1 00:00:18,160 --> 00:00:20,340 Hello everyone, Arthur Packett here. 2 00:00:20,340 --> 00:00:22,400 We have a pre-recorded video for you. 3 00:00:22,540 --> 00:00:25,420 It's an intro to Velociraptor. 4 00:00:25,540 --> 00:00:27,440 This is about a 40-minute presentation. 5 00:00:27,440 --> 00:00:36,000 We hope you enjoy, and if you have any questions, please feel free to direct them to the workshop track one or the Recon Discord server for more immediate answers. 6 00:00:36,000 --> 00:00:37,180 We hope you enjoy. 7 00:00:40,640 --> 00:00:56,520 ...video to demonstrate how to install Velociraptor, and we'll just do a quick guided tour through the Velociraptor features, and have a quick introduction to this new DFIR tool. 8 00:00:56,520 --> 00:01:04,840 I mean, you might have heard of Velociraptor before, and in this video we will show how to install it, and we'll just do a quick demonstration. 9 00:01:05,620 --> 00:01:09,380 So I'm going to start off by... you can see my desktop. 10 00:01:09,380 --> 00:01:21,860 This is a typical Windows system, and I'm going to show you how to install it from scratch in a little bit, how to actually use it in real DFIR work. 11 00:01:21,980 --> 00:01:37,980 So the first thing that I'll do is I'm just going to go to the GitHub page, and I'm just going to search for a GitHub page for Velociraptor, and download all the releases. 12 00:01:37,980 --> 00:01:43,520 I'm going to show you how to install Velociraptor in the cloud, on a cloud platform. 13 00:01:43,700 --> 00:01:47,000 So the first thing I'll do is I'll download the releases. 14 00:01:47,360 --> 00:01:56,980 I'm going to have a server which will run on Linux, so I'm going to need to download the Linux binary. 15 00:01:56,980 --> 00:02:05,400 I'm also going to run the Windows executable on Windows, so I'm going to need to download the Windows binary. 16 00:02:05,860 --> 00:02:14,780 And also, finally, I'm going to need to download the source code, so I can show you guys how to build an MSI installer. 17 00:02:15,820 --> 00:02:31,740 So once I download these binaries, I'm going to open a new shell, and I'm just going to run it as administrator, so I can install the relevant MSIs. 18 00:02:32,520 --> 00:02:41,680 And since I just downloaded it into the downloads directory, I'm just going to change directory to that, 19 00:02:45,260 --> 00:02:47,340 like downloads. 20 00:02:48,300 --> 00:02:53,680 And if I do a dir, you can see the binaries that I've just downloaded. 21 00:02:54,000 --> 00:02:54,440 Okay, great. 22 00:02:54,440 --> 00:03:04,220 So the first thing that we need to do is create a configuration file in which we can deploy on the server. 23 00:03:04,360 --> 00:03:15,960 I'm going to create the configuration file on the Windows machine, and then I'm going to push it out into the server, create a Debian package, and push it to a Debian server in the cloud. 24 00:03:16,280 --> 00:03:25,540 So first thing I will do is I will generate a configuration file using the configuration wizard. 25 00:03:25,680 --> 00:03:33,580 I'm going to use the dash i flag, which is the interactive wizard, which will help me generate the configuration. 26 00:03:35,580 --> 00:03:45,600 So it goes off and it will ask me some questions about what exactly, what type of deployment I want to use, and it will actually create configuration for that. 27 00:03:45,600 --> 00:03:51,060 I'll start off, I'm going to be running it on a Debian machine, so I'll choose a Linux server. 28 00:03:51,320 --> 00:04:00,580 File based data store is usually the simplest, and this is the directory that I'm going to store all the files in. 29 00:04:01,740 --> 00:04:16,940 In this particular example, we're going to create a Let's Encrypt certificate automatically, so it will create an SSL certificate without any further intervention, and will also authenticate with standard usernames and passwords. 30 00:04:17,060 --> 00:04:29,660 So this is the second option, and I'm going to use one of my VM machines, training VMs, and this will be the domain name for the training VM. 31 00:04:29,660 --> 00:04:38,220 So because we want to create an SSL certificate, we're going to need DNS to be properly set up. 32 00:04:38,720 --> 00:04:50,600 So we're going to use a real DNS name, and Velociraptor has this really useful feature where it will actually update dynamic DNS by itself, without us doing anything at all. 33 00:04:50,600 --> 00:04:55,540 So if we use Google Domains for the DynDNS, it will be able to go out and update it. 34 00:04:55,540 --> 00:05:08,080 And over here, I've got the credentials for that, which you can get from the dynamic DNS settings of the Google Domains. 35 00:05:08,880 --> 00:05:15,920 So I just literally copied them into the prompt here. 36 00:05:17,100 --> 00:05:20,760 And then it will ask me to create a new user. 37 00:05:20,760 --> 00:05:26,460 This is the initial administrative user that will be created when the service installs. 38 00:05:26,460 --> 00:05:36,180 So I'm going to just create a new user and give it a password here, and then just press enter. 39 00:05:36,180 --> 00:05:43,720 It will generate some keys, finish configuring it, and you can see that it created a server config and a client config. 40 00:05:43,720 --> 00:05:54,240 If I have a look at the files, then we have the server configuration, and then the client configuration, which contain the keys, the key material, and all the configuration. 41 00:05:55,080 --> 00:06:04,820 So the next step is simply to create a server Debian package using that configuration. 42 00:06:04,820 --> 00:06:14,980 So we're going to run Velociraptor again and tell it to use the server configuration and Debian server. 