start	end	text
18160	22400	Hello everyone, Arthur Packett here. We have a pre-recorded video for you.
22540	28240	It's an intro to Velociraptor. This is about a 40-minute presentation. We hope you enjoy,
28240	32340	and if you have any questions, please feel free to direct them to the workshop track one
32340	37180	or the Recon Discord server for more immediate answers. We hope you enjoy.
40640	46980	...video to demonstrate how to install Velociraptor, and we'll just do a quick guided
46980	56760	tour through the Velociraptor features, and have a quick introduction to this new DFIR tool. I mean,
56760	62460	you might have heard of Velociraptor before, and in this video we will show how to install it,
62460	69380	and we'll just do a quick demonstration. So I'm going to start off by... you can see my desktop.
69380	76960	This is a typical Windows system, and I'm going to show you how to install it from scratch in a
76960	83860	little bit, how to actually use it in real DFIR work. So the first thing that I'll do is I'm just
83860	93440	going to go to the GitHub page, and I'm just going to search for a GitHub page for Velociraptor,
94000	101860	and download all the releases. I'm going to show you how to install Velociraptor in the cloud,
101860	107000	on a cloud platform. So the first thing I'll do is I'll download the releases.
107360	115600	I'm going to have a server which will run on Linux, so I'm going to need to download the Linux
116180	123280	binary. I'm also going to run the Windows executable on Windows, so I'm going to need
123280	130860	to download the Windows binary. And also, finally, I'm going to need to download the source code,
130860	137960	so I can show you guys how to build an MSI installer. So once I download these binaries,
137960	146220	I'm going to open a new shell, and I'm just going to run it as administrator,
146980	157120	so I can install the relevant MSIs. And since I just downloaded it into the downloads directory,
157120	171480	I'm just going to change directory to that, like downloads. And if I do a dir, you can see the
171480	177260	binaries that I've just downloaded. Okay, great. So the first thing that we need to do is create
178860	186200	a configuration file in which we can deploy on the server. I'm going to create the configuration
186200	192320	file on the Windows machine, and then I'm going to push it out into the server, create a Debian
192320	199800	package, and push it to a Debian server in the cloud. So first thing I will do is I will generate
200200	208100	a configuration file using the configuration wizard. I'm going to use the dash i flag,
208100	213580	which is the interactive wizard, which will help me generate the configuration.
215580	222060	So it goes off and it will ask me some questions about what exactly, what type of deployment I want
222060	226980	to use, and it will actually create configuration for that. I'll start off, I'm going to be running
226980	234020	it on a Debian machine, so I'll choose a Linux server. File based data store is usually the
234020	242800	simplest, and this is the directory that I'm going to store all the files in. In this particular
242800	247340	example, we're going to create a Let's Encrypt certificate automatically, so it will create
247900	254320	an SSL certificate without any further intervention, and will also authenticate with
254880	260780	standard usernames and passwords. So this is the second option, and I'm going to use one of my
261440	270400	VM machines, training VMs, and this will be the domain name for the training VM. So because we
270400	278220	want to create an SSL certificate, we're going to need DNS to be properly set up.
278720	283860	So we're going to use a real DNS name, and Velociraptor has this really useful feature
283860	290700	where it will actually update dynamic DNS by itself, without us doing anything at all. So
290700	296160	if we use Google Domains for the DynDNS, it will be able to go out and update it. And over here,
296160	306400	I've got the credentials for that, which you can get from the dynamic DNS settings of the
306400	315920	Google Domains. So I just literally copied them into the prompt here.
317100	322780	And then it will ask me to create a new user. This is the initial administrative user that
322780	330360	will be created when the service installs. So I'm going to just create a new user and give it
331660	338600	a password here, and then just press enter. It will generate some keys,
338600	343720	finish configuring it, and you can see that it created a server config and a client config.
343720	349060	If I have a look at the files, then we have the server configuration, and then the client
349060	354240	configuration, which contain the keys, the key material, and all the configuration.
355080	365120	So the next step is simply to create a server Debian package using that configuration. So we're
365120	371520	going to run Velociraptor again and tell it to use the server configuration and Debian
373620	378880	server. So we're just asking it to create a Debian package for the server.
