Question

During an incident investigation, a SOC analyst connects a live response session to a compromised Windows server. The analyst wants to identify all currently loaded drivers on the device to detect a suspected rootkit, but the built-in live response commands do not include a driver-enumeration command. The analyst has a PowerShell script named 'Get-LoadedDrivers.ps1' that produces the needed output. What must the analyst do before this script can be executed in the live response session?

Accepted Answer

Upload the script to the live response library, then invoke it with the 'run' command during the session

Answer

Use the 'putfile' command to copy the script directly from the analyst's local disk to the device

Answer

Enable unsigned script execution in the tenant, then paste the script contents into the 'runscript' command inline

Answer

Place the script in the device's investigation package and extract it during the session