gromedev / liveresponsedfir

Some packages for use in a Microsoft Defender live response session to get DFIR tools on the system fast

"# LiveResponseDFIR"

.EXAMPLES Useful cmdlets

Get-Process: 
This cmdlet can be used to retrieve information about running processes on the system. For example, you could use the -Name parameter to retrieve information about a specific process by name, or you could use the -ID parameter to retrieve information about a specific process by ID.


Get-NetTCPConnection: 
This cmdlet can be used to retrieve information about active TCP connections on the system. You could use the -State parameter to filter the results by connection state (e.g. Established or Listen), or you could use the -RemoteAddress parameter to filter the results by remote IP address.


Get-EventLog: 
This cmdlet can be used to retrieve entries from the system event log. You could use the -LogName parameter to specify which event log to retrieve entries from (e.g. Application, Security, etc.), and you could use the -EntryType parameter to filter the results by event type (e.g. Error, Warning, etc.).