380060	387520	If we just try to do this now, then it will say, I don't actually have a Linux binary,
387520	392640	so you're running a Windows binary and you're asking me to build a Debian package, so I need
392640	399160	the Linux binary as well. So in this scenario, we're going to need to give it the Linux binary
399160	408440	to actually package as well. So we do that, and it will actually build us a Debian package. Let's
408440	414680	have a look. And we can see that there is a Debian package here that contains the configuration
414680	420360	embedded with it and all the startup scripts and it's all the service configuration. So all we have
420360	427680	to really do is now just push that to our cloud endpoint and then start it. So I'm just going to
427680	438940	scp it to my cloud machine and over here I've got my IP address of my cloud machine
442900	451280	and it will just copy the Debian package over there.
452640	456800	So now I will ssh to that machine and install it.
461020	465740	Okay, and if we have a look at my home directory, there is the Debian package there.
466260	475660	So I just install it with the package and it's going to head and install the service
475660	481240	and create it. So it's already pre-configured to start and it should just work,
481240	486540	should bring up the service. I can check the service is up, service
494840	503680	status, and it shows me green, active, running, and it's all ready to go. So now if I go to that
503680	518260	with HTTPS, vm1.training.velocidex.com, then I should be able to log in with the username and
518260	524720	password that I gave it before in the configuration file. So now we have a Velociraptor server set up.
524860	532280	It only takes a minute. You can see down here the version and this is the GUI. This is great,
532280	536120	so that's the server, but we still don't have any clients attached to it
536120	540820	because we haven't really deployed the client side of it. So now I'm going to show you how to
540820	549260	create an MSI for being able to deploy on the Windows platform. So let me get out of there.
550800	558880	So we'll go back to our downloads that we had here. And to build an MSI, we use a tool called
558880	566700	Wix, which is a typical MSI framework build framework. And it's very easy to do.
566940	573420	Let me just open the source code, which we downloaded from the GitHub page. And in the
573420	579620	docs directory, you will find a directory called Wix. And this directory contains all the scripts
579620	589160	required to build the Wix, to use Wix to build the MSI. So I'm just going to paste it
589780	594680	and just extract that one directory into the downloads directory.
596060	601400	Okay, so I can see it here. And let me go into it.
602260	608100	And I'll just quickly show you guys all the scripts here. We have a number of different
608100	614100	scripts. And what we want to do is we want to build in this case, a customized version
614660	621300	of our MSI that already embeds our special configuration. So that MSI will be used can
621300	628050	be used to then deploy using any number of software management tools like
630450	639510	Group Policy or SCCM or anything like that. So in order for these scripts to work,
639510	647830	I need to create a directory called output and copy into it the binary that I want to deploy,
647830	655790	which would be the Windows binary. I'll put and call it velociraptor.exe.
655790	661530	Okay, additionally, I want to copy the client configuration
662830	670410	into the output directory as well. So now I have two files in the output directory.
670410	675810	And these two files will be packaged. That's really all it is that's required to be packaged
676350	685170	in the MSI. So I'm just going to run the build custom script to create the custom MSI for me.
685790	693070	And all it does is it simply runs the Wix tool set with the right scripts and options
693070	701210	to just build the MSI. It's going to take a second and it will just create an MSI that I can then use.
703610	715950	Okay, so okay, now if I have a look, there is custom MSI here ready for me to build,
715950	720250	to deploy. So I'm just going to install it on my machine here.
722810	730270	And it will just install Velociraptor and it's ready to go. Okay, so that's all it took.
730370	733970	And if we have a look at it over here, and we should be able to see the client
734910	739750	already checking in. So it's installed it on this machine and checked into that
740510	744990	Debian machine in the cloud that's running the server. So that is really all that's required
744990	751230	to deploy Velociraptor client and server. So now I would actually just take that MSI
751230	756870	and deploy it across the fleet and get all the endpoints. So that's great. So we've actually
756870	763390	managed to install Velociraptor in a few minutes with a proper SSL certificate,
764150	770770	automatic DynDNS setup, and it's ready to go. We've seen all the clients.
770770	778430	And now what can we do with these clients? So let me just give you guys a quick introduction
778430	786310	to the UI. Okay, so when you first go to the Velociraptor UI, you will see the dashboard.
