack succeeded or whether other attack tools are being used with different user agents. D is wrong because restarting the web server does not reverse SQL injection if the database has already been accessed or modified.