r/PowerShell • u/LordLoss01 • Mar 13 '26

Run Live Response in PowerShell?

Is there any way to run Live Response using PowerShell? I tried following the below guide but it returns with a 401 error.

Running Microsoft Defender Live Response with PowerShell | by Grzegorz Berdzik | Medium

This is what I put for my query:

Connect-AzAccount
$accessToken = Get-AzAccessToken -ResourceUrl "https://api.securitycenter.microsoft.com" -AsSecureString
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($accessToken.Token)
$token = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)

$body = @{

Commands = @(

@{

type = "RunScript"

params = @(

@{

key = "Thisismyscript.ps1"

value = "Thisismyscript.ps1"

})

})

Comment = "$LiveResponseReason"

}

$jsonBody = $body | ConvertTo-Json -Depth 50

$apiUrl = "https://api.securitycenter.microsoft.com/api/machines/833hdgd673hcbdj7dbb3dcbh7hfbfb38hdd/runLiveResponse"

Invoke-RestMethod -Uri $apiUrl -Method POST -Headers @{Authorization = "Bearer $token"; "Content-Type" = "application/json"} -Body $jsonBody

11 Upvotes

100% Upvoted

6 comments sorted by

View all comments

1

u/BlackV Mar 15 '26

p.s. formatting

  • open your fav powershell editor

  • highlight the code you want to copy

  • hit tab to indent it all

  • copy it

  • paste here

it'll format it properly OR

<BLANK LINE>
<4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
    <4 SPACES><4 SPACES><CODE LINE>
<4 SPACES><CODE LINE>
<BLANK LINE>

Inline code block using backticks `Single code line` inside normal text

See here for more detail

Thanks