786890	790010	Over here on the left side, you can see the number of different options
790650	800070	of the different screens of the UI. The home screen is just a dashboard that tells you a
800070	806570	of the server. You can see how many connected clients there are. And over here, you can see
806570	815050	all the GUI users that are currently configured and what kind of roles they have. You can see
815050	821370	that I only created one user called administrator. I can create other ones. And then over here,
821370	827130	we can see there is a server version with the version of the server that's currently running.
828410	835190	So that's great. Normally, when I would use Velociraptor, I might want to look at a specific
835190	841770	endpoint. So I would usually search for it. And over here, there's a search box. I can use
842930	851990	the host name. You can see that it has some kind of completion going on here. Or I can actually
851990	859210	label machines. You can see I can take this machine and create a label. And let's say I call
859210	866950	it test. The label can be anything, but it simply adds the label to that machine. So now it's called
866950	875050	test. Now I can actually search for label test. And labels are useful later on when we do hunting
875050	881870	and so on. We can select specific labels. So once we search for a machine that we want to look at,
881990	888050	in more detail, we can just click on it. And this is just an overview screen to show us
888710	895750	what this machine is all about. This is a Windows server data center machine. And then we've got
895750	901250	some basic information about it. In this screen, probably the most important thing is the agent
901250	908970	version and when it was last seen and the last IP address that we've seen coming from that machine.
908970	915830	If we click over to the drill down page, then we can see more details about it,
915830	922630	about the machine. You can see more information about the platform and all that sort of stuff.
922630	929870	But this is probably a more interesting thing. It shows us the footprint of the agent on the
929870	938210	endpoint. So we can see that it takes like 35, around 35 megabytes of memory. And
938210	943990	the CPU load is virtually zero because the agent's not really doing anything.
944030	948470	So when we do some heavy hunting and we might actually do a lot more work on the machine
949210	954210	on the endpoint, then it's useful to see how much memory we're actually using and how much
954210	960830	impact we're having on the endpoints. And then this particular one shows us also
961700	967350	the users that exist on the endpoints. But this is just kind of an overview
967950	971450	information about it. We always collect telemetry so you can always see
972190	979430	the most recent telemetry from the endpoint about footprint and so on. The next tab over
979430	985870	shows us the interactive shell. This is an easy UI that allows us to just create,
985870	991150	just run shell commands on the machine. We try generally not to run too many shell commands
991150	996890	because they can be unpredictable, but it's possible to just break into a shell.
997070	1002690	Over here we've got a number of different options. We can run our shell commands through PowerShell
1002690	1009210	or CommandShell or Bash. Usually I would prefer to run with PowerShell because it's just a little
1009210	1018310	more reliable with regards to escaping quotes and stuff like that. So here's an example,
1018310	1026330	ipconfig slash all examples will show us everything about the interface.
1026330	1032010	You can see that over here, this is the time and who ran the command. So when you have multiple
1032010	1038790	users, you can see who actually issued this shell command. And over here we have kind of a little
1038790	1045910	bit of a UI here that kind of hides the results a little bit. When you have many shell commands,
1045910	1053850	then it's easy to see, it's really easy to lose it. So it allows you to kind of hide them a little
1053850	1060170	bit. And this one just kind of hides them inside of a kind of indented cell. So it's just the UI
1060170	1069450	kind of feature. But we can essentially type something else, google.com,
1069450	1074750	and then run it. And you'll see that this spinner will just wait while the command is running.
1075470	1080090	And then when they complete, we will see the results. So we can see that
1080090	1087770	the results. So this is kind of handy when you have to do interactively look at the machine.
1090170	1098110	The next one over is the VFS. The VFS is a way for us to interactively examine the machine,
1098110	1105610	the machine's file system. So over here we have these are accesses, different types of things
1105610	1112090	that we can look at. And what we're looking at here is really just the server's cache of
1113590	1120910	what the file system sort of looks like. But it isn't just checking the file system on the
1120910	1127830	endpoint. It's just what it already knows about. So when you navigate to a directory that hasn't
1127830	1133030	been listed before, then it doesn't know about it. And it tells you no data available for this
1133030	1139590	directory. So initially, there will be no data available. So you can click on this button here
1139590	1146910	to refresh the directory. And what it will do is it will just issue a directory refresh query to
1146910	1153470	the endpoint and just list the directory, and then refresh the server's view of it.
