Defender Live Response

How to Check

Live response opens a command prompt on a device from the Microsoft Defender portal, so you can examine it without going to it. It works on devices that run the Defender for Endpoint sensor. Its commands list the running processes and connections, show what starts automatically and download a file. It cannot look inside a process, at its DLLs, handles, threads or memory, so a clean answer from it never clears a process. For those, take a memory image.

What It Shows

Its built-in commands answer two of the process window's seven tabs, Overview and Network. A script of your own reaches the DLLs and the account on Token, and the rest needs a memory image.

What It Can Reach in a Process

Each tab of the process window is marked by how live response reaches it, so you know what to collect another way.

  • OverviewBuilt-In Commandprocesses
  • DLLsYour Own ScriptGet-Process -Module
  • HandlesNeeds a Memory Imagewindows.handles
  • MemoryNeeds a Memory Imagewindows.vadinfo
  • ThreadsNeeds a Memory Imagewindows.threads
  • NetworkBuilt-In Commandconnections
  • TokenYour Own ScriptGet-Process -IncludeUserNameThe rest: windows.getsids
Built-In Command
Its processes command lists every running process, or one by PID or name, and its connections command lists the device's connections. Check that the JSON output names each connection's process before you read it per process.
Your Own Script
A PowerShell script you upload to the live response library and start with the run command can call Get-Process, which lists the DLLs a process loaded and the account it runs as. Microsoft does not say which account the script runs as, so check that the output covers the process you asked about.
Needs a Memory Image
Live response has no command for these, or for a token's groups, privileges and integrity level. Take a memory image and read it with the Volatility 3 plugin named on each tab.

To take a memory image, read Dumping a Process and Memory

What You Need to Run It

Live response comes with Defender for Endpoint Plan 2, which Microsoft 365 E5 includes, and an admin must turn it on in the Defender portal's advanced features. You then need the basic live response permission to look and download files, or the advanced one to run scripts.

Microsoft Learn: What Live Response Needs, and Its Limits (opens in a new tab)

What It Misses

Every way of looking has gaps, so cover these from another source.

  • There is no built-in process memory dump, and the investigation package holds no memory image, so a full image for Volatility 3 is collected another way.
  • The connections, drivers, persistence, registry, scheduledtasks, services and startupfolders commands run on Windows only. On macOS and Linux, processes is the one process command left, so a missing answer there is not a clean one.

False Positives

These look odd but are normal, so rule them out before you act.

  • A session you or a colleague ran shows in the Defender audit log as Ran live response session, and each command stays in the session's command log. Check who ran it before you treat it as an intruder's.

Sources