Defender for Endpoint Live Response

Microsoft Defender for Endpoint (MDE) Live Response is a feature that provides security analysts with a remote, interactive command-line interface (CLI) to Windows devices onboarded to MDE. Unlike automated investigation and remediation (AIR), Live Response requires manual initiation by an analyst with appropriate permissions. It is designed for scenarios where immediate, hands-on action is needed—such as hunting for indicators of compromise (IOCs), collecting specific files, or terminating malicious processes.

Traditional incident response often involves either deploying agents to collect data post-incident or physically accessing the machine. Both are slow and may miss volatile data (e.g., running processes, network connections). Live Response enables real-time interactivity: analysts can run PowerShell scripts, execute built-in commands, and transfer files to/from the device. This reduces mean-time-to-respond (MTTR) and allows containment actions like isolating the device from the network.

When an analyst initiates a Live Response session from the MDE portal (security.microsoft.com), the following sequence occurs:

- Supported Operating Systems: Windows 10 (version 1709+), Windows 11, Windows Server 2016+ (with Microsoft Defender for Endpoint Server). Not supported on Linux or macOS. - Permissions: Requires 'Live Response' permission in Azure AD. Can be assigned via MDE RBAC (Role-Based Access Control) or Azure AD roles. - Session Duration: Maximum 30 minutes of inactivity. Active commands reset the timer. The total session length is not limited as long as activity continues. - Concurrent Sessions: An analyst can have up to 10 concurrent Live Response sessions. - Command Set: Built-in commands include: - background – List background processes. - connections – Show active network connections. - dir – List directory contents. - fileinfo – Get metadata of a file. - find – Search for files. - getfile – Download a file from the device. - kill – Terminate a process by PID or name. - list – List files in the current directory. - log – View the command history. - processes – List running processes. - putfile – Upload a file to the device (max 1 GB). - registry – Query registry keys. - scheduledtask – List scheduled tasks. - services – List services. - trace – Set logging verbosity. - undo – Undo a putfile operation. - Audit Logging: Every command and its output are logged in MDE's Advanced Hunting under DeviceEvents with ActionType like 'LiveResponseCommand'. This is critical for compliance and investigation.

To use Live Response, ensure the device is onboarded to MDE and has internet connectivity. No additional installation is required—the sensor includes the Live Response component.

To check if Live Response is enabled on a device:

To verify sensor connectivity from the device:

To initiate a Live Response session:

To run a PowerShell script:

A financial institution detects ransomware on a workstation via an MDE alert. The SOC analyst initiates Live Response on the affected device. First, they run connections to identify any C2 communication. They see an outbound connection to a known malicious IP. They run kill on the process ID associated with that connection. Then they use processes to check for other suspicious processes. They find a PowerShell process running obfuscated commands and kill it as well. Next, they run getfile to collect the ransomware binary and any scripts for further analysis. Finally, they use the MDE portal to isolate the device from the network to prevent lateral movement. The entire response takes under 10 minutes, significantly reducing impact. The collected files are handed to the threat intelligence team.

A healthcare organization suspects an employee of exfiltrating patient data. The security team initiates Live Response on the employee's device. They use registry to check for USB device usage history. They run dir to list recent files in the Documents folder. They use find to search for files containing 'PHI' or 'patient'. They also run scheduledtask to look for any data exfiltration scripts. The analyst downloads suspicious files via getfile. The session is fully audited, providing chain-of-custody evidence. The organization later uses the logs to terminate the employee and report the incident.

Live Response is designed for targeted, manual response, not mass deployment. In an enterprise with thousands of devices, analysts should prioritize critical devices. Concurrent sessions are limited to 10 per analyst. To scale, organizations use automation via the MDE API to trigger Live Response scripts in response to alerts. Network bandwidth is minimal (command output is text-based; file transfers are the main consumer). Misconfiguration often occurs when permissions are too broad—analysts may have Live Response access to all devices, increasing risk. Best practice is to scope permissions to device groups (e.g., 'Workstations', 'Servers') using MDE RBAC. Another common mistake is forgetting to monitor Live Response sessions; without auditing, malicious use of Live Response could go undetected.