Question

During investigation of a Defender for Endpoint incident, you connect a live response session to a compromised Windows server. The device timeline shows a suspicious scheduled task named 'SysHealthCheck' that re-launches a malicious PowerShell payload every 30 minutes. You have already isolated the device. You need to identify the exact command line and trigger configuration of this scheduled task directly from within the live response session, without downloading and analyzing a full investigation package offline. Which live response command should you use?

Accepted Answer

Run the built-in 'scheduledtasks' command to list scheduled tasks and their configured actions on the device

Answer

Use 'getfile' to retrieve the Task Scheduler binary and inspect it locally

Answer

Run 'analyze file' against the PowerShell payload to determine the task trigger

Answer

Use 'remediate' on the scheduled task to automatically capture its configuration during removal