43 00:06:15,220 --> 00:06:18,880 So we're just asking it to create a Debian package for the server. 44 00:06:20,060 --> 00:06:33,940 If we just try to do this now, then it will say, I don't actually have a Linux binary, so you're running a Windows binary and you're asking me to build a Debian package, so I need the Linux binary as well. 45 00:06:33,940 --> 00:06:41,680 So in this scenario, we're going to need to give it the Linux binary to actually package as well. 46 00:06:42,940 --> 00:06:48,240 So we do that, and it will actually build us a Debian package. 47 00:06:48,240 --> 00:06:49,380 Let's have a look. 48 00:06:49,680 --> 00:06:59,700 And we can see that there is a Debian package here that contains the configuration embedded with it and all the startup scripts and it's all the service configuration. 49 00:06:59,700 --> 00:07:06,360 So all we have to really do is now just push that to our cloud endpoint and then start it. 50 00:07:06,360 --> 00:07:18,940 So I'm just going to scp it to my cloud machine and over here I've got my IP address of my cloud machine 51 00:07:22,900 --> 00:07:31,280 and it will just copy the Debian package over there. 52 00:07:32,640 --> 00:07:36,800 So now I will ssh to that machine and install it. 53 00:07:41,020 --> 00:07:45,740 Okay, and if we have a look at my home directory, there is the Debian package there. 54 00:07:46,260 --> 00:07:56,720 So I just install it with the package and it's going to head and install the service and create it. 55 00:07:56,720 --> 00:08:02,880 So it's already pre-configured to start and it should just work, should bring up the service. 56 00:08:03,820 --> 00:08:06,540 I can check the service is up, service 57 00:08:14,840 --> 00:08:20,960 status, and it shows me green, active, running, and it's all ready to go. 58 00:08:21,180 --> 00:08:41,680 So now if I go to that with HTTPS, vm1.training.velocidex.com, then I should be able to log in with the username and password that I gave it before in the configuration file. 59 00:08:41,820 --> 00:08:44,720 So now we have a Velociraptor server set up. 60 00:08:44,860 --> 00:08:46,220 It only takes a minute. 61 00:08:46,220 --> 00:08:50,760 You can see down here the version and this is the GUI. 62 00:08:51,160 --> 00:08:59,420 This is great, so that's the server, but we still don't have any clients attached to it because we haven't really deployed the client side of it. 63 00:08:59,420 --> 00:09:06,900 So now I'm going to show you how to create an MSI for being able to deploy on the Windows platform. 64 00:09:07,400 --> 00:09:09,260 So let me get out of there. 65 00:09:10,800 --> 00:09:15,000 So we'll go back to our downloads that we had here. 66 00:09:15,500 --> 00:09:24,360 And to build an MSI, we use a tool called Wix, which is a typical MSI framework build framework. 67 00:09:24,620 --> 00:09:26,700 And it's very easy to do. 68 00:09:26,940 --> 00:09:32,900 Let me just open the source code, which we downloaded from the GitHub page. 69 00:09:32,900 --> 00:09:37,100 And in the docs directory, you will find a directory called Wix. 70 00:09:37,440 --> 00:09:47,240 And this directory contains all the scripts required to build the Wix, to use Wix to build the MSI. 71 00:09:47,240 --> 00:09:54,680 So I'm just going to paste it and just extract that one directory into the downloads directory. 72 00:09:56,060 --> 00:09:58,300 Okay, so I can see it here. 73 00:09:59,080 --> 00:10:01,400 And let me go into it. 74 00:10:02,260 --> 00:10:06,920 And I'll just quickly show you guys all the scripts here. 75 00:10:06,920 --> 00:10:09,020 We have a number of different scripts. 76 00:10:09,900 --> 00:10:19,620 And what we want to do is we want to build in this case, a customized version of our MSI that already embeds our special configuration. 77 00:10:19,640 --> 00:10:35,510 So that MSI will be used can be used to then deploy using any number of software management tools like Group Policy or SCCM or anything like that. 78 00:10:36,070 --> 00:10:50,270 So in order for these scripts to work, I need to create a directory called output and copy into it the binary that I want to deploy, which would be the Windows binary. 79 00:10:50,510 --> 00:10:55,790 I'll put and call it velociraptor.exe. 80 00:10:55,790 --> 00:11:05,370 Okay, additionally, I want to copy the client configuration into the output directory as well. 81 00:11:05,510 --> 00:11:10,410 So now I have two files in the output directory. 82 00:11:10,410 --> 00:11:12,890 And these two files will be packaged. 83 00:11:12,890 --> 00:11:17,870 That's really all it is that's required to be packaged in the MSI. 84 00:11:18,970 --> 00:11:25,170 So I'm just going to run the build custom script to create the custom MSI for me. 85 00:11:25,790 --> 00:11:34,910 And all it does is it simply runs the Wix tool set with the right scripts and options to just build the MSI. 86 00:11:34,910 --> 00:11:41,210 It's going to take a second and it will just create an MSI that I can then use. 87 00:11:43,610 --> 00:11:46,250 Okay, so okay 88 00:11:49,350 --> 00:11:56,830 , now if I have a look, there is custom MSI here ready for me to build, to deploy. 89 00:11:57,450 --> 00:12:00,250 So I'm just going to install it on my machine here. 90 00:12:02,810 --> 00:12:06,890 And it will just install Velociraptor and it's ready to go. 91 00:12:07,810 --> 00:12:10,270 Okay, so that's all it took. 92 00:12:10,370 --> 00:12:16,230 And if we have a look at it over here, and we should be able to see the client already checking in. 93 00:12:16,230 --> 00:12:23,010 So it's installed it on this machine and checked into that Debian machine in the cloud that's running the server. 