Live Response

Live Response provides governed remote access to managed endpoints for investigation, forensics, and remediation. This guide covers establishing connections, executing approved commands, and managing live response sessions.

Advanced Alpha boundary: Live Response actions are deployment-gated. Destructive commands, unrestricted shell access, and host-changing remediation must be explicitly enabled, authorized, audited, and validated in the target operating system profile before production use.

Overview

Live Response enables security analysts to:

• Execute approved commands on remote endpoints in real-time
• Collect files and artifacts for analysis
• Manage processes and services
• Query and modify system configuration
• Perform remediation actions
• Conduct live forensic investigation

[Screenshot: Live Response session overview with command prompt]

Connect to Agent

Prerequisites

Before initiating a Live Response session:

Initiating a Session

From Agent List

1. Navigate to Agents
2. Select target agent
3. Click Live Response in the action toolbar
4. Session initializes automatically

From Alert

1. Open alert details
2. Click Live Response in response actions
3. Session connects to affected endpoint

From Investigation

1. Open investigation
2. Navigate to Agents section
3. Click Live Response on target agent

[Screenshot: Live Response connection initialization]

Session Initialization

Upon connection:

1. Authentication: Session authenticated via existing console credentials
2. Verification: Agent verifies session token
3. Handshake: Secure channel established
4. Ready: Command prompt available

Connecting to WORKSTATION-042...
Session authenticated
Secure channel established
Agent version: 2.5.0
OS: Windows 11 Pro (22H2)

tamandua> _

Connection Troubleshooting

Available Commands

Live Response provides a comprehensive command set for endpoint interaction.

Command Categories

Command Reference

System Commands

info

Display system information:

tamandua> info

System Information
==================
Hostname:      WORKSTATION-042
Domain:        corp.local
OS:            Windows 11 Pro
Build:         22621.2861
Architecture:  x64
Install Date:  2023-06-15
Last Boot:     2024-01-15 08:32:00
Uptime:        6h 12m 34s

uptime

Show system uptime:

tamandua> uptime
System uptime: 6 hours, 12 minutes, 34 seconds
Last boot: 2024-01-15 08:32:00 UTC

[Screenshot: System info command output]

Process Commands

ps

List running processes:

tamandua> ps

PID    PPID   Name                User              Memory    CPU    Started
---------------------------------------------------------------------------
4      0      System              SYSTEM            0.1 MB    0.1%   08:32:00
88     4      Registry            SYSTEM            32 MB     0.0%   08:32:00
456    4      smss.exe            SYSTEM            1.2 MB    0.0%   08:32:01
...
2340   1456   chrome.exe          corp\john.doe     450 MB    2.3%   09:15:30
5678   1234   powershell.exe      corp\john.doe     85 MB     1.2%   14:32:45

Filter processes:

tamandua> ps -name powershell
tamandua> ps -user john.doe
tamandua> ps -pid 5678

kill

Terminate a process:

tamandua> kill 5678
Process 5678 (powershell.exe) terminated successfully

tamandua> kill -name notepad.exe
Killed 3 processes matching 'notepad.exe'

Options:

• -pid: Kill by process ID
• -name: Kill by process name
• -tree: Kill process and all children
• -force: Force termination

memdump

Capture process memory:

tamandua> memdump 5678
Capturing memory for process 5678 (powershell.exe)...
Memory dump size: 85 MB
Compressing...
Uploading to investigation artifacts...
Complete: artifact_20240115_143500_memdump_5678.dmp

[Screenshot: Process list and kill command]

File Commands

ls

List directory contents:

tamandua> ls C:\Users\john.doe\Desktop

Directory: C:\Users\john.doe\Desktop

Type    Size        Modified             Name
----    ----        --------             ----
DIR                 2024-01-10 14:30:00  Documents
DIR                 2024-01-12 09:15:00  Downloads
FILE    1,234 KB    2024-01-15 14:32:00  suspicious.exe
FILE    45 KB       2024-01-15 14:30:00  document.docx

Options:

• -r: Recursive listing
• -h: Human-readable sizes
• -a: Show hidden files
• -t: Sort by time

cd / pwd

Navigate directories:

tamandua> pwd
C:\

tamandua> cd C:\Users\john.doe\Desktop
tamandua> pwd
C:\Users\john.doe\Desktop

get

Download file from endpoint:

tamandua> get C:\Users\john.doe\Desktop\suspicious.exe

Downloading: suspicious.exe
Size: 1,234 KB
Progress: [====================] 100%
Downloaded to investigation artifacts
SHA256: a1b2c3d4e5f6...

