MDE LiveResponse Downloading File Fails

Brass Contributor

I was playing with LiveResponse and the 'BackupEventLog.ps1' script from


which creates a file around 97MB, well below the 3GB limit. 


I've tried  

getfile 'file' 


I've tried downloading in the background 

download 'file' &


but it won't download.  


I can download slightly smaller files...(67MB)

getfile C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx


Does anyone know if there's something else I was supposed to do? 



3 Replies
Thanks for posting. I am asking our team to see if they can provide some additional details and insights. Will follow up once I have more info.
Hey Daniel, thank you, it's much appreciated!