Free PAN-XSIAMA Web TestEngine Demo

Q7 Single choice

A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to
launch "Malware pdf.exe".

Which XQL query will always show the correct user context used to launch "Malware pdf.exe"?

A
config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter
action_process_image_name = "Malware.pdf.exe" | fields causality_actor_effective_username
B
config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter
action_process_image_name = "Malware.pdf.exe" | fields actor_process_username
C
config case_sensitive = false | datamodel dataset = xdrdata | filter xdm.source.process.name =
"Malware. pdf.exe" | fields xdm.target.user.username
D
config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter
action_process_image_name = "Malware.pdf.exe" | fields action_process_username

PAN-XSIAMA Web TestEngine demo