A. config case_sensitive = false | dataset = xdr_data | filter event_type = ENU
B. PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields causality_actor_effective_username
C. config case_sensitive = false | dataset = xdr_data | filter event_type = ENU
D. PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields actor_process_username
E. config case_sensitive = false | datamodel dataset = xdrdata | filter xdm.source.process.name = "Malware. pdf.exe" | fields xdm.target.user.username
F. config case_sensitive = false | dataset = xdr_data | filter event_type = ENU
G. PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields action_process_username
Explanation:
The correct answer is AC the query using the fieldcausality_actor_effective_username.
When analyzing events where privilege escalation is used, it is essential to identify the original effective user that initiated the causality chain, not merely the process’s own running user (as provided by other fields). The fieldcausality_actor_effective_usernamespecifically provides the effective username context of the actor behind the entire chain of actions that resulted in launching the suspicious executable.
Explanation: of fields from Official Document:
causality_actor_effective_username: This field indicates the original effective user who started the entire causality chain.
actor_process_usernameandaction_process_username: These fields indicate the immediate process username, not necessarily reflecting the correct original context when privilege escalation occurs.
Therefore, to always identify the correct user context in privilege escalation scenarios, optionAis the verified correct answer.