94 00:12:23,010 --> 00:12:28,190 So that is really all that's required to deploy Velociraptor client and server. 95 00:12:28,330 --> 00:12:35,290 So now I would actually just take that MSI and deploy it across the fleet and get all the endpoints. 96 00:12:35,290 --> 00:12:36,230 So that's great. 97 00:12:36,230 --> 00:12:49,110 So we've actually managed to install Velociraptor in a few minutes with a proper SSL certificate, automatic DynDNS setup, and it's ready to go. 98 00:12:49,110 --> 00:12:50,770 We've seen all the clients. 99 00:12:50,770 --> 00:12:54,450 And now what can we do with these clients? 100 00:12:54,890 --> 00:12:59,810 So let me just give you guys a quick introduction to the UI. 101 00:13:00,530 --> 00:13:06,310 Okay, so when you first go to the Velociraptor UI, you will see the dashboard. 102 00:13:06,890 --> 00:13:13,410 Over here on the left side, you can see the number of different options of the different screens of the UI. 103 00:13:13,770 --> 00:13:21,990 The home screen is just a dashboard that tells you a of the server. 104 00:13:21,990 --> 00:13:24,830 You can see how many connected clients there are. 105 00:13:25,370 --> 00:13:33,590 And over here, you can see all the GUI users that are currently configured and what kind of roles they have. 106 00:13:34,510 --> 00:13:38,490 You can see that I only created one user called administrator. 107 00:13:38,730 --> 00:13:40,570 I can create other ones. 108 00:13:40,790 --> 00:13:47,130 And then over here, we can see there is a server version with the version of the server that's currently running. 109 00:13:48,410 --> 00:13:49,890 So that's great. 110 00:13:49,930 --> 00:13:56,610 Normally, when I would use Velociraptor, I might want to look at a specific endpoint. 111 00:13:56,910 --> 00:13:59,430 So I would usually search for it. 112 00:13:59,450 --> 00:14:01,090 And over here, there's a search box. 113 00:14:01,090 --> 00:14:04,490 I can use the host name. 114 00:14:04,490 --> 00:14:09,290 You can see that it has some kind of completion going on here. 115 00:14:10,090 --> 00:14:13,030 Or I can actually label machines. 116 00:14:13,030 --> 00:14:16,850 You can see I can take this machine and create a label. 117 00:14:18,290 --> 00:14:20,030 And let's say I call it test. 118 00:14:20,030 --> 00:14:26,210 The label can be anything, but it simply adds the label to that machine. 119 00:14:26,210 --> 00:14:27,870 So now it's called test. 120 00:14:27,870 --> 00:14:32,010 Now I can actually search for label test. 121 00:14:32,010 --> 00:14:35,730 And labels are useful later on when we do hunting and so on. 122 00:14:35,730 --> 00:14:38,250 We can select specific labels. 123 00:14:39,030 --> 00:14:44,650 So once we search for a machine that we want to look at, in more detail, we can just click on it. 124 00:14:44,650 --> 00:14:50,530 And this is just an overview screen to show us what this machine is all about. 125 00:14:50,530 --> 00:14:54,330 This is a Windows server data center machine. 126 00:14:54,510 --> 00:14:58,090 And then we've got some basic information about it. 127 00:14:58,290 --> 00:15:08,970 In this screen, probably the most important thing is the agent version and when it was last seen and the last IP address that we've seen coming from that machine. 128 00:15:08,970 --> 00:15:17,410 If we click over to the drill down page, then we can see more details about it, about the machine. 129 00:15:17,550 --> 00:15:22,630 You can see more information about the platform and all that sort of stuff. 130 00:15:22,630 --> 00:15:26,010 But this is probably a more interesting thing. 131 00:15:26,010 --> 00:15:30,850 It shows us the footprint of the agent on the endpoint. 132 00:15:31,170 --> 00:15:37,330 So we can see that it takes like 35, around 35 megabytes of memory. 133 00:15:37,550 --> 00:15:43,990 And the CPU load is virtually zero because the agent's not really doing anything. 134 00:15:44,030 --> 00:15:57,610 So when we do some heavy hunting and we might actually do a lot more work on the machine on the endpoint, then it's useful to see how much memory we're actually using and how much impact we're having on the endpoints. 135 00:15:58,030 --> 00:16:05,910 And then this particular one shows us also the users that exist on the endpoints. 136 00:16:05,950 --> 00:16:09,250 But this is just kind of an overview information about it. 137 00:16:09,250 --> 00:16:18,290 We always collect telemetry so you can always see the most recent telemetry from the endpoint about footprint and so on. 138 00:16:18,510 --> 00:16:22,210 The next tab over shows us the interactive shell. 139 00:16:22,210 --> 00:16:28,190 This is an easy UI that allows us to just create, just run shell commands on the machine. 140 00:16:28,330 --> 00:16:36,890 We try generally not to run too many shell commands because they can be unpredictable, but it's possible to just break into a shell. 141 00:16:37,070 --> 00:16:40,110 Over here we've got a number of different options. 142 00:16:40,110 --> 00:16:45,290 We can run our shell commands through PowerShell or CommandShell or Bash. 143 00:16:45,530 --> 00:16:54,710 Usually I would prefer to run with PowerShell because it's just a little more reliable with regards to escaping quotes and stuff like that. 144 00:16:55,290 --> 00:17:06,330 So here's an example, ipconfig slash all examples will show us everything about the interface. 145 00:17:06,330 --> 00:17:10,970 You can see that over here, this is the time and who ran the command. 146 00:17:10,970 --> 00:17:16,130 So when you have multiple users, you can see who actually issued this shell command. 