A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware pdf.exe". Which XQL query will always show the correct user context used to launch "Malware pdf.exe"?
Correct Answer:
A
The correct answer is A -- the query using the field causality_actor_effective_username.
When analyzing events where privilege escalation is used, it is essential to identify the original effective user that initiated the causality chain, not merely the process's own running user (as provided by other fields). The field causality_actor_effective_username specifically provides the effective username context of the actor behind the entire chain of actions that resulted in launching the suspicious executable.
Explanation of fields from Official Document:
causality_actor_effective_username: This field indicates the original effective user who started the entire causality chain.
actor_process_username and action_process_username: These fields indicate the immediate process username, not necessarily reflecting the correct original context when privilege escalation occurs.
Therefore, to always identify the correct user context in privilege escalation scenarios, option A is the verified correct answer.
