A security analyst is performing a forensic investigation involving compromised account credentials. Using the Event Viewer, the analyst was able to detect the following message: "Special privileges assigned to new logon." Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?
A) Pass-the-hash
B) Buffer overflow
C) Cross-site scripting
D) Session replay

Question

Quizplus · Accepted Answer

The "Special privileges assigned to new logon" message without a valid logon suggests that an attacker is using a technique like Pass-the-hash, where they use a hash of a user's password to authenticate without needing the actual password, thus bypassing the normal logon process.

A Security Analyst Is Performing a Forensic Investigation Involving Compromised