了解即時回應中常用的指令，並了解它們通常的使用範例。
根據你的職務，你可以執行基本或進階的即時回應指令。 欲了解更多基本與進階指令，請參閱 使用即時回應的裝置上調查實體。
analyze
# Analyze the file malware.txt
analyze file c:\Users\user\Desktop\malware.txt
# Analyze the process by PID
analyze process 1234
connections
# List active connections in json format using parameter name
connections -output json
# List active connections in json format without parameter name
connections json
dir
# List files and sub-folders in the current folder (by default it will show relative paths [-relative_path])
dir
# List files and sub-folders in the current folder, with their full path
dir -full_path
# List files and sub-folders in a specific folder
dir C:\Users\user\Desktop\
# List files and subfolders in the current folder in json format
dir -output json
fileinfo
# Display information about a file
fileinfo C:\Windows\notepad.exe
findfile
# Find file by name
findfile test.txt
get
# Download a file from a machine
get c:\Users\user\Desktop\work.txt
# Download a file from a machine, automatically run prerequisite commands
get c:\Users\user\Desktop\work.txt -auto
注意事項
以下檔案類型 無法 在 Live Response 內使用此指令下載：
PowerShell 支援這些檔案類型。
如果你在 Live Response 裡使用這個指令有問題，可以用 PowerShell 作為替代方案。
library
# List files in the library
library
# Delete a file from the library
library delete script.ps1
processes
# Show all processes
processes
# Get process by pid
processes 123
# Get process by pid with argument name
processes -pid 123
# Get process by name
processes -name notepad.exe
putfile
# Upload file from library
putfile get-process-by-name.ps1
# Upload file from library, overwrite file if it exists
putfile get-process-by-name.ps1 -overwrite
# Upload file from library, keep it on the machine after a restart
putfile get-process-by-name.ps1 -keep
registry
# Show information about the values in a registry key
registry HKEY_CURRENT_USER\Console
# Show information about a specific registry value (the double backslash \\ indicates a registry value versus key)
registry HKEY_CURRENT_USER\Console\\ScreenBufferSize
remediate
# Remediate file in specific path
remediate file c:\Users\user\Desktop\malware.exe
# Remediate process with specific PID
remediate process 7960
# See list of all remediated entities
remediate list
注意事項
目前， HKEY_USERS reg hive 尚未支援。remediate 這是已知的問題，我們正在調查。
run
# Run PowerShell script from the library without arguments
run script.ps1
# Run PowerShell script from the library with arguments
run get-process-by-name.ps1 -parameters "-processName Registry"
注意事項
對於像是「run」或「getfile」這類長時間執行的指令，你可能會想在指令末尾加上「&」符號，在背景執行該動作。 如果你使用「g」符號，可以繼續調查機器，完成後再用「fg」 基本指令回到背景指令。
在傳遞參數給即時回應腳本時，請不要包含以下禁止字元：';'」、「&」、「|'、'！' 和 '$'。
scheduledtask
# Get all scheduled tasks
scheduledtasks
# Get specific scheduled task by location and name
scheduledtasks Microsoft\Windows\Subscription\LicenseAcquisition
# Get specific scheduled task by location and name with spacing
scheduledtasks "Microsoft\Configuration Manager\Configuration Manager Health Evaluation"
undo
# Restore remediated registry
undo registry HKEY_CURRENT_USER\Console\ScreenBufferSize
# Restore remediated scheduledtask
undo scheduledtask Microsoft\Windows\Subscription\LicenseAcquisition
# Restore remediated file
undo file c:\Users\user\Desktop\malware.exe
提示
想要深入了解? Engage 與 Microsoft Security 社群互動，加入我們的技術社群：適用於端點的 Microsoft Defender Defender 技術社群。