147 00:17:16,130 --> 00:17:23,330 And over here we have kind of a little bit of a UI here that kind of hides the results a little bit. 148 00:17:23,470 --> 00:17:31,990 When you have many shell commands, then it's easy to see, it's really easy to lose it. 149 00:17:31,990 --> 00:17:34,510 So it allows you to kind of hide them a little bit. 150 00:17:34,810 --> 00:17:39,250 And this one just kind of hides them inside of a kind of indented cell. 151 00:17:39,250 --> 00:17:41,270 So it's just the UI kind of feature. 152 00:17:41,570 --> 00:17:51,390 But we can essentially type something else, google.com, and then run it. 153 00:17:51,390 --> 00:17:54,750 And you'll see that this spinner will just wait while the command is running. 154 00:17:55,470 --> 00:17:58,570 And then when they complete, we will see the results. 155 00:17:58,570 --> 00:18:00,950 So we can see that the results. 156 00:18:00,950 --> 00:18:07,770 So this is kind of handy when you have to do interactively look at the machine. 157 00:18:10,170 --> 00:18:13,870 The next one over is the VFS. 158 00:18:13,870 --> 00:18:20,050 The VFS is a way for us to interactively examine the machine, the machine's file system. 159 00:18:20,110 --> 00:18:27,030 So over here we have these are accesses, different types of things that we can look at. 160 00:18:27,210 --> 00:18:37,890 And what we're looking at here is really just the server's cache of what the file system sort of looks like. 161 00:18:37,890 --> 00:18:41,370 But it isn't just checking the file system on the endpoint. 162 00:18:41,370 --> 00:18:43,730 It's just what it already knows about. 163 00:18:44,190 --> 00:18:50,670 So when you navigate to a directory that hasn't been listed before, then it doesn't know about it. 164 00:18:50,670 --> 00:18:54,010 And it tells you no data available for this directory. 165 00:18:54,510 --> 00:18:57,130 So initially, there will be no data available. 166 00:18:57,130 --> 00:19:01,610 So you can click on this button here to refresh the directory. 167 00:19:01,850 --> 00:19:13,470 And what it will do is it will just issue a directory refresh query to the endpoint and just list the directory, and then refresh the server's view of it. 168 00:19:13,650 --> 00:19:18,030 So you can sort of go through and click and refresh, click and refresh. 169 00:19:18,030 --> 00:19:25,630 Or you can simply just do this recursive refresh, and it just goes off. 170 00:19:25,730 --> 00:19:33,330 And it takes a little bit longer, but it just recursively refreshes all the subdirectories. 171 00:19:33,530 --> 00:19:38,170 So you can kind of look through them without having to click all the time. 172 00:19:38,790 --> 00:19:40,870 So this is a bit of a UI thing. 173 00:19:41,950 --> 00:19:56,510 And for example, if we have a look at our files, we can have... for instance, you would know that there is an ntuser.dat in the user's home directory. 174 00:19:57,510 --> 00:20:01,910 And we don't actually have the data, we just know about it. 175 00:20:01,910 --> 00:20:03,450 So we listed the directory. 176 00:20:03,450 --> 00:20:09,210 And if we actually want to see that file, then we can fetch that file specifically from the endpoint. 177 00:20:09,550 --> 00:20:12,910 So we can just click on this thing, and it goes off and fetches it. 178 00:20:12,910 --> 00:20:20,730 And then we'll have a little icon here, which is, you know, just indicates that the server has a copy of that file now. 179 00:20:20,730 --> 00:20:26,590 So we're able to see it from the server, and we can also download it and things like that. 180 00:20:26,590 --> 00:20:40,750 And for those of you who know, you would have seen that typically the ntuser.dat is locked when a user is logged in, but Velociraptor will fall back to raw NTFS parsing in case it's locked. 181 00:20:40,750 --> 00:20:44,250 So it will actually retrieve the data, even if it's locked. 182 00:20:44,250 --> 00:20:46,790 And you can see hex view and so on. 183 00:20:47,610 --> 00:20:53,550 So that's essentially the VFS view, which is the virtual file system. 184 00:20:53,750 --> 00:20:57,410 And it's just a view over in the NTFS. 185 00:20:57,410 --> 00:21:04,870 I think we can actually see what it looks like in a raw NTFS parser. 186 00:21:04,870 --> 00:21:16,350 So we can see all those hidden files like the MFD, and we can collect the MFD in exactly the same way as we did before from the server, just by pressing this button. 187 00:21:17,510 --> 00:21:21,730 MFD is somewhat larger, so it's going to take a little bit longer. 188 00:21:22,270 --> 00:21:29,550 Okay, so the question is, what are we doing when we're pressing these GUI buttons? 189 00:21:29,550 --> 00:21:34,830 And we can essentially just look at it in the same way and download it and so forth. 190 00:21:35,850 --> 00:21:42,450 So you might wonder what is actually happening here with the Velociraptor endpoints? 191 00:21:42,590 --> 00:21:46,970 Well, Velociraptor is really a VQL engine. 192 00:21:46,970 --> 00:21:49,370 It just runs these query languages. 193 00:21:49,530 --> 00:21:56,290 VQL is the query language that runs the entire Velociraptor architecture. 194 00:21:56,530 --> 00:22:04,410 When we click on the UI, what we're doing is we're issuing VQL queries on the endpoints. 195 00:22:04,410 --> 00:22:06,860 We're just issuing different kinds of queries. 196 00:22:08,070 --> 00:22:15,090 And so if we go back to our overview here, then we have the Collector tab. 197 00:22:15,810 --> 00:22:19,820 And this Collector tab shows us all the artifacts that we've collected. 