A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events: Date and time Source Event ID 12/26/2019 11:37:21 PM Microsoft Windows security auditing 14771 Keywords Kerberos pre- authentication failed. Kerberos pre- authentication failed. Kerberos pre- authentication failed. 12/26/2019 11:37:21 PM Microsoft Windows security auditing 4771 12/26/2019 11:37:22 PM Microsoft Windows security auditing 4771 To better understand what is going on, the analyst runs a command and receives the following output: name lastbadpasswordattempt badpwdcount John. Smith 12/26/2019 11:37:21 PM 7 Joe. Jones 12/26/2019 11:37:21 PM 13 Michael. Johnson 12/26/2019 11:37:22 PM 8 Mary.Wilson 12/26/2019 11:37:22 PM 8 Jane. Brown 12/26/2019 11:37:23 PM 12 Based on the analyst's findings, which of the following attacks is being executed? A. Credential harvesting B. Keylogger C. Brute-force D. Spraying
