Question

During an active incident, you connect a live response session to a compromised Windows server. Your SOC has a vetted PowerShell remediation script named CleanupPersistence.ps1 that must be executed on the device. When you attempt to use the runscript command, live response reports that the script cannot be found. What must you do so the script can be executed through runscript?

Accepted Answer

Upload the script to the live response library in the Defender portal so it is available to the runscript command

Answer

Copy the script to the C:\Windows\Temp folder on the target device and rerun the command

Answer

Use the put command during the session to transfer the script to the device before running it

Answer

Enable unsigned script execution in the endpoint security PowerShell settings policy