nerdexam
Palo_Alto_Networks

XSIAM-ANALYST · Question #18

A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware.pdf.exe." Which XQL query will always show the correct user context used…

The correct answer is C. config case_sensitive = false | dataset = xdr_data | filter event_type =. causality_actor_effective_username records the effective user after privilege changes, ensuring the query returns the actual user context that launched the process even when privilege escalation occurs.

Threat Hunting and XQL Queries

Question

A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware.pdf.exe." Which XQL query will always show the correct user context used to launch "Malware.pdf.exe"?

Options

  • Aconfig case_sensitive = false | dataset = xdr_data | filter event_type =
  • Bconfig case_sensitive = false | datamodel dataset = xdr_data | filter
  • Cconfig case_sensitive = false | dataset = xdr_data | filter event_type =
  • Dconfig case_sensitive = false | dataset = xdr_data | filter event_type =

How the community answered

(26 responses)
  • A
    23% (6)
  • B
    12% (3)
  • C
    62% (16)
  • D
    4% (1)

Explanation

causality_actor_effective_username records the effective user after privilege changes, ensuring the query returns the actual user context that launched the process even when privilege escalation occurs.

Topics

#XQL query#privilege escalation#user context#threat hunting

Community Discussion

No community discussion yet for this question.

Full XSIAM-ANALYST Practice