dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "ntdsutil.exe" and lowercase(action_process_image_command_line) contains "ifm" and lowercase(action_process_image_command_line) contains "create"
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time