1153650	1159310	So you can sort of go through and click and refresh, click and refresh. Or you can simply
1159310	1167730	just do this recursive refresh, and it just goes off. And it takes a little bit longer,
1167730	1176090	but it just recursively refreshes all the subdirectories. So you can kind of look through
1176090	1182750	them without having to click all the time. So this is a bit of a UI thing. And for example,
1182750	1190950	if we have a look at our files, we can have... for instance, you would know that there is an
1190950	1201710	ntuser.dat in the user's home directory. And we don't actually have the data, we just know about
1201710	1207030	it. So we listed the directory. And if we actually want to see that file, then we can fetch that file
1207030	1212650	specifically from the endpoint. So we can just click on this thing, and it goes off and fetches
1212650	1219190	it. And then we'll have a little icon here, which is, you know, just indicates that the server has
1219270	1224890	a copy of that file now. So we're able to see it from the server, and we can also download it and
1225430	1231550	things like that. And for those of you who know, you would have seen that typically the ntuser.dat
1231550	1238310	is locked when a user is logged in, but Velociraptor will fall back to raw NTFS parsing
1238930	1244870	in case it's locked. So it will actually retrieve the data, even if it's locked. And you can see
1244870	1253550	hex view and so on. So that's essentially the VFS view, which is the virtual file system.
1253750	1259530	And it's just a view over in the NTFS. I think we can actually see
1261030	1266430	what it looks like in a raw NTFS parser. So we can see all those hidden files
1266430	1271190	like the MFD, and we can collect the MFD in exactly the same way as we did before
1272050	1279990	from the server, just by pressing this button. MFD is somewhat larger,
1279990	1286610	so it's going to take a little bit longer. Okay, so the question is, what are we doing
1286610	1292330	when we're pressing these GUI buttons? And we can essentially just look at it in the same way
1292810	1298610	and download it and so forth. So you might wonder what is actually happening here
1299060	1307230	with the Velociraptor endpoints? Well, Velociraptor is really a VQL engine. It just
1307230	1314950	runs these query languages. VQL is the query language that runs the entire Velociraptor
1314950	1322670	architecture. When we click on the UI, what we're doing is we're issuing VQL queries
1322670	1326860	on the endpoints. We're just issuing different kinds of queries.
1328070	1335090	And so if we go back to our overview here, then we have the Collector tab.
1335810	1339820	And this Collector tab shows us all the artifacts that we've collected.
1340250	1349590	So an artifact is simply a VQL query. So every time we click through the UI
1349590	1356130	behind the scenes, the UI simply issues a different kind of artifact to collect from
1356130	1362890	the endpoints. In other words, it just simply issues different kinds of VQL queries. And you
1362890	1370050	can see that by simply looking at the Request tab. The Request tab is showing us all the raw
1370050	1378450	requests that is going out to each endpoint. And we can see over here, queries. This is the VQL
1378450	1383790	queries that are going out. So really, whenever we talk to the endpoint, all we're doing is sending
1383790	1393370	VQL queries to the endpoint. And that's basically all it is. So for instance, here, when we ran the
1393370	1398570	PowerShell, we're looking at different PowerShell and we can see, you know, we sent a command,
1398570	1406730	that was the query, and so on. Let's have a look. So when the query is going to the endpoint,
1406730	1412550	then it will execute on the endpoint. And the next tab that's interesting is the query log.
1412550	1417690	So as the query is executing on the endpoint, the endpoint is logging some interesting
1418430	1424670	things about the query, so like errors or anything like that. So we can see over here,
1424670	1432530	that as the query is running, we get logs. And then finally, it tells us how many rows
1432530	1438130	the query is returning, because ultimately, all queries just return rows, because, you know,
1438130	1445570	it's just a query. So the results tab simply shows us the rows that are returned for each query.
1445570	1452890	In this case, when we ran the PowerShell, it just returns a row and has a column called std out,
1452890	1458130	and then std error and the return code. Over here, when we listed the directory,
1458860	1466350	it has a bigger query, and it returns more rows and more columns. But ultimately,
1466350	1472130	it's still the same. It's just a table. Everything we do is just a table that's returning.
