Device Investigation — Rapid Scope
The prompt
In Microsoft Defender XDR, investigate device [DEVICE NAME or ID]. For the period [START TIME] to [END TIME]: 1. List all processes executed — flag any that are unusual, unsigned, or living-off-the-land binaries (LOLBins) 2. List all network connections — flag any to external IPs or uncommon destinations 3. List all file events — flag any new executables dropped or scripts run 4. Was any lateral movement attempted from this device? Return findings as a structured table per category. Flag items that require immediate action.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L2, Incident Responder
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- User Investigation — Credential Compromise Assessment
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.