To effectively investigate a badly infected computer with a secret type of virus using Microsoft Defender for Endpoint, while preventing its spread and preserving critical forensic information, a security expert leverages several specialized tools. The initial and most critical step is to contain the threat and prevent further lateral movement. This is achieved using the Isolate Device feature directly from the device's page in the Microsoft Defender portal. Isolating the device disconnects it from the organization’s network, preventing the virus from communicating with other systems or command-and-control servers, while crucially maintaining its connection to Defender for Endpoint for continued management and investigation. This action stops the spread without altering the device's internal state for forensic purposes. Once isolated, the expert immediately utilizes Live Response. Live Response provides a direct, real-time command-line interface connection to the infected device, allowing interactive investigation and remediation actions. This tool is paramount for gathering clues without losing important information because it enables the expert to execute forensic commands to collect specific artifacts. For instance, the expert can use commands like `file-get` to safely retrieve samples of the virus binary, suspicio....
Log in to view the answer
