Perform Actions On A Device

By Ashwin Venugopal -

 



Device Actions

While investigating a device you can perform actions, collect data or remotely access the machine including the following containment actions:

  • Isolate device
  • Restrict app execution
  • Run antivirus scan 

You can perform the following investigation actions:

  • Initiate Automated Investigation
  • Collect investigation package
  • Initiate Live Response Session

The action center provides information on the actions that were taken on a device or file.

Isolate devices from networks

This action can help you to prevent the attacker from controlling the compromised device as well as performing the further activities such as data exfiltration and lateral movement and its isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device.

Once you have selected the isolate device on the device page, type a comment and select confirm after which the Action Center will show you the scan information and the device timeline will include a new event. When a device is being isolated, a notification is displayed to inform the user that the device is being isolated from the network.

Restrict app execution

This action is available for devices on Windows 10, version 1709, or later and also if your organization uses Microsoft Antivirus Defender Antivirus and to restrict an application from running, a code integrity policy is applied that only allows files to run if they are signed by a Microsoft issued certificate which can help you to prevent an attacker from controlling compromised devices as well as performing further malicious activities.

You will be capable to reverse the restriction from applications running at any time and the button on the device page will change to say Remove app restriction, after which you have to take the same steps as restricting app execution. When an app is restricted, a notification is displayed to inform the user that an app is being restricted from running. 

Collect investigation package from devices

As a part of the investigation or response process, you can easily collect an investigation package from a device and can identify the current state of the device as well as further understand the tools and techniques used by the attacker. To download the package (zip file) and investigate the events that occurred on a device:

  • Select Collect investigation package from the row of response actions at the top of the device page.
  • Specify in the text box why you want to do this action. Select Confirm.
  • The zip file will download.   

Alternate way:

  • Select Action center from the response actions section of the device page.
  • In the Action center fly-out, select Package collection package available to download the zip file. 

Initiate live response session

Live response gives security operations teams instantaneous access to a device (also referred to as a machine) by using a remote shell connection which gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats in real time.

Live response is designed to enhance the investigations by enabling your security operations team to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for the emerging threats.

With live response, analysts can do all of the following tasks:

  • Run basic and advanced commands to do the investigative work on a device. 
  • Download files such as malware samples and outcomes of the PowerShell scripts. 
  • Download files in the background (new).
  • Upload a PowerShell script or executable to the library or run it on a device from a tenant level.
  • Take or undo remediation actions. 

 Prerequisites

Before you can initiate a session on a device, make sure you fulfill the following the requirements:

Verify that you are running a supported version on Windows 10- You will also need to enable the live response capability in the Advanced features settings page. 

Only users with manage security or global admin roles can edit these settings. 

Ensure that the device has an Automation Remediation level assigned to it- You'll need to enable, at least, the minimum Remediation level for a give Device Group, otherwise you won't be able to establish a Live Response session to a member of that group. 

Enable live response unsigned script execution (optional) - Allowing the use of unsigned scripts may increase your exposure to threats and running them is not recommended. But if you must use them, then you will need to enable the setting in the Advanced features settings page. 

Ensure that you have the appropriate permissions- Only the users who have been provisioned with the appropriate RBAC permissions can initiate the session. Depending on the role that's being granted to you, you can easily run basic and advanced live response commands. Users' permissions are controlled by the RBAC custom role. 

Limitations:

Live response has the following limitations:
  • Live response sessions are limited to 10 live response sessions at a time.
  • Large-scale command execution is not supported.
  • Live response session inactive timeout value is 5 minutes.
  • A user can only initiate one session at a time.
  • A device can only be in one session at a time. 

  The following file size limits apply:

  • getfile limit- 3 GB
  • fileinfo limit- 10 GB
  • library limit- 250 MB







Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more