Muahaha, interactive Live Response inside of PowerShell!

Do you do offense full time now?

🤣

I read a lot of what the AI reasons about in the terminal, and I've learned a ton about techniques I never would have thought about It's crazy how short that trip is from "I just want this to be transparent to the user" to "I just built an OST" 😂

Very cool. One more conference and then I will have a bit more time to add stuff to XDRInternals as well. 😂

I apologize for the flood of stuff I'm about to push to the branch... I need to figure out the best naming for all this stuff, like the best verbs and heirarchy. I'll publish the few branches, we can discuss whenever :P

👀

👀

@BertJanCyber how about sending the same command to multiple sessions at the same time?

@BertJanCyber I should create a separate cmdlet for that, but it would be very doable The more difficult part of the logic will be tracking API limits or handling the quotas when they are inside jobs and not visible to the user, but I think I can work around that

@BertJanCyber You mean Claude can work around? 🤪

@BertJanCyber Haha, yeah, it'll do most of the fixing for me :P My current workflow, though could be improved, is to capture via browser using our helper extension, and let AI scaffold the cmdlet. Then I edit and test until I hit issues or big changes, then pass back to AI, then I finish it.

@BertJanCyber I would say 90% is written by AI, but I delete probably 20% of what it writes by refining things or fixing issues it didn't know about There is no way I could develop this in my free time without AI, the time commitment would be too much For tracking:

Red teamer in heart

This is cool, can you execute arbitrary PS? (Maybe by uploading the command as a .ps1 file to the live response library and then executing the run command against it in the background)

The reason they give us a limited set of command instead of a full shell is to ensure commands are pre-meditated, pre-authorized, and consistent But if we have a second shell (or way to bg the current task), then we can definitely do that I could add a special command in shell

Nice. How to replicate it? Is there a full guidance? Github repo to understand?

I implemented as part of our XDRInternals PowerShell module, currently waiting for review but should be in soon :)

Thank you

This is the kind of quality-of-life improvement that actually changes incident response workflows. The ability to stay in PowerShell without context-switching out to the portal is underrated — especially when you're working at 2am and muscle memory matters most.

Humans can only click on things so fast, and we are further slowed down by the unnecessary content in the browser Beyond a human being able to grab data, grep, pipe, etc., parts of this module opens an opportunity for application and agent development that we never had before :)

Very useful! Makes it way easier to jump in and investigate and remediate. Looking forward to learning more about this *wink*wink*nudge*nudge*

I'm working through some of the more complicated stuff like collecting files and proper undo I did add PSReadline so you can tab complete the Live Response commands 🤣

Missing a semi interactive terminal was/is one of my biggest complaints of MDE once we switched off the other guys. It massively complicates and slows down IR when you are trying to stop them from lat moving, encrypting and exfiling your data. Love this!

Thanks! It's been fun to play with, ran into a few more bugs tonight, so might not be until tomorrow that I get this pushed out for testing :)