198 00:22:20,250 --> 00:22:27,190 So an artifact is simply a VQL query. 199 00:22:27,490 --> 00:22:37,350 So every time we click through the UI behind the scenes, the UI simply issues a different kind of artifact to collect from the endpoints. 200 00:22:37,350 --> 00:22:42,410 In other words, it just simply issues different kinds of VQL queries. 201 00:22:42,410 --> 00:22:45,870 And you can see that by simply looking at the Request tab. 202 00:22:45,870 --> 00:22:54,170 The Request tab is showing us all the raw requests that is going out to each endpoint. 203 00:22:54,170 --> 00:22:57,530 And we can see over here, queries. 204 00:22:57,530 --> 00:22:59,770 This is the VQL queries that are going out. 205 00:22:59,770 --> 00:23:06,190 So really, whenever we talk to the endpoint, all we're doing is sending VQL queries to the endpoint. 206 00:23:07,390 --> 00:23:10,390 And that's basically all it is. 207 00:23:11,330 --> 00:23:21,690 So for instance, here, when we ran the PowerShell, we're looking at different PowerShell and we can see, you know, we sent a command, that was the query, and so on. 208 00:23:21,970 --> 00:23:23,110 Let's have a look. 209 00:23:23,190 --> 00:23:28,950 So when the query is going to the endpoint, then it will execute on the endpoint. 210 00:23:29,330 --> 00:23:32,550 And the next tab that's interesting is the query log. 211 00:23:32,550 --> 00:23:42,470 So as the query is executing on the endpoint, the endpoint is logging some interesting things about the query, so like errors or anything like that. 212 00:23:42,470 --> 00:23:48,270 So we can see over here, that as the query is running, we get logs. 213 00:23:49,130 --> 00:23:59,510 And then finally, it tells us how many rows the query is returning, because ultimately, all queries just return rows, because, you know, it's just a query. 214 00:23:59,530 --> 00:24:05,570 So the results tab simply shows us the rows that are returned for each query. 215 00:24:05,570 --> 00:24:15,670 In this case, when we ran the PowerShell, it just returns a row and has a column called std out, and then std error and the return code. 216 00:24:15,910 --> 00:24:24,890 Over here, when we listed the directory, it has a bigger query, and it returns more rows and more columns. 217 00:24:25,310 --> 00:24:27,270 But ultimately, it's still the same. 218 00:24:27,270 --> 00:24:28,570 It's just a table. 219 00:24:28,570 --> 00:24:32,130 Everything we do is just a table that's returning. 220 00:24:32,810 --> 00:24:36,850 All the queries are simply tables. 221 00:24:37,450 --> 00:24:41,410 So we looked at the VFS UI, and it's kind of a nice UI. 222 00:24:41,410 --> 00:24:52,290 It's intuitive, and it's kind of what we're used to when we look at, you know, Windows Explorer, something like that, people quite understand this sort of file system hierarchy. 223 00:24:52,630 --> 00:24:59,530 But we've seen that it actually just creates artifact collections in the background, but we can actually just collect other artifacts. 224 00:25:00,650 --> 00:25:05,150 So if we click on this plus button here, we will collect a new artifact. 225 00:25:05,810 --> 00:25:07,850 And over here, we have a search screen. 226 00:25:07,850 --> 00:25:12,690 So we can search for a number of different kind of artifacts. 227 00:25:12,970 --> 00:25:17,810 For example, a prefetch artifact. 228 00:25:18,170 --> 00:25:34,330 So as you know, prefetch is a set of files that are stored in the Windows prefetch folder, and they maintain a list of information about executables that are typically run. 229 00:25:34,330 --> 00:25:42,430 But one of the cool things about them is that they actually maintain a timeline of each executable when it was run. 230 00:25:42,830 --> 00:25:59,390 So it's often useful to build a timeline based on the prefetch information, because then we will be able to pinpoint when a particular binary was run, which might be useful for a GFIR investigation. 231 00:25:59,390 --> 00:26:04,830 So we can choose the prefetch artifact. 232 00:26:05,010 --> 00:26:17,410 And we can see that the artifact gives us a bit of an explanation about what it is that it's doing, a little bit of background information, then it can take a bunch of parameters. 233 00:26:17,850 --> 00:26:22,090 And over here, we can see this is the PQL source that's actually going to run. 234 00:26:22,370 --> 00:26:23,890 So we can look at it. 235 00:26:23,890 --> 00:26:26,490 But we don't really need to kind of understand it too much. 236 00:26:26,490 --> 00:26:29,150 If we want to collect this, we simply click add. 237 00:26:29,670 --> 00:26:33,550 And then we will fold that top pane up. 238 00:26:33,550 --> 00:26:37,810 So that will give us access to all the parameters that we can configure. 239 00:26:38,450 --> 00:26:47,090 And the parameters are actually then used to control the query, the VQL query, or by the artifact. 240 00:26:47,130 --> 00:26:57,370 But you know, here we can, this particular artifact allows us to filter by timestamps or, you know, or binary regular expressions or other things like this. 241 00:26:58,830 --> 00:27:05,550 So, but we're just going to just run it, but usually the defaults do kind of the right thing. 242 00:27:05,630 --> 00:27:11,770 So when we run it, it will immediately issue that collection and collect that from the endpoint. 243 00:27:12,290 --> 00:27:12,590 Right? 244 00:27:12,590 --> 00:27:18,290 So it basically goes off and builds a timeline from the prefetch data. 245 00:27:18,290 --> 00:27:23,250 So every time we run a binary, it has some, some timing here. 246 00:27:23,430 --> 00:27:25,070 So this is really great, right? 