Microsoft Security Operations Analyst Associate SC-200 Practice Question

The has_any operator tests whether a string or dynamic array field contains at least one value from a list of supplied literals. Using has_any with the three substrings lets the query return events whose ProcessCommandLine includes any of them without writing separate OR comparisons.

contains performs a case-insensitive search for a single substring, so you would need three separate conditions. in compares an entire field value to a list of exact matches, which is unsuitable for searching within a longer command line. matches regex requires a regular expression and is more complex than necessary for this simple list comparison.