Using Live Response in MDE for IR and forensics.

What is Live response in Microsoft Defender for Endpoint:

“Live response gives security operations teams instantaneous access to a device (also referred to as a machine) using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time.

Live response is designed to enhance investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.”

— Microsoft

How do you enable the feature for your endpoints:

• In the Microsoft XDR portal (security.microsoft.com), go to the settings page at the left side of the screen.
• Click on Endpoint and then go to advanced features and turn on the below three options:

To begin a live response session on an endpoint, go to the devices page and go to three dots at the extreme right of your screen and then click “Initiate Live Response session.”

Example 1: Listing and exporting processes

For testing purposes, some basic PowerShell scripts were created to be run on an endpoint onboarded to MDE.

Powershell script:

# Get information about all running processes
$processes = Get-Process | Select-Object Id, ProcessName, CPU, Memory, StartTime

# Display process information
$processes | Format-Table -AutoSize

Please note that to have an active live response session, your endpoint needs to be powered on. Once your session has been connected you will be provided with the below screenshot:

You can upload the file to the endpoint by clicking the button below :

To run the script, you just have to provide the following command and your script name, in our case it was listallprocesses.ps1

run listallprocesses1.ps1

If we want to export the same results to a text file, we can use the below PowerShell commands:

$processes = Get-Process | Select-Object Id, ProcessName, CPU, Memory, StartTime
$textFilePath = "C:\Path\To\Your\ProcessInfo.txt"
$processes | Out-File -FilePath $textFilePath
Write-Host "Process information exported to: $textFilePath"

The results can be seen below, and the file is saved in the mentioned file path:

You can see from the below screenshot that it is saved in our mentioned file path:

Now let's try to download the file using the live response sessions:

To download a file, use “getfile” command with the file path:

getfile C:\Users\ProcessInfo.txt

The output of the file:

Example 2: Downloading files related to security event logs.

For testing purposes, a script named “testingscript.ps1” was created to add a few users with the password ‘Yourpass12345’. Let's investigate it further using the live response feature to see if we can get any further information.

Usually new user profiles will be shown to you in the file directory: C:\Users.

You can also download the security event logs directly to investigate it on your endpoint using the below command:

getfile C:\Windows\System32\winevt\Logs\Security.evtx

Example 3: Listing and exporting scheduled tasks.

Schedule tasks can be used as a persistence technique to keep a hold of an endpoint after compromise. We can use a powershell script or the in-built Microsoft feature to get information on the schedule tasks.

Get Nived Sawant’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Microsoft has pre-built commands to address this as shown below in Live response:

Although we have taken a different approach - a simple PowerShell script was created to extract this information and export it to a excel file:

$scheduledTasks = Get-ScheduledTask
$scheduledTasks | Select-Object TaskName, Actions, NextRunTime, LastRunTime, IsActive | Format-Table -AutoSize
$scheduledTasks | Select-Object TaskName, Actions, NextRunTime, LastRunTime, IsActive | Export-Csv -Path "C:\ScheduledTasks.csv" -NoTypeInformation -Delimiter ','

The script created a file under the C:\ as shown below :

You can then download it using the below command for further investigation:

getfile C:\ScheduledTasks.csv

Example 4: Listing all the processes used by WMI and exporting them to a csv file.

The following PowerShell command will list processeses used by WMI :

$processes = Get-WmiObject Win32_Process | Select-Object ProcessId, Name, CommandLine
$processes | Export-Csv -Path 'C:\WMIProcesses.csv' -NoTypeInformation
Invoke-Item 'C:\WMIProcesses.csv'

Upload the script through the library in MDE Live response and then execute the following command on the live response console with your file name, in our case it was “wmiprocesses.ps1”:

run wmiprocesses.ps1

Output:

Example 5: Listing all firewall rules on a windows endpoint and exporting them to a csv file

The below PowerShell command will list out all firewall rules on an endpoint and export it to a csv file:

$firewallRules = Get-NetFirewallRule
$excelFilePath = "C:\FirewallLogs.csv"
$firewallRules | Export-Csv -Path $excelFilePath -NoTypeInformation
Write-Host "Firewall logs exported to $excelFilePath"

Upload the script through the library in MDE Live response and then execute the following command on the live response console with your file name, in our case it was “firewallrulesinfo.ps1”:

run firewallrulesinfo.ps1

Output:

Example 6: Listing all services (Running and stopped)

The PowerShell command listed below can be used:

Get-Service | Format-Table -AutoSize

Upload the script through the library in MDE Live response and then execute the following command on the live response console with your file name, in our case it was “services1.ps1”:

run services1.ps1

Output:

Important Directories for IR investigations:

Credit and reference go to 13Cubed Training documents which are available to download, please feel free to refer and learn: Downloads (13cubed.com)

We wont be going super deep on all directories but as for now, we will cover a few examples on how to navigate the directories and download the file which we might need for our investigation.

Browser artifacts:

Edge History (SQLite Database):

getfile C:\Users\[Yourusername]\AppData\Local\Microsoft\Edge\UserData\Default\History

Edge Cookies (SQLite Database):

getfile C:\Users\[Yourusername]\AppData\Local\Microsoft\Edge\UserData\Default\Network\Cookies

Edge Sessions:

getfile C:\Users\[Yourusername]\AppData\Local\Microsoft\Edge\User Data\Default\Sessions

Browser cache information

getfile C:\Users\[Yourusername]\AppData\Local\Microsoft\Edge\User Data\Default\Cache

Conclusion:

Thank you for reading! I trust the blog has provided valuable insights into the functionality of the live response feature and its versatility for a number of purposes.

Similarly, you can improvise and create other PowerShell scripts which can be useful in your incident response process.

Also, exercise caution when utilizing PowerShell scripts from online sources. It’s essential to comprehend the script’s intended purpose and functionality. Thoroughly scrutinize the script’s contents to ensure a clear understanding of its capabilities and potential implications.