247 00:27:25,070 --> 00:27:29,450 We basically can, can see what, what the results are. 248 00:27:29,590 --> 00:27:30,490 Right? 249 00:27:30,490 --> 00:27:44,010 Another very interesting one is to look for scheduled tasks, scheduled tasks, because that's a pretty common, a pretty common persistence mechanism. 250 00:27:44,650 --> 00:27:49,070 And then, you know, all we have to do is simply click add and then just launch it. 251 00:27:49,750 --> 00:27:50,890 And off we go. 252 00:27:50,890 --> 00:27:56,990 It just, it goes off and calculates it and take a couple of seconds and do that. 253 00:27:57,770 --> 00:27:57,930 Okay. 254 00:27:57,930 --> 00:27:59,830 And then we have the results here. 255 00:27:59,910 --> 00:28:04,330 So this is basically how we would collect a bunch of information. 256 00:28:06,170 --> 00:28:07,130 Right? 257 00:28:10,130 --> 00:28:12,390 So, so far it was kind of nice. 258 00:28:12,390 --> 00:28:18,490 We collected specific information from the endpoint about prefetch, about task scheduler, et cetera. 259 00:28:18,870 --> 00:28:22,890 What if we wanted to collect it from all our machines at once? 260 00:28:23,110 --> 00:28:32,470 We have, I mean, in this case, we only have one machine connected to this deployment, but typically we might have say 10,000 endpoints connected to the deployment. 261 00:28:33,010 --> 00:28:38,550 When we want to collect the same artifact from many machines at once, we call this a hunt. 262 00:28:38,650 --> 00:28:50,630 And over here we have the hunt manager, which is exactly the same idea, except it just automatically collects it from all the machines that are connected at once. 263 00:28:50,670 --> 00:28:55,210 So we have a similar GUI, very similar UI to before, right? 264 00:28:55,210 --> 00:28:58,030 Except now we're doing it in a hunt. 265 00:28:58,070 --> 00:29:03,910 So let's just say that we wanted to find all the information about running processes. 266 00:29:03,910 --> 00:29:06,850 So we wanted to use PSLIST as a hunt. 267 00:29:06,850 --> 00:29:19,970 So we just choose add, and again, we can configure it somehow and see that we can do a regular expression for which processes we want to look at and so on. 268 00:29:20,370 --> 00:29:23,390 But this time, hunt has an expiry. 269 00:29:23,390 --> 00:29:30,030 What this means is that once we start this hunt, it will just continue running until the expiry time. 270 00:29:30,030 --> 00:29:38,650 And anytime a new machine comes back online and connects to our endpoint, it will pick that collection up and it will just run it. 271 00:29:38,650 --> 00:29:43,310 So we don't have to catch the machine when it's on. 272 00:29:44,010 --> 00:29:52,210 Basically, we just schedule it and it will just run it when the machine comes online in its convenience, right? 273 00:29:52,210 --> 00:29:55,650 So we click next. 274 00:29:55,650 --> 00:30:02,270 We can specify description, process listing, let's say. 275 00:30:03,830 --> 00:30:04,950 Next. 276 00:30:05,210 --> 00:30:11,370 And here we can choose to run it everywhere or just choose the right labels. 277 00:30:11,370 --> 00:30:14,170 If you recall before, we created the label before. 278 00:30:14,170 --> 00:30:15,130 We'll test. 279 00:30:15,130 --> 00:30:21,170 We can simply restrict it to all those machines that have that label or run everywhere. 280 00:30:21,930 --> 00:30:25,710 And run everywhere will assign the hunt to all the machines. 281 00:30:26,710 --> 00:30:28,050 So we click next. 282 00:30:28,050 --> 00:30:30,590 Now it's showing us this is going to be the request. 283 00:30:30,590 --> 00:30:32,190 This is what we're going to be sending. 284 00:30:32,930 --> 00:30:34,170 Looks good. 285 00:30:34,210 --> 00:30:35,450 Let's go. 286 00:30:35,770 --> 00:30:39,250 When we create the hunt, it's created in a paused state. 287 00:30:39,250 --> 00:30:41,570 So it's not actually running yet. 288 00:30:41,910 --> 00:30:45,350 We click start to actually start it. 289 00:30:45,810 --> 00:30:47,230 And off it goes. 290 00:30:47,310 --> 00:30:52,130 As soon as we click start, it schedules it to all the machines that are currently connected. 291 00:30:52,130 --> 00:30:55,330 So far, it's only got one machine. 292 00:31:00,290 --> 00:31:01,570 And it's finished. 293 00:31:01,570 --> 00:31:06,210 So as soon as the machines will finish, it essentially creates that. 294 00:31:06,350 --> 00:31:09,390 We can have a look at all the clients that are connected. 295 00:31:09,390 --> 00:31:12,410 There's really only one in this case, but there could be many more. 296 00:31:12,550 --> 00:31:17,590 The status tab shows us if there's any errors. 297 00:31:18,290 --> 00:31:22,190 And over here, we can see the results of the hunt. 298 00:31:23,410 --> 00:31:27,990 So over here, we can see this is a process listing of this machine. 299 00:31:30,630 --> 00:31:39,670 If we wanted to process this data using another tool, then we simply need to prepare a download over here. 300 00:31:39,670 --> 00:31:46,490 And it will create a zip file that contains all of the information in this hunt from all the machines. 301 00:31:46,490 --> 00:31:47,550 Let's take a look. 302 00:31:47,550 --> 00:31:49,190 What does the zip file look like? 303 00:31:49,430 --> 00:31:53,210 This is only going to be a small one because it's really only the one machine. 304 00:31:53,470 --> 00:32:02,230 But we're going to see a CSV and adjacent file of all of the results combined from all the machines. 305 00:32:02,730 --> 00:32:08,930 And as well as that, we actually have the collection split up for each machine. 306 00:32:08,930 --> 00:32:10,170 These are the logs. 307 00:32:10,690 --> 00:32:15,510 And these are the artifacts that we ended up collecting as part of these hunts. 