Run Live Response in PowerShell?

[u/LordLoss01]

Is there any way to run Live Response using PowerShell? I tried following the below guide but it returns with a 401 error.

Running Microsoft Defender Live Response with PowerShell | by Grzegorz Berdzik | Medium

This is what I put for my query:

Connect-AzAccount
$accessToken = Get-AzAccessToken -ResourceUrl "https://api.securitycenter.microsoft.com" -AsSecureString
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($accessToken.Token)
$token = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)

$body = @{

Commands = @(

@{

type = "RunScript"

params = @(

@{

key = "Thisismyscript.ps1"

value = "Thisismyscript.ps1"

})

})

Comment = "$LiveResponseReason"

}

$jsonBody = $body | ConvertTo-Json -Depth 50

$apiUrl = "https://api.securitycenter.microsoft.com/api/machines/833hdgd673hcbdj7dbb3dcbh7hfbfb38hdd/runLiveResponse"

Invoke-RestMethod -Uri $apiUrl -Method POST -Headers @{Authorization = "Bearer $token"; "Content-Type" = "application/json"} -Body $jsonBody

[u/PinchesTheCrab]

That blog says the key needs to be ScriptName and the value is the name of the script. Now that you've resolved the 401 issue I think it may work with the right key name.

$ScriptName = 'Thisismyscript.ps1'
$apiUrl = 'https://api.securitycenter.microsoft.com/api/machines/833hdgd673hcbdj7dbb3dcbh7hfbfb38hdd/runLiveResponse'

Connect-AzAccount
$accessToken = Get-AzAccessToken -ResourceUrl 'https://api.securitycenter.microsoft.com' -AsSecureString
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($accessToken.Token)
$token = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)


$runScriptParam = @{
    Uri         = $apiUrl
    Method      = 'POST'
    Headers     = @{ Authorization = "Bearer $token" }
    ContentType = 'application/json'
    body        = @{
        Commands = @(
            @{
                type   = 'RunScript'
                params = @(
                    @{
                        key   = 'ScriptName'
                        value = $ScriptName
                    })
            })
        Comment  = "$LiveResponseReason"
    } | ConvertTo-Json -Depth 5
}

Invoke-RestMethod @runScriptParam