You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and...

< putfile and &

To push (download) a file from the Live Response library onto an endpoint you use the PutFile (often shown as putfile ) Live Response command. Microsoft’s Live Response command set documents that PutFile “puts a file from the library to the device” and the file is saved to a working folder on the endpoint (and removed on restart by default). This is the operation that transfers a tenant-level library file (for example, an executable you uploaded) onto the target machine for execution or inspection. blog.sec-labs.com+1

When you need the transfer to run as a background job so the live-response session is not blocked waiting for command completion, the Live Response shell supports running co mmands asynchronously by appending the ampersand operator. Microsoft’s Live Response guidance and examples show that background execution is used to avoid blocking the interactive session while large files or long-running operations complete; using & runs the command in the background. Combining these two yields the correct command to download a 250-MB executable from the library to Device1 as a background process: use putfile for the library→device transfer and append & to run it in the background.

Therefo re: choose putfile and & .