Defender XDR series · Lab 2 of 5 · Advanced

A machine is behaving badly. Prove it, then touch it.

FIN-WKS-0777 raised Behavioral threat detected (high severity) plus an RDP session from an unusual peer. You are the endpoint engineer on shift. Everything here is graded on order: evidence before remediation, approval before disruption, verification before closure.

Required
Console replica, synthetic tenant.

Layout and control names model the 2026 Defender portal. Nothing is connected to a real environment: no device is isolated, no binary is executed, no package is installed. Every host, user, hash, URL and address is fabricated for training (documentation ranges only). No Microsoft marks or logos are reproduced.

Objectives · 100 pts

Seven graded controls

  • 1
    Scope & asset context · 10Pick the right device out of the inventory and state the exposure you are protecting.
  • 2
    Timeline & process tree · 15Separate parent-child facts from noise; identify why nothing was blocked.
  • 3
    Blast radius in KQL · 15Find every host with the same file hash and the same registry persistence.
  • 4
    Live response · 20Drive the simulated console: evidence first, no destructive verb before collection, structured query when you need it.
  • 5
    Isolation or containment? · 10Choose the right disruption for the right reason, with the notification and the exception path.
  • 6
    Vulnerability remediation · 15Recommendations, remediation package, and an exception with owner and expiry.
  • 7
    Verification & closure · 15Prove the machine is clean, the sensor is healthy and the note is audit-ready.
Device inventory

Five candidates, one is yours

Select one device. No rows selected
Device nameExposureGroupsAlertsSensorLast seenHVA
FIN-WKS-0777Windows 11 23H2 · 4 usersHighFIN-WKS3 openHealthy2 min agoNo
FIN-WKS-0421Windows 11 23H2MediumFIN-WKS0Healthy11 min agoNo
OPS-SRV-0102Windows Server 2022MediumOPS-SRV1 openNo onboarding3 h agoYes
PAY-SRV-0007Windows Server 2019 · conditional launch enforcedLowPAY-SRV1 openHealthy40 s agoYes
HR-WKS-0110Windows 11 24H2LowHR-WKS2 openHealthy1 h agoNo

HVA = onboarded as a high-value asset, which deliberately restricts some response actions. Two of these hosts sit in the payroll path: disrupting one at 16:40 on a Friday is a decision, not a reflex.