Question

During an incident investigation, a device timeline in Microsoft Defender for Endpoint shows that a suspicious process wrote a value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to an executable in the user's AppData folder. You start a live response session on the affected device to remove this persistence mechanism and confirm the malicious binary is no longer set to auto-start. Which sequence of live response actions accomplishes this?

Accepted Answer

Use 'reg query' to read the Run key, 'remediate' the referenced file, then 'reg delete' to remove the auto-start value, and 're-run 'reg query' to verify

Answer

Run 'isolate' to cut the device off the network, then submit the file hash to the Tenant Allow/Block List

Answer

Use 'getfile' to download the registry hive, then edit it offline and re-import it with 'putfile'

Answer

Run 'scan' to trigger a full antivirus scan, which automatically removes all registry-based persistence entries