308 00:32:15,510 --> 00:32:18,510 So that sort of split up individually and combined. 309 00:32:19,470 --> 00:32:26,370 And also, if any of these hunts collect files, then we will be able to get that in the zip as well. 310 00:32:26,670 --> 00:32:31,330 So this is just a way that we can use to export data. 311 00:32:31,550 --> 00:32:36,490 Now over here, you can see that it's still kind of in the running state. 312 00:32:36,670 --> 00:32:38,410 And some people are confused by that. 313 00:32:38,410 --> 00:32:43,910 But this is just, that hunts always run, they simply expire. 314 00:32:44,130 --> 00:32:54,690 So when we created until the expiry time, when we started till the expiry time, for that time period, it will be active, and then it will become stopped by itself. 315 00:32:55,190 --> 00:33:02,310 And it will no stop means that it no longer accepts new new clients that come online at that time. 316 00:33:02,310 --> 00:33:05,010 So that's, that's basically hunts. 317 00:33:06,210 --> 00:33:08,450 Okay, so that's, that's pretty cool. 318 00:33:08,450 --> 00:33:12,070 We can see how we can export the data and use it in another tool. 319 00:33:12,270 --> 00:33:20,270 Sometimes, we really want to be able to post process the data within the tool within FlossRaptor. 320 00:33:20,590 --> 00:33:28,270 So the next feature I wanted to show you guys is the notebook feature. 321 00:33:28,270 --> 00:33:43,580 Notebook is basically like a collaborative analyst tool that we can use to, to analyze the results from a particular investigation, put them together and post process them. 322 00:33:43,950 --> 00:33:47,090 So I'm just going to show you quickly how I would build a notebook. 323 00:33:47,630 --> 00:33:53,350 So I would click this plus button here, which creates a new notebook. 324 00:33:53,750 --> 00:34:01,250 And I can call it whatever I want, like test notebook, for example, give it some description. 325 00:34:02,690 --> 00:34:06,350 And here I can choose collaborators that I would like to collaborate. 326 00:34:06,350 --> 00:34:14,310 So it's like a collaborating, you know, a Google Doc or something like that is it's very pretty familiar concept. 327 00:34:14,610 --> 00:34:18,010 When I submit it, it will create a new notebook over here. 328 00:34:18,370 --> 00:34:23,750 And, and you'll see that down here we have the title will be copied into here. 329 00:34:23,930 --> 00:34:28,030 So that over here, we can see all the notebooks that I currently have. 330 00:34:28,030 --> 00:34:33,430 And when I click over here, I have to actually click on the title itself to bring it into focus. 331 00:34:33,430 --> 00:34:38,110 And I will see that it creates, this is called a cell. 332 00:34:38,150 --> 00:34:40,950 So a notebook is consisting of different cells. 333 00:34:41,010 --> 00:34:44,670 And over here, again, this is called a markdown cells. 334 00:34:44,670 --> 00:34:46,890 You can see its type is markdown. 335 00:34:47,070 --> 00:34:51,210 So I can simply use, just describe this. 336 00:34:51,210 --> 00:34:54,850 And normally I would put like some background for the investigation. 337 00:34:55,450 --> 00:34:59,390 Demo cell for demo. 338 00:35:00,250 --> 00:35:00,810 Right. 339 00:35:00,810 --> 00:35:07,690 And I actually can also copy paste, copy image, take a screenshot. 340 00:35:07,690 --> 00:35:10,070 I can actually paste the image in here. 341 00:35:11,650 --> 00:35:12,250 Right. 342 00:35:12,250 --> 00:35:13,850 And this is just markdown. 343 00:35:13,850 --> 00:35:17,970 If you're familiar with the markdown, it's very, very familiar. 344 00:35:18,310 --> 00:35:21,150 When we save it, it simply renders it. 345 00:35:21,150 --> 00:35:24,230 So it's just a markdown here where I can put some notes. 346 00:35:24,230 --> 00:35:32,330 So that's not the most interesting thing, but let's say that I wanted to do more interesting post-processing. 347 00:35:32,330 --> 00:35:38,670 Well, I can create another cell and add it from a particular flow or hunt that I've created previously. 348 00:35:38,910 --> 00:35:41,550 So from a particular collection. 349 00:35:41,850 --> 00:35:45,550 So let's just add cell from flow. 350 00:35:45,550 --> 00:35:50,630 I choose the client and these are the flows that ran before. 351 00:35:50,630 --> 00:35:50,830 Right. 352 00:35:50,830 --> 00:35:54,130 So here I've got my task schedule, for instance. 353 00:35:54,610 --> 00:35:58,430 So all this does is it creates VQL. 354 00:35:58,430 --> 00:36:03,130 It pre-fills the VQL for me with the right cell IDs and all this sort of stuff. 355 00:36:03,190 --> 00:36:10,510 This is simply a VQL query that just post-processes the information that we've already collected. 356 00:36:10,510 --> 00:36:13,510 So it doesn't go out to the client and collect the information again. 357 00:36:13,510 --> 00:36:15,630 It just post-processes it. 358 00:36:15,690 --> 00:36:25,350 It's useful in order for us to see, to be able to post-process it and filter it and so on. 359 00:36:25,350 --> 00:36:30,790 So for instance, in this particular case, we are looking at task schedule and this task scheduler. 360 00:36:31,090 --> 00:36:37,190 And, you know, maybe a particular malicious task would have maybe PowerShell. 361 00:36:37,190 --> 00:36:45,470 We wanted to know which tasks are running PowerShell. 362 00:36:45,530 --> 00:36:48,370 So this one will return all the tasks. 363 00:36:48,370 --> 00:36:50,110 And now we would like to filter it. 364 00:36:50,130 --> 00:37:01,010 Where commands, and this is the regular expression operator, matches PowerShell. 