Microsoft Defender for Endpoint curated list of resources for DFIR

<p align="center"> <img src="https://images2.imgbox.com/94/d2/6Jd7QaSP_o.jpg"> </p>

Hey, thank you stopping by! Well, being here means that you are either familiar with the discipline of Digital Forensics & Incident Reponse (DFIR) or you are interested in beginning to explore DFIR tools and techniques. The common denominator, no matter what your sense is around DFIR, is that you are using Microsoft Defender for Endpoint (MDE) and the wider Microsoft Azure and Microsoft Defender environments. I hope you will enjoy the following resources which come from my notes and relevant research and testing I have done. Do you have any other resources that fit here? Drop me a line at any of my mediums here or pull the repo and push your request to review it.

If you find this repo useful, don't forget to ⭐ it!

Table of Contents

• Mitigate threats using Microsoft Defender for Endpoint
• Introducing library management in Microsoft Defender
• Remote collection of Windows Forensic Artifacts using KAPE and MDE
• @BertJanCyber Incident Response guide
• THOR-Cloud forensic scanning through MDE
• HUNTERS Human-Friendly Guide for Incident Response & Threat Hunting
• Microsoft Defender For Endpoint Live Response Script Sources
• Ginsu: A tool for repackaging large collections to traverse Windows Defender Live Response
• Run Remote Triage Collections using Magnet Forensics
• Run Recursive Collections using Cyber Triage
• Using Live Response in MDE for IR and forensics
• Exposing Incognito Mode with Defender for Endpoint
• macOS Forensics -Remote collection and Analysis using Microsoft Defender for Endpoint and Aftermath
• PowerShell Collector
• Selective Isolation in Defender for Endpoint by Combining tools like Velociraptor for DFIR
• KustoHawk

Bonus content

• How to troubleshoot Live Response in Defender for Endpoint

---

Mitigate threats using Microsoft Defender for Endpoint

What better way to begin the resource list other than Microsoft Learn itself? MDE supports a lot of functionalities including artifact collection, containment, live response, advanced hunting and others which help analysts and investigators unfold alerts and incidents.

• Mitigate threats using Microsoft Defender for Endpoint

---

Introducing library management in Microsoft Defender

Recognizing the need for better readiness and control, Defender introduced a more proactive and efficient way to manage these assets: library management. The new library management experience in Defender brings powerful enhancements to how security teams manage scripts and files used in live response.

• Introducing library management in Microsoft Defender

---

Remote collection of Windows Forensic Artifacts using KAPE and MDE

KAPE (Kroll Artifact Parser and Extractor) is a powerful DFIR tool by Eric Zimmerman that primarily collects and processes collected files. @DFIRanjith and Krzysztof Miodoński have built and published guides on how to deploy KAPE through MDE live response and collect forensic artefacts.

• Remote collection of Windows Forensic Artifacts using KAPE and MDE
• Collaboration between KAPE and MDE at the service of the SOC

---

@BertJanCyber Incident Response guide

Bert-Jan (@BertJanCyber), a fellow community contributor has prepared a detailed and comprehensive guide on how to accommodate Microsoft technologies available including KQL queries and Live Response in order to practice the DFIR discipline.

• Incident Response Part 1: IR on Microsoft Security Incidents (KQL edition)
• Incident Response Part 2: What about the other logs?
• Incident Response Part 3: Leveraging Live Response

---

THOR-Cloud forensic scanning through MDE

THOR-Cloud allows live compromise assessment scans for YARA, Sigma and IOCs on endpoints through MDE. THOR-Cloud Lite comes with a free plan as well.

• THOR Cloud Lite Release Session
• THOR Cloud Lite - Microsoft Defender ATP Integration

---

HUNTERS Human-Friendly Guide for Incident Response and Threat Hunting

HUNTERS, an advanced platform that leverages SIEM to help SOC teams, provides highly technical blogs around Microsoft Security. They started unfolding a series of blogs about IR and Threat hunting that really go deep into platform, differentiating sources, user's permissions etc.

• The Human-Friendly Guide: Incident Response & Threat Hunting in Microsoft Azure, Part 1

---

Microsoft Defender For Endpoint Live Response Script Sources

Repositories hosting Powershell script samples for "Live Response" that can be leveraged in your Microsoft Defender For Endpoint Environment.

• Powershell Digital Forensics & Incident Response (DFIR)
• Microsoft Defender Advanced Threat Protection LiveResponse

---

Ginsu A tool for repackaging large collections to traverse Windows Defender Live Response

This script uses 7zip (7za.exe) to compress a specified folder and then splits the resulting archive into sections of 3GB or less. It will work (and was designed for) files larger than 3GB. Windows Defender Live Response currently only supports pulling back files of 3GB or less via the console.

• Ginsu: A tool for repackaging large collections to traverse Windows Defender Live Response
• Ginsu Github Repo

---

Run Remote Triage Collections using Magnet Forensics

Using the Live Response console, you can push Magnet RESPONSE (a free IR data collection tool for members of the forensic community – download the latest version here) to a Windows endpoint, run a triage collection, and pull that collection back for analysis via the console.

• How To Run Remote Triage Collections on Quarantined Endpoints

---

Run Recursive Collections using Cyber Triage

The Defender Live Response feature can be used to deploy the (Cyber Triage Collector to endpoints. The Collector is unique in that it parses and resolves artifacts on the endpoint so that all executable files and documents are collected for in-depth analysis. Cyber Triage can then analyze and score them to identify malicious activity.

You can use both the free and paid version of Cyber Triage for this. Results can be saved to file, S3/Azure, or a Cyber Triage server.

• How To Investigate Endpoints with Cyber Triage and Windows Defender blog post
• User Guide

---

Using Live Response in MDE for IR and forensics

The following blog elaborates many aspects and capabilities from MDE's Live Response, including EDGE browser forensics that could be collected remotely.

• Using Live Response in MDE for IR and forensics

---

How to troubleshoot Live Response in Defender for Endpoint

In this blog, Jeffrey explains the troubleshooting capabilities more in-depth with a strong focus on situations where Live Response is not working as expected.

• How to troubleshoot Live Response in Defender for Endpoint

---

Exposing Incognito Mode with Defender for Endpoint

This blog elaborates a forensics investigation about a malware download, using Chrome's incognito mode.

• Exposing Incognito Mode with Defender for Endpoint

---

macOS Forensics -Remote collection and Analysis using Microsoft Defender for Endpoint and Aftermath

This blog demonstrates how you can remotely collect and Analyze macOS forensic artifacts/triage image using Microsoft Defender for Endpoint and Aftermath.

• macOS Forensics -Remote collection and Analysis using Microsoft Defender for Endpoint and Aftermath

---

PowerShell Collector

A simple, straightforward PowerShell script developed by Marcus Edmondson which allows collecting Event logs, LNK/Jump list files, Prefetch Files and Registry hives all saved in Collector_.zip file in C:.

• PowerShell Collector

---

Selective Isolation in Defender for Endpoint by Combining tools like Velociraptor for DFIR

In this blog, an elaboration of how Selective Isolation works, what Microsoft Defender for Endpoint (MDE) can offer natively, how it can be extended with Velociraptor, and what a modern DFIR process looks like when combining containment with full investigative access.

• MDE Selective Isolation Velociraptor

---

KustoHawk

KustoHawk is a incident triage and response tool for Microsoft Defender XDR and Sentinel environments. The script collects common indicators of compromise and returns a complete picture of the activities performed by an device of account. The tool leverages Graph API to run the hunting queries across your unified XDR environment.

• KustoHawk