XSIAM-ANALYST · Question #18
A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware.pdf.exe." Which XQL query will always show the correct user context used…
The correct answer is C. config case_sensitive = false | dataset = xdr_data | filter event_type =. causality_actor_effective_username records the effective user after privilege changes, ensuring the query returns the actual user context that launched the process even when privilege escalation occurs.
Question
A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware.pdf.exe." Which XQL query will always show the correct user context used to launch "Malware.pdf.exe"?
Options
- Aconfig case_sensitive = false | dataset = xdr_data | filter event_type =
- Bconfig case_sensitive = false | datamodel dataset = xdr_data | filter
- Cconfig case_sensitive = false | dataset = xdr_data | filter event_type =
- Dconfig case_sensitive = false | dataset = xdr_data | filter event_type =
How the community answered
(26 responses)- A23% (6)
- B12% (3)
- C62% (16)
- D4% (1)
Explanation
causality_actor_effective_username records the effective user after privilege changes, ensuring the query returns the actual user context that launched the process even when privilege escalation occurs.
Topics
Community Discussion
No community discussion yet for this question.