During log correlation in a SIEM, an analyst notices: a firewall allows RDP from an external IP, followed 2 minutes later by a Windows Security log showing a successful logon for a service account, followed by execution of PowerShell with encoded commands. What attack phases does this sequence represent?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — c is correct because the sequence shows initial access via external RDP, use of a service account credential to authenticate, and then execution of obfuscated PowerShell — mapping to initial access, credential use, and execution phases. A is wrong because scanning would appear before successful authentication and does not include execution.
Full Explanation
C is correct because the sequence shows initial access via external RDP, use of a service account credential to authenticate, and then execution of obfuscated PowerShell — mapping to initial access, credential use, and execution phases. A is wrong because scanning would appear before successful authentication and does not include execution. B is wrong because exfiltration and impact occur later in the attack chain. D is wrong because PowerShell encoding is defense evasion but the sequence also clearly shows initial access and execution phases.