365 00:37:01,010 --> 00:37:01,230 Okay. 366 00:37:01,230 --> 00:37:05,730 And then if I press save, okay, there's no PowerShell here. 367 00:37:08,070 --> 00:37:08,790 Okay 368 00:37:13,710 --> 00:37:13,790 . 369 00:37:14,230 --> 00:37:17,510 So we have Google update or whatever. 370 00:37:17,510 --> 00:37:33,850 So you can basically run DLL is a common, this machine is not actually owned, but is not compromised, but so you can see it. 371 00:37:33,850 --> 00:37:39,430 So here, for example, we can filter by run DLL, see all the, all the commands that have run DLL. 372 00:37:39,570 --> 00:37:43,950 So this allows us to do these post-processing kind of operations. 373 00:37:44,290 --> 00:37:52,150 We can do the same thing, add cell from hunt and looking at our process listing hunt, same thing. 374 00:37:52,330 --> 00:37:58,490 It simply creates the table for us, the query for us initially, right? 375 00:37:58,490 --> 00:38:01,950 So for instance, we can say where, 376 00:38:07,320 --> 00:38:16,200 where name matches Velociraptor to see all the Velociraptor processes that are running. 377 00:38:16,200 --> 00:38:17,440 We can see there it is. 378 00:38:17,440 --> 00:38:19,660 The Velociraptor process is running. 379 00:38:19,660 --> 00:38:21,200 That's the hashes. 380 00:38:21,200 --> 00:38:23,320 That's the authentic code information. 381 00:38:23,440 --> 00:38:24,340 Is it signed? 382 00:38:24,340 --> 00:38:25,500 Yes, it is. 383 00:38:25,520 --> 00:38:26,020 And so on. 384 00:38:26,020 --> 00:38:32,200 So we can get this kind of high level information and the username is running it as a system. 385 00:38:32,340 --> 00:38:38,440 So this is a pretty cool, cool way of post-processing the different, different things. 386 00:38:38,940 --> 00:38:57,300 So I'm not going to get into too much into the, the artifacts and how to actually write the QL, but as a process to say that in this screen here, we can view all the different artifacts and let's just reiterate again, what an artifact is. 387 00:38:57,300 --> 00:39:11,920 As I said Velociraptor simply runs VQL, but if the UI simply required you to type a new query each time, and that would be very tedious and error prone, and it would just not be a very good user experience. 388 00:39:12,100 --> 00:39:27,820 So with Velociraptor, we have a concept of artifacts and artifact is simply a YAML file that contains the descriptions behind the particular VQL and the VQL itself. 389 00:39:28,240 --> 00:39:34,540 So let's have a look at something like, let's say the DNS, DNS cache. 390 00:39:34,640 --> 00:39:37,360 This is an example of a, of an artifact. 391 00:39:37,460 --> 00:39:45,400 And you can see that here in this screen, we can view all the different artifacts and we can actually edit them as well. 392 00:39:45,400 --> 00:39:50,080 So this particular artifact, you can see that it has some VQL here. 393 00:39:50,080 --> 00:39:53,540 It just queries the DNS cache on a Windows system. 394 00:39:53,780 --> 00:40:00,220 So we have some explanation of what it does, and then it just, it just does it right. 395 00:40:00,220 --> 00:40:07,240 So, so let's have a look at what does it look like in, we said it's a YAML file. 396 00:40:07,240 --> 00:40:13,600 So if we click the, to edit it a little bit. 397 00:40:13,900 --> 00:40:19,120 And so you can see that we can customize using this UI, we can customize the artifact. 398 00:40:19,840 --> 00:40:25,960 So we can simply add in here, the, the different, different things, right? 399 00:40:25,960 --> 00:40:28,520 So, you know, we could say, Oh, okay. 400 00:40:28,520 --> 00:40:40,100 You know, if we, maybe we wanted to add a filter or something else, we can simply, we can change this as required or write our own. 401 00:40:40,100 --> 00:40:46,700 And so we can go over here for instance, and let's open a new tab. 402 00:40:51,760 --> 00:40:53,080 Collected cache. 403 00:40:57,870 --> 00:40:58,390 Okay. 404 00:40:58,390 --> 00:41:01,050 Let's collect the DNS cache again. 405 00:41:02,290 --> 00:41:04,870 And it's very quick to do, to do that. 406 00:41:04,870 --> 00:41:09,710 As soon as we ask to collect it, it will, it will essentially do it instantly. 407 00:41:10,290 --> 00:41:13,210 It goes out to the end point and collects it instantly. 408 00:41:13,210 --> 00:41:19,530 And we can see all the different, all the different DNS names that are in cache at the moment. 409 00:41:20,130 --> 00:41:24,710 So hopefully this was a quick, short introduction to Velociraptor. 410 00:41:24,710 --> 00:41:29,110 We went through the installation process, which only took a couple of minutes. 411 00:41:29,310 --> 00:41:33,890 And then we went through some of the things that we can do with it. 412 00:41:34,210 --> 00:41:37,210 Again, the sky's the limit, really. 413 00:41:38,430 --> 00:41:51,690 We can collect different things and we would normally respond to the different incidents and collect, you know, connect different artifacts to, you know, all the time. 414 00:41:51,870 --> 00:42:05,490 But, you know, it's, it's just a very powerful tool that allows us to gain unprecedented visibility of the endpoints that we really can't get with other tools currently. 415 00:42:05,890 --> 00:42:06,550 Okay. 416 00:42:06,550 --> 00:42:07,810 Thanks for watching. 417 00:42:09,730 --> 00:42:17,250 And yeah, if you're interested in Velociraptor, have a look, go to the GitHub and download it. 418 00:42:17,250 --> 00:42:18,410 It's open source. 419 00:42:18,610 --> 00:42:21,450 And also contribute and join our community. 420 00:42:22,050 --> 00:42:24,290 Thanks again for listening. 421 00:42:25,290 --> 00:42:26,210 Thanks.