Agent Foskett Investigation • Incident Response • Microsoft Defender XDR • Evidence Preservation • KQL
The Administrator Fixed the Problem — And Deleted the Evidence
The alert was real.
The administrator moved quickly.
The suspicious file was deleted. The process was stopped. The account was reset.
By the time the SOC began the investigation, the immediate problem looked fixed.
There was just one complication.
Some of the best evidence had been cleaned up with it.
Contain Fast. Preserve First.
Remediation can stop an attack while also changing the scene investigators need to understand it.
✓ Record what exists before changing it
✓ Preserve volatile and local evidence where practical
✓ Reconstruct from Defender telemetry when the endpoint has changed
The incident was already being fixed
The SOC received an escalation for WKSTN-218. A suspicious executable named invoice-viewer.exe had launched PowerShell and contacted an unfamiliar external address. Before the analyst could begin, a well-meaning administrator had already logged on and started cleaning up.
10:21Defender records invoice-viewer.exe starting on WKSTN-218.
10:22PowerShell launches beneath the suspicious process.
10:24Outbound network activity follows.
10:31The administrator begins remediation.
10:34The suspicious file is removed and running processes are terminated.
10:47The SOC opens the deeper investigation.
The current state looked reassuring
The file was no longer on disk. The suspicious process was no longer running. The user's password had been reset. Looking only at the endpoint's current state made the incident appear almost finished. Agent Foskett was interested in something else: what happened before the cleanup?
File goneUseful for containment, but the original artefact was no longer available at its previous path.
Process stoppedThe live process tree could no longer be inspected on the endpoint.
Configuration changedRemediation had altered the machine after the suspicious activity occurred.
Agent Foskett rule: the current state of a device is not the same thing as its historical state.
Start with the process history
Microsoft Defender XDR DeviceProcessEvents records process creation telemetry, including command lines, account context and initiating-process information. Even though the processes were no longer running, the historical events could still reconstruct the execution chain captured by Defender.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
let TargetDevice = "WKSTN-218";
DeviceProcessEvents
| where Timestamp > ago(7d)
| where DeviceName startswith TargetDevice
| where FileName in~ ("invoice-viewer.exe", "powershell.exe", "cmd.exe")
or InitiatingProcessFileName =~ "invoice-viewer.exe"
| project Timestamp, DeviceName,
AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName,
InitiatingProcessCommandLine
| order by Timestamp asc
The deleted file still had a history
Deleting a file changes the endpoint, but it does not automatically erase previously collected Defender telemetry. DeviceFileEvents can provide historical file activity, hashes, paths and initiating-process context for events that were recorded before or during remediation.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
let TargetDevice = "WKSTN-218";
DeviceFileEvents
| where Timestamp > ago(7d)
| where DeviceName startswith TargetDevice
| where FileName =~ "invoice-viewer.exe"
| project Timestamp, ActionType,
FileName, FolderPath,
SHA1, SHA256,
InitiatingProcessAccountName,
InitiatingProcessFileName,
InitiatingProcessCommandLine
| order by Timestamp asc
Important: telemetry can preserve useful history, but it is not a substitute for every forensic artefact. If the original file, volatile memory or other local evidence matters, preserve it before remediation when operationally safe and practical.
Then separate attacker activity from administrator activity
The timeline now contained two stories: the compromise and the cleanup. The investigation needed to distinguish suspicious activity from legitimate response actions instead of treating everything after the alert as attacker behaviour.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
let TargetDevice = "WKSTN-218";
let CleanupStart = datetime(2026-09-08 10:30:00);
DeviceProcessEvents
| where DeviceName startswith TargetDevice
| where Timestamp between (CleanupStart .. CleanupStart + 20m)
| project Timestamp, AccountName,
FileName, ProcessCommandLine,
InitiatingProcessFileName,
InitiatingProcessAccountName
| order by Timestamp asc
Fixing the problem and investigating it are different jobs
The administrator had done something valuable: they reduced immediate risk. The mistake was not remediation itself. The problem was beginning destructive cleanup before recording what existed and before the investigation had captured the evidence it might need.
ContainmentStop ongoing harm and prevent further attacker activity.
PreservationCapture the evidence needed to understand scope, cause and impact.
RemediationRemove malicious artefacts, close access paths and restore the environment safely.
What Agent Foskett checked
Original alert timeWhat happened before anyone began changing the endpoint?
Process historyWhich processes executed and what spawned them?
File historyWhat hashes, paths and file actions had already been recorded?
Network activityDid the suspicious process communicate externally before it was stopped?
Administrator actionsExactly when did legitimate cleanup begin, and under which account?
Evidence gapsWhich artefacts were no longer available because remediation changed or removed them?
What the evidence can and cannot prove
Historical Defender telemetry can reconstruct events that were collected before the endpoint changed. It cannot guarantee recovery of every artefact that was deleted or every volatile detail that existed before remediation. The investigation should document both what the telemetry establishes and what the cleanup made unavailable.
ProvenRecorded process and file events can establish activity captured by Defender before and during remediation.
Requires correlationWhich actions belonged to the attacker and which belonged to the administrator must be established from accounts, timing and surrounding telemetry.
Do not assumeA clean endpoint after remediation does not prove the incident was small, fully understood or completely contained.
The investigation finding
The administrator successfully removed the obvious malicious artefact and stopped the active process, but the cleanup happened before the SOC completed evidence collection. Microsoft Defender XDR retained enough historical telemetry to reconstruct the captured execution and file timeline, while some local evidence was no longer available. The incident was contained — but the investigation had become harder than it needed to be.
Investigation principle: contain the threat without destroying the story. When time and safety permit, preserve the evidence you may need before destructive remediation changes the scene.
Related investigations
The SharePoint File Was Deleted — But the Audit Trail Still Had the EvidenceSee how historical cloud audit telemetry can preserve a story after the live object disappears.The OAuth App Was Deleted — But the Permission Grant Was Still ThereReconstruct a deleted application's lifecycle instead of relying only on current tenant state.The Defender Alert Was Closed — But the Same Command Ran on Three More DevicesDo not confuse an administrative action with the end of the investigation.
Final thought
The administrator had not done nothing. Quite the opposite — they had acted quickly and reduced the immediate risk. But incident response is not only about making the bad thing disappear. It is also about understanding how it arrived, what it did and where else it went.
Fix the problem. Preserve the story.
Otherwise Agent Foskett arrives to investigate the crime scene... and somebody has already vacuumed it. 😂🔎
The Logs Already Knew!
Fix the problem. Preserve the story.
Otherwise Agent Foskett arrives to investigate the crime scene... and somebody has already vacuumed it. 😂🔎
The Logs Already Knew!