1472810	1481510	All the queries are simply tables. So we looked at the VFS UI, and it's kind of a nice UI. It's
1481510	1488010	intuitive, and it's kind of what we're used to when we look at, you know, Windows Explorer,
1488010	1493090	something like that, people quite understand this sort of file system hierarchy. But we've
1493090	1497590	seen that it actually just creates artifact collections in the background, but we can
1497590	1503090	actually just collect other artifacts. So if we click on this plus button here,
1503090	1509410	we will collect a new artifact. And over here, we have a search screen. So we can search for
1509710	1519270	a number of different kind of artifacts. For example, a prefetch artifact. So as you know,
1519270	1528530	prefetch is a set of files that are stored in the Windows prefetch folder, and they maintain
1529590	1535810	a list of information about executables that are typically run. But one of the cool things about
1535810	1545070	them is that they actually maintain a timeline of each executable when it was run. So it's often
1545070	1552770	useful to build a timeline based on the prefetch information, because then we will be able to
1553850	1559390	pinpoint when a particular binary was run, which might be useful for a GFIR investigation.
1559390	1568610	So we can choose the prefetch artifact. And we can see that the artifact gives us a bit
1568610	1574510	of an explanation about what it is that it's doing, a little bit of background information,
1574510	1580810	then it can take a bunch of parameters. And over here, we can see this is the PQL source
1580810	1585810	that's actually going to run. So we can look at it. But we don't really need to kind of understand
1585810	1590770	it too much. If we want to collect this, we simply click add. And then we will fold that
1590770	1597810	top pane up. So that will give us access to all the parameters that we can configure.
1598450	1605310	And the parameters are actually then used to control the query, the VQL query,
1605310	1611130	or by the artifact. But you know, here we can, this particular artifact allows us to filter by
1612050	1617370	timestamps or, you know, or binary regular expressions or other things like this.
1618830	1625550	So, but we're just going to just run it, but usually the defaults do kind of the right thing.
1625630	1631770	So when we run it, it will immediately issue that collection and collect that from the endpoint.
1632290	1639090	Right? So it basically goes off and builds a timeline from the prefetch data. So every time
1639090	1646510	we run a binary, it has some, some timing here. So this is really great, right? We basically can,
1646510	1652430	can see what, what the results are. Right? Another very interesting one is to look for
1652430	1662790	scheduled tasks, scheduled tasks, because that's a pretty common, a pretty common persistence
1662790	1669070	mechanism. And then, you know, all we have to do is simply click add and then just launch it.
1669750	1676990	And off we go. It just, it goes off and calculates it and take a couple of seconds and do that.
1677770	1681990	Okay. And then we have the results here. So this is basically how we would collect
1682930	1687130	a bunch of information. Right?
1690130	1694930	So, so far it was kind of nice. We collected specific information from the endpoint
1694930	1701550	about prefetch, about task scheduler, et cetera. What if we wanted to collect it from all our
1701550	1707190	machines at once? We have, I mean, in this case, we only have one machine connected to this
1707190	1712470	deployment, but typically we might have say 10,000 endpoints connected to the deployment.
1713010	1719070	When we want to collect the same artifact from many machines at once, we call this a hunt. And
1719070	1725530	over here we have the hunt manager, which is exactly the same idea, except it just automatically
1725530	1732750	collects it from all the machines that are connected at once. So we have a similar GUI,
1732750	1739470	very similar UI to before, right? Except now we're doing it in a hunt. So let's just say that we
1739470	1746850	wanted to find all the information about running processes. So we wanted to use PSLIST as a hunt.
1746850	1754250	So we just choose add, and again, we can configure it somehow and see that we can
1754250	1761710	do a regular expression for which processes we want to look at and so on. But this time,
1761710	1768190	hunt has an expiry. What this means is that once we start this hunt, it will just continue running
1768190	1774470	until the expiry time. And anytime a new machine comes back online and connects to our endpoint,
1774470	1780190	it will pick that collection up and it will just run it. So we don't have to
1780930	1787350	catch the machine when it's on. Basically, we just schedule it and it will just run it when
1787350	1798090	the machine comes online in its convenience, right? So we click next. We can specify description,
1798730	1802270	process listing, let's say.
1803830	1811970	Next. And here we can choose to run it everywhere or just choose the right labels. If you recall
1811970	1817410	before, we created the label before. We'll test. We can simply restrict it to all those machines
1817410	1825130	that have that label or run everywhere. And run everywhere will assign the hunt to all the
1825130	1830930	machines. So we click next. Now it's showing us this is going to be the request. This is what
1830930	1838430	we're going to be sending. Looks good. Let's go. When we create the hunt, it's created in a paused
1838430	1847230	state. So it's not actually running yet. We click start to actually start it. And off it goes.
