Velociraptor

In this room, we will explore Rapid7's newly acquired tool known as Velociraptor. 

Per the official Velociraptor documentation, "Velociraptor is a unique, advanced open-source endpoint monitoring, digital forensic and cyber response platform. It was developed by Digital Forensic and Incident Response (DFIR) professionals who needed a powerful and efficient way to hunt for specific artifacts and monitor activities across fleets of endpoints. Velociraptor provides you with the ability to more effectively respond to a wide range of digital forensic and cyber incident response investigations and data breaches".

This tool was created by Mike Cohen, a former Google employee who worked on tools such as GRR (GRR Rapid Response) and Rekall (Rekall Memory Forensic Framework). Mike joined Rapid7's Detection and Response Team and continues to work on improving Velociraptor. At the date of this entry, the latest release for Velociraptor is 0.6.3.

Learning Objectives

• Learn what is Velociraptor
• Learn how to interact with agents and create collections
• Learn how to interact with the virtual file system
• Learn what is VQL and how to create basic queries
• Use Velociraptor to perform a basic hunt

Prerequisites

• Windows Forensics 1
• Windows Forensics 2
• KAPE