SC-200 Practice Question 3844
Exam: SC-200
Domain: Perform threat hunting
Difficulty: hard
You need to find endpoints where an administrative user account was added to the local Administrators security group on Windows endpoints. Which Advanced Hunting table records local group modifications?
Answer Options
A
DeviceEvents (filtering by ActionType == "UserAccountAddedToLocalGroup")
B
DeviceNetworkInfo table
C
EmailEvents table
D
CloudAppEvents table
Correct Answer
A: DeviceEvents (filtering by ActionType == "UserAccountAddedToLocalGroup")
Explanation
The DeviceLocalAssemblyEvents or DeviceEvents table (filtering by ActionType == "UserAccountAddedToLocalGroup") captures local user and group membership modifications.