Question

During an active incident in Microsoft Defender for Endpoint, a SOC analyst identifies a persistence mechanism on an onboarded Windows server: a malicious scheduled task that re-downloads a payload. The analyst wants to remediate the task on the live device without waiting for a full reimage, using a PowerShell script that the SOC team has already validated and stored centrally so it can be reused across future live response sessions. Which action allows the analyst to execute this pre-approved script during a live response session?

Accepted Answer

Upload the script to the live response library, then use the 'run' command referencing the script name within the live response session

Answer

Use the 'putfile' command to copy the script from the analyst's workstation to the device, then execute it with the 'exec' command

Answer

Create an advanced hunting custom detection rule with an automated 'Run script' response action targeting the scheduled task

Answer

Trigger an automated investigation and let Automated Investigation and Response (AIR) remediate the scheduled task automatically