Options:

• -o: Specify output name
• -q: Quarantine after download
• -zip: Compress before transfer

put

Upload file to endpoint:

tamandua> put remediation_tool.exe C:\Windows\Temp\

Uploading: remediation_tool.exe
Size: 2,500 KB
Progress: [====================] 100%
File uploaded to C:\Windows\Temp\remediation_tool.exe

cat

View file contents:

tamandua> cat C:\Windows\System32\drivers\etc\hosts

# Copyright (c) 1993-2009 Microsoft Corp.
127.0.0.1       localhost
::1             localhost
# Suspicious entries below
192.168.1.100   evil.com

Options:

• -n: Show line numbers
• -head N: Show first N lines
• -tail N: Show last N lines
• -hex: Hexadecimal view

rm

Delete file:

tamandua> rm C:\Users\john.doe\Desktop\malware.exe

File deleted: C:\Users\john.doe\Desktop\malware.exe

Options:

• -r: Recursive delete
• -f: Force delete
• -q: Quarantine instead of delete

mv / cp

Move or copy files:

tamandua> mv C:\temp\file.exe C:\quarantine\
tamandua> cp C:\Windows\System32\config\SAM C:\temp\SAM_copy

[Screenshot: File operations output]

Network Commands

netstat

Display network connections:

tamandua> netstat

Proto  Local Address          Remote Address         State       PID    Process
------------------------------------------------------------------------------
TCP    192.168.1.50:49152     192.168.1.100:443     ESTABLISHED 5678   chrome.exe
TCP    192.168.1.50:49153     45.33.32.156:4444     ESTABLISHED 1234   powershell.exe
TCP    192.168.1.50:49154     8.8.8.8:53            TIME_WAIT   892    svchost.exe
UDP    192.168.1.50:5353      *:*                               1456   chrome.exe

Options:

• -t: TCP only
• -u: UDP only
• -l: Listening only
• -e: Established only

arp

Display ARP table:

tamandua> arp

Internet Address      Physical Address      Type
------------------------------------------------
192.168.1.1          00-1a-2b-3c-4d-5e     Dynamic
192.168.1.100        00-ab-cd-ef-12-34     Dynamic
192.168.1.150        00-11-22-33-44-55     Static

dns

Display DNS cache:

tamandua> dns

DNS Cache
=========
Name                          Type    TTL      Data
--------------------------------------------------
evil.com                      A       3600     45.33.32.156
google.com                    A       300      142.250.80.46
corp.local                    A       600      192.168.1.10

Options:

• -flush: Clear DNS cache

route

Display routing table:

tamandua> route

Network Destination    Netmask          Gateway         Interface
------------------------------------------------------------------
0.0.0.0                0.0.0.0          192.168.1.1     192.168.1.50
192.168.1.0            255.255.255.0    On-link         192.168.1.50

[Screenshot: Network commands output]

Registry Commands

reg query

Query registry values:

tamandua> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    SecurityHealth    REG_EXPAND_SZ    %ProgramFiles%\Windows Defender\MSASCuiL.exe
    VMware User       REG_SZ           "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
    Malware           REG_SZ           C:\Users\Public\malware.exe    [SUSPICIOUS]

Options:

• -r: Recursive
• -v VALUE: Query specific value
• -s: Include subkeys

reg add

Add or modify registry value:

tamandua> reg add HKLM\SOFTWARE\Tamandua\Response -v CleanupComplete -t REG_DWORD -d 1

Registry value added successfully

reg delete

Delete registry value or key:

tamandua> reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -v Malware

Registry value deleted: HKLM\...\Run\Malware

Options:

• -f: Force delete without confirmation
• -key: Delete entire key

[Screenshot: Registry query output with suspicious entry highlighted]

Service Commands

service list

List services:

tamandua> service list

Name                           Display Name                    Status      StartType
-----------------------------------------------------------------------------------
Dhcp                           DHCP Client                     Running     Automatic
Dnscache                       DNS Client                      Running     Automatic
MaliciousSvc                   System Update Service           Running     Automatic  [SUSPICIOUS]
wuauserv                       Windows Update                  Stopped     Manual

Options:

• -running: Running services only
• -stopped: Stopped services only

service start / stop

Control services:

tamandua> service stop MaliciousSvc
Service 'MaliciousSvc' stopped successfully

tamandua> service start Dnscache
Service 'Dnscache' started successfully

service delete

Remove service (caution):

tamandua> service delete MaliciousSvc
WARNING: This will permanently delete the service. Continue? (y/n): y
Service 'MaliciousSvc' deleted successfully

User Commands

users

List local users:

tamandua> users

Username         Full Name           Status    Last Login          Admin
-------------------------------------------------------------------------
Administrator    Built-in Admin      Disabled  Never               Yes
Guest            Guest               Disabled  Never               No
john.doe         John Doe            Active    2024-01-15 09:00    No
svc_backup       Backup Service      Active    2024-01-14 02:00    No
hidden_admin     Admin               Active    2024-01-15 14:30    Yes   [SUSPICIOUS]

whoami

Current user context:

tamandua> whoami
CORP\tamandua-agent (SYSTEM)

loggedon

List logged-on users:

tamandua> loggedon

Session    Username         Type        Started
-----------------------------------------------
Console    CORP\john.doe    Interactive 2024-01-15 09:00:00
RDP-0      CORP\admin       Remote      2024-01-15 10:30:00

Forensic Commands

hash

Calculate file hash:

tamandua> hash C:\Users\john.doe\Desktop\suspicious.exe

File: C:\Users\john.doe\Desktop\suspicious.exe
MD5:    d41d8cd98f00b204e9800998ecf8427e
SHA1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

strings

Extract strings from file:

tamandua> strings C:\Users\john.doe\Desktop\suspicious.exe

...
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
http://evil.com/beacon
cmd.exe /c whoami
...

