1.4 Manage Microsoft Defender for Endpoint Investigations

10-14 hours · Module 1 · Free

Manage Microsoft Defender for Endpoint Investigations

SC-200 Exam Objective

Domain 3 — Manage Incident Response: "Investigate device timelines," "Perform actions on the device, including live response and collecting investigation packages," and "Perform evidence and entity investigation."

Introduction

When malware reaches a device — or an attacker gains remote access to one — Defender for Endpoint is where you investigate. This subsection teaches you to read device timelines, interpret process trees, take response actions, and collect forensic evidence. Module 4 covers the full Defender for Endpoint configuration in depth. This subsection focuses on the investigation skills you use when an endpoint alert fires.

The device timeline

The device timeline is a chronological view of everything that happened on a device: every process created, every network connection, every file written, every registry change, every logon event. It is the most detailed investigation data source for endpoint activity.

⚠ Macro execution⚠ Shell spawn⚠ Encoded payload⚠ Credential theft

Every step is a red flag. ASR rule “Block Office child processes” prevents this chain at the first arrow.

Figure 1.6: The textbook macro malware process chain. Word launches cmd.exe (macro), which launches encoded PowerShell (payload download), which launches Mimikatz (credential dump). Each arrow is an investigation indicator and an ASR rule intervention point.

Reading a process tree: The most critical skill for endpoint investigation is reading parent-child process relationships. Legitimate software follows predictable patterns: explorer.exe → outlook.exe → winword.exe (user opens Outlook, opens Word attachment). Malicious behavior creates unusual chains: winword.exe → cmd.exe → powershell.exe → mimikatz.exe (macro launches command shell, downloads credential-dumping tool).

When investigating an endpoint alert:

Open the device page from the incident → click the device entity
Read the alert process tree — click the alert to see the specific process chain that triggered it
Examine the parent process — is it a legitimate application launching a suspicious child?
Check network connections — did the suspicious process connect to an external IP?
Check file events — did the process drop files to disk?

1
2
3
4
5
6
7
8
// Investigate process chain from a suspicious alert
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName == "DESKTOP-NGE042"
| where InitiatingProcessParentFileName in~ ("winword.exe", "excel.exe")
| project Timestamp, GrandParent = InitiatingProcessParentFileName,
    Parent = InitiatingProcessFileName, Child = FileName, ProcessCommandLine
| order by Timestamp asc

Expected Output — Suspicious Office Process Chain

Timestamp	GrandParent	Parent	Child	CommandLine
09:14	winword.exe	cmd.exe	powershell.exe	powershell -enc aQBl...

What to look for: Word spawning cmd.exe spawning encoded PowerShell is the textbook macro malware chain. The -enc flag means Base64-encoded command — the attacker is hiding the payload. This process chain triggers ASR rules (Module 4.3) and should result in immediate device isolation.

Response actions from the device page

Action	What it does	When to use
Isolate device	Cuts all network except the Defender management channel	Confirmed compromise — stops lateral movement and C2
Collect investigation package	Gathers processes, connections, scheduled tasks, autorun entries	Before isolation — captures live state
Run antivirus scan	Full or quick malware scan	Initial triage or post-remediation verification
Restrict app execution	Only Microsoft-signed executables can run	Active malware — prevents attacker tool execution
Live response	Remote command shell to the device	Forensic evidence collection, targeted file retrieval

Collect the investigation package BEFORE isolating

Isolation drops all active network connections. The investigation package captures live connections, running processes, and active sessions. Once isolated, some of this data changes or disappears. Collect first (30 seconds), then isolate. This sequence is detailed in Module 4.6.

Check your understanding

1. The device timeline shows: winword.exe → cmd.exe → powershell.exe -enc [base64]. What does this indicate and what is your response?

Macro-based malware delivery. An Office document executed a macro that launched a command shell running encoded PowerShell — the classic initial access chain. Response: collect investigation package, isolate the device, decode the Base64 to understand the payload, revoke the user's sessions (the document may have been delivered via phishing).

Normal Office automation

A Windows update process

Office applications do not legitimately spawn cmd.exe or encoded PowerShell. This is the exact chain that Module 4's ASR rules prevent. If ASR was in audit mode, this execution was logged but not blocked. If in block mode, the chain would have been stopped at the cmd.exe spawn.

← 1.3 Remediate Risks with Microsoft Defender for Office 365 1.5 Mitigate Threats Using Microsoft Defender for Identity →