1847310	1852130	As soon as we click start, it schedules it to all the machines that are currently connected.
1852130	1863510	So far, it's only got one machine. And it's finished. So as soon as the machines will finish,
1863510	1869510	it essentially creates that. We can have a look at all the clients that are connected. There's
1869510	1876370	really only one in this case, but there could be many more. The status tab shows us if there's
1876370	1882190	any errors. And over here, we can see the results of the hunt.
1883410	1887990	So over here, we can see this is a process listing of this machine.
1890630	1898690	If we wanted to process this data using another tool, then we simply need to prepare a download
1898690	1905450	over here. And it will create a zip file that contains all of the information in this hunt from
1905450	1910570	all the machines. Let's take a look. What does the zip file look like? This is only going to be
1910710	1917070	a small one because it's really only the one machine. But we're going to see a CSV and adjacent
1917070	1924990	file of all of the results combined from all the machines. And as well as that, we actually have
1925570	1933010	the collection split up for each machine. These are the logs. And these are the artifacts that
1933010	1938510	we ended up collecting as part of these hunts. So that sort of split up individually and combined.
1939470	1945790	And also, if any of these hunts collect files, then we will be able to get that in the zip as
1945790	1954210	well. So this is just a way that we can use to export data. Now over here, you can see that
1954210	1960570	it's still kind of in the running state. And some people are confused by that. But this is just,
1960570	1967150	that hunts always run, they simply expire. So when we created until the expiry time,
1967150	1972270	when we started till the expiry time, for that time period, it will be active, and then it will
1972270	1978610	become stopped by itself. And it will no stop means that it no longer accepts new
1979070	1985010	new clients that come online at that time. So that's, that's basically hunts.
1986210	1991270	Okay, so that's, that's pretty cool. We can see how we can export the data and use it in another
1991270	1999030	tool. Sometimes, we really want to be able to post process the data within the tool within
1999030	2008270	FlossRaptor. So the next feature I wanted to show you guys is the notebook feature.
2008270	2017470	Notebook is basically like a collaborative analyst tool that we can use to, to analyze
2018080	2023580	the results from a particular investigation, put them together and post process them.
2023950	2030970	So I'm just going to show you quickly how I would build a notebook. So I would click this plus
2030970	2037990	button here, which creates a new notebook. And I can call it whatever I want, like test notebook,
2037990	2045490	for example, give it some description. And here I can choose collaborators that I would
2045490	2050830	like to collaborate. So it's like a collaborating, you know, a Google Doc or something like that is
2050830	2059310	it's very pretty familiar concept. When I submit it, it will create a new notebook over here. And,
2059310	2065010	and you'll see that down here we have the title will be copied into here. So that over here,
2065010	2069530	we can see all the notebooks that I currently have. And when I click over here, I have to
2069530	2076450	actually click on the title itself to bring it into focus. And I will see that it creates,
2076450	2082850	this is called a cell. So a notebook is consisting of different cells. And over here, again,
2082850	2089630	this is called a markdown cells. You can see its type is markdown. So I can simply use,
2089630	2094850	just describe this. And normally I would put like some background for the investigation.
2095450	2106030	Demo cell for demo. Right. And I actually can also copy paste, copy image,
2106030	2110070	take a screenshot. I can actually paste the image in here.
2111650	2117010	Right. And this is just markdown. If you're familiar with the markdown, it's very, very
2117010	2123550	familiar. When we save it, it simply renders it. So it's just a markdown here where I can put some
2123550	2129650	notes. So that's not the most interesting thing, but let's say that I wanted to do more
2130350	2136870	interesting post-processing. Well, I can create another cell and add it from a particular flow
2136870	2144590	or hunt that I've created previously. So from a particular collection. So let's just add cell
2144590	2152150	from flow. I choose the client and these are the flows that ran before. Right. So here I've got my
2152150	2160510	task schedule, for instance. So all this does is it creates VQL. It pre-fills the VQL for me with
2160510	2168750	the right cell IDs and all this sort of stuff. This is simply a VQL query that just post-processes
2168750	2172150	the information that we've already collected. So it doesn't go out to the client and collect
2172150	2180130	the information again. It just post-processes it. It's useful in order for us to see,
2181090	2186930	to be able to post-process it and filter it and so on. So for instance, in this particular case,
2186930	2192690	we are looking at task schedule and this task scheduler. And, you know, maybe a particular
2194030	2203030	malicious task would have maybe PowerShell. We wanted to know which tasks are running
2204670	2210110	PowerShell. So this one will return all the tasks. And now we would like to filter it.