Options:

• -n N: Minimum string length
• -u: Unicode strings only
• -a: ASCII strings only

filetime

Show file timestamps (MAC times):

tamandua> filetime C:\Users\john.doe\Desktop\suspicious.exe

File: suspicious.exe
Created:    2024-01-15 14:30:00 UTC
Modified:   2024-01-15 14:30:00 UTC  [Same as created - possible timestomping]
Accessed:   2024-01-15 14:35:00 UTC
MFT Record: 2024-01-15 14:30:00 UTC

[Screenshot: Forensic commands output]

Response Commands

isolate

Enable network isolation:

tamandua> isolate

Network isolation enabled
- All network traffic blocked except management channel
- Endpoint can only communicate with Tamandua server
- Use 'unisolate' to restore network access

unisolate

Disable network isolation:

tamandua> unisolate

Network isolation disabled
- Full network access restored
- Monitor for suspicious activity

quarantine

Move file to quarantine:

tamandua> quarantine C:\Users\john.doe\Desktop\malware.exe

File quarantined:
Original: C:\Users\john.doe\Desktop\malware.exe
Quarantine: C:\ProgramData\Tamandua\Quarantine\malware_20240115_143500.quar
SHA256: a1b2c3d4...

Shell Access

For complex operations, authorized deployments can expose a governed interactive shell. Shell access is disabled unless the deployment enables it for the target platform and role.

Starting Shell

tamandua> shell

WARNING: You are entering an interactive shell session.
Commands run in the configured response context and are fully audited.
Type 'exit' to return to Live Response.

C:\Windows\System32>

Shell Context

Shell Commands

Execute approved commands allowed by the deployment policy:

C:\Windows\System32> wmic process where name="powershell.exe" get processid,commandline
CommandLine                                          ProcessId
"C:\Windows\System32\powershell.exe" -enc ZWNo...    5678

C:\Windows\System32> taskkill /PID 5678 /F
SUCCESS: The process with PID 5678 has been terminated.

Exiting Shell

C:\Windows\System32> exit
Returning to Live Response...
tamandua> _

Shell Security

• All shell commands logged
• Session recording captures all activity
• Dangerous commands require explicit policy enablement and confirmation
• Time-limited sessions (configurable)

[Screenshot: Shell access with command execution]

Session Recording

All Live Response sessions are recorded for audit and training.

Recording Contents

Viewing Recordings

1. Navigate to Settings > Audit Log
2. Filter by Live Response
3. Select session to replay
4. Use playback controls

[Screenshot: Session recording playback interface]

Recording Export

Export session transcript:

1. Select session in audit log
2. Click Export
3. Choose format:

• Text: Plain text transcript
• HTML: Formatted with syntax highlighting
• Video: Screen recording (if enabled)

Recording Retention

Configure retention in Settings > Retention:

Session Management

Active Sessions

View all active Live Response sessions:

1. Navigate to Agents > Live Sessions tab
2. View session list:

Session Limits

Terminate Session

Administrators can terminate other users' sessions:

1. Navigate to active sessions
2. Select session
3. Click Terminate
4. Provide reason
5. Confirm

Session Notifications

Configure notifications for Live Response activity:

Best Practices

Investigation Protocol

1. Document Purpose: Note reason for session
2. Minimal Footprint: Collect only necessary data
3. Preserve Evidence: Use forensic commands before changes
4. Chain of Custody: Track all collected artifacts
5. Clean Exit: Ensure session properly terminated

Security Guidelines

Common Workflows

Malware Collection

tamandua> hash C:\path\to\malware.exe       # Calculate hash
tamandua> filetime C:\path\to\malware.exe   # Check timestamps
tamandua> get C:\path\to\malware.exe        # Download
tamandua> quarantine C:\path\to\malware.exe # Quarantine
tamandua> rm C:\path\to\malware.exe -f      # Remove (if needed)

Persistence Investigation

tamandua> reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
tamandua> reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
tamandua> service list
tamandua> ls C:\Windows\System32\Tasks -r
tamandua> ls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"

Network Investigation

tamandua> netstat -e                        # Established connections
tamandua> dns                               # DNS cache
tamandua> arp                               # ARP table
tamandua> ps -name powershell               # Check suspicious processes
tamandua> memdump [PID]                     # Capture memory if needed

Troubleshooting

Connection Issues

Command Failures

Next Steps

• Investigations - Use Live Response in investigations
• Alert Management - Respond to alerts with Live Response
• Agent Management - Manage agent connectivity
• Console Overview - Return to console overview