SAL2

Practice session

An analyst reviewing Splunk logs notices a user account performed 47 failed logins followed by one successful login, then immediately ran 'net localgroup administrators' and 'whoami /all'. Which attack stage does this sequence most likely represent?

Loading your practice session…