Hunting — Persistence Mechanisms
The prompt
In Microsoft Defender XDR advanced hunting, search for persistence mechanisms created in the last [TIMEFRAME] on device [DEVICE NAME or all devices]. Check for: 1. New scheduled tasks created by non-system accounts 2. Registry run key modifications (HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalent) 3. New services created 4. Startup folder modifications For each finding: device, user who made the change, timestamp, and the specific value or command added. Flag anything added by non-administrative accounts or pointing to temp/appdata directories.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
Threat Hunter, Incident Responder
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.