2210130	2217490	Where commands, and this is the regular expression operator,
2217490	2225730	matches PowerShell. Okay. And then if I press save, okay, there's no PowerShell here.
2228070	2245030	Okay. So we have Google update or whatever. So you can basically run DLL is a common,
2245030	2254130	this machine is not actually owned, but is not compromised, but so you can see it. So here,
2254130	2259430	for example, we can filter by run DLL, see all the, all the commands that have run DLL.
2259570	2265850	So this allows us to do these post-processing kind of operations. We can do the same thing,
2265850	2273750	add cell from hunt and looking at our process listing hunt, same thing. It simply creates
2273750	2281950	the table for us, the query for us initially, right? So for instance, we can say where,
2287320	2296200	where name matches Velociraptor to see all the Velociraptor processes that are running.
2296200	2301200	We can see there it is. The Velociraptor process is running. That's the hashes.
2301200	2306860	That's the authentic code information. Is it signed? Yes, it is. And so on. So we can get
2306860	2312780	this kind of high level information and the username is running it as a system. So this is
2312900	2322020	a pretty cool, cool way of post-processing the different, different things. So I'm not going to
2322020	2328380	get into too much into the, the artifacts and how to actually write the QL, but as a process to say
2328380	2334760	that in this screen here, we can view all the different artifacts and let's just reiterate
2334760	2343340	again, what an artifact is. As I said Velociraptor simply runs VQL, but if the UI simply required you
2343340	2349020	to type a new query each time, and that would be very tedious and error prone, and it would just
2349020	2355740	not be a very good user experience. So with Velociraptor, we have a concept of artifacts
2355740	2366080	and artifact is simply a YAML file that contains the descriptions behind the particular VQL and
2366080	2375260	the VQL itself. So let's have a look at something like, let's say the DNS, DNS cache. This is an
2375260	2382040	example of a, of an artifact. And you can see that here in this screen, we can view all the
2382040	2386960	different artifacts and we can actually edit them as well. So this particular artifact,
2386960	2393540	you can see that it has some VQL here. It just queries the DNS cache on a Windows system.
2393780	2402080	So we have some explanation of what it does, and then it just, it just does it right. So,
2402580	2412020	so let's have a look at what does it look like in, we said it's a YAML file. So if we click the,
2412020	2417340	to edit it a little bit. And so you can see that we can customize using this UI,
2417340	2424720	we can customize the artifact. So we can simply add in here, the, the different,
2424720	2430300	different things, right? So, you know, we could say, Oh, okay. You know, if we, maybe we wanted
2430300	2440100	to add a filter or something else, we can simply, we can change this as required or write our own.
2440100	2446700	And so we can go over here for instance, and let's open a new tab.
2451760	2464870	Collected cache. Okay. Let's collect the DNS cache again. And it's very quick to do, to do that.
2464870	2471390	As soon as we ask to collect it, it will, it will essentially do it instantly. It goes out to the
2471390	2477710	end point and collects it instantly. And we can see all the different, all the different DNS names
2477710	2484710	that are in cache at the moment. So hopefully this was a quick, short introduction to Velociraptor.
2484710	2490830	We went through the installation process, which only took a couple of minutes. And then we went
2490830	2498870	through some of the things that we can do with it. Again, the sky's the limit, really. We can
2498870	2503850	collect different things and we would normally respond to the different incidents and collect,
2504990	2513690	you know, connect different artifacts to, you know, all the time. But, you know, it's,
2513690	2521150	it's just a very powerful tool that allows us to gain unprecedented visibility of the endpoints
2521670	2527810	that we really can't get with other tools currently. Okay. Thanks for watching.
2529730	2535750	And yeah, if you're interested in Velociraptor, have a look, go to the GitHub
2535750	2541450	and download it. It's open source. And also contribute and join our community.
2542050	2546210	Thanks again for listening. Thanks.