WEBVTT 00:18.160 --> 00:20.340 Hello everyone, Arthur Packett here. 00:20.340 --> 00:22.400 We have a pre-recorded video for you. 00:22.540 --> 00:25.420 It's an intro to Velociraptor. 00:25.540 --> 00:27.440 This is about a 40-minute presentation. 00:27.440 --> 00:36.000 We hope you enjoy, and if you have any questions, please feel free to direct them to the workshop track one or the Recon Discord server for more immediate answers. 00:36.000 --> 00:37.180 We hope you enjoy. 00:40.640 --> 00:56.520 ...video to demonstrate how to install Velociraptor, and we'll just do a quick guided tour through the Velociraptor features, and have a quick introduction to this new DFIR tool. 00:56.520 --> 01:04.840 I mean, you might have heard of Velociraptor before, and in this video we will show how to install it, and we'll just do a quick demonstration. 01:05.620 --> 01:09.380 So I'm going to start off by... you can see my desktop. 01:09.380 --> 01:21.860 This is a typical Windows system, and I'm going to show you how to install it from scratch in a little bit, how to actually use it in real DFIR work. 01:21.980 --> 01:37.980 So the first thing that I'll do is I'm just going to go to the GitHub page, and I'm just going to search for a GitHub page for Velociraptor, and download all the releases. 01:37.980 --> 01:43.520 I'm going to show you how to install Velociraptor in the cloud, on a cloud platform. 01:43.700 --> 01:47.000 So the first thing I'll do is I'll download the releases. 01:47.360 --> 01:56.980 I'm going to have a server which will run on Linux, so I'm going to need to download the Linux binary. 01:56.980 --> 02:05.400 I'm also going to run the Windows executable on Windows, so I'm going to need to download the Windows binary. 02:05.860 --> 02:14.780 And also, finally, I'm going to need to download the source code, so I can show you guys how to build an MSI installer. 02:15.820 --> 02:31.740 So once I download these binaries, I'm going to open a new shell, and I'm just going to run it as administrator, so I can install the relevant MSIs. 02:32.520 --> 02:41.680 And since I just downloaded it into the downloads directory, I'm just going to change directory to that, 02:45.260 --> 02:47.340 like downloads. 02:48.300 --> 02:53.680 And if I do a dir, you can see the binaries that I've just downloaded. 02:54.000 --> 02:54.440 Okay, great. 02:54.440 --> 03:04.220 So the first thing that we need to do is create a configuration file in which we can deploy on the server. 03:04.360 --> 03:15.960 I'm going to create the configuration file on the Windows machine, and then I'm going to push it out into the server, create a Debian package, and push it to a Debian server in the cloud. 03:16.280 --> 03:25.540 So first thing I will do is I will generate a configuration file using the configuration wizard. 03:25.680 --> 03:33.580 I'm going to use the dash i flag, which is the interactive wizard, which will help me generate the configuration. 03:35.580 --> 03:45.600 So it goes off and it will ask me some questions about what exactly, what type of deployment I want to use, and it will actually create configuration for that. 03:45.600 --> 03:51.060 I'll start off, I'm going to be running it on a Debian machine, so I'll choose a Linux server. 03:51.320 --> 04:00.580 File based data store is usually the simplest, and this is the directory that I'm going to store all the files in. 04:01.740 --> 04:16.940 In this particular example, we're going to create a Let's Encrypt certificate automatically, so it will create an SSL certificate without any further intervention, and will also authenticate with standard usernames and passwords. 04:17.060 --> 04:29.660 So this is the second option, and I'm going to use one of my VM machines, training VMs, and this will be the domain name for the training VM. 04:29.660 --> 04:38.220 So because we want to create an SSL certificate, we're going to need DNS to be properly set up. 04:38.720 --> 04:50.600 So we're going to use a real DNS name, and Velociraptor has this really useful feature where it will actually update dynamic DNS by itself, without us doing anything at all. 04:50.600 --> 04:55.540 So if we use Google Domains for the DynDNS, it will be able to go out and update it. 04:55.540 --> 05:08.080 And over here, I've got the credentials for that, which you can get from the dynamic DNS settings of the Google Domains. 05:08.880 --> 05:15.920 So I just literally copied them into the prompt here. 05:17.100 --> 05:20.760 And then it will ask me to create a new user. 05:20.760 --> 05:26.460 This is the initial administrative user that will be created when the service installs. 05:26.460 --> 05:36.180 So I'm going to just create a new user and give it a password here, and then just press enter. 05:36.180 --> 05:43.720 It will generate some keys, finish configuring it, and you can see that it created a server config and a client config. 05:43.720 --> 05:54.240 If I have a look at the files, then we have the server configuration, and then the client configuration, which contain the keys, the key material, and all the configuration. 05:55.080 --> 06:04.820 So the next step is simply to create a server Debian package using that configuration. 06:04.820 --> 06:14.980 So we're going to run Velociraptor again and tell it to use the server configuration and Debian server. 06:15.220 --> 06:18.880 So we're just asking it to create a Debian package for the server. 06:20.060 --> 06:33.940 If we just try to do this now, then it will say, I don't actually have a Linux binary, so you're running a Windows binary and you're asking me to build a Debian package, so I need the Linux binary as well. 06:33.940 --> 06:41.680 So in this scenario, we're going to need to give it the Linux binary to actually package as well. 06:42.940 --> 06:48.240 So we do that, and it will actually build us a Debian package. 06:48.240 --> 06:49.380 Let's have a look. 06:49.680 --> 06:59.700 And we can see that there is a Debian package here that contains the configuration embedded with it and all the startup scripts and it's all the service configuration. 06:59.700 --> 07:06.360 So all we have to really do is now just push that to our cloud endpoint and then start it. 07:06.360 --> 07:18.940 So I'm just going to scp it to my cloud machine and over here I've got my IP address of my cloud machine 07:22.900 --> 07:31.280 and it will just copy the Debian package over there. 07:32.640 --> 07:36.800 So now I will ssh to that machine and install it. 07:41.020 --> 07:45.740 Okay, and if we have a look at my home directory, there is the Debian package there. 07:46.260 --> 07:56.720 So I just install it with the package and it's going to head and install the service and create it. 07:56.720 --> 08:02.880 So it's already pre-configured to start and it should just work, should bring up the service. 08:03.820 --> 08:06.540 I can check the service is up, service 08:14.840 --> 08:20.960 status, and it shows me green, active, running, and it's all ready to go. 08:21.180 --> 08:41.680 So now if I go to that with HTTPS, vm1.training.velocidex.com, then I should be able to log in with the username and password that I gave it before in the configuration file. 08:41.820 --> 08:44.720 So now we have a Velociraptor server set up. 08:44.860 --> 08:46.220 It only takes a minute. 08:46.220 --> 08:50.760 You can see down here the version and this is the GUI. 08:51.160 --> 08:59.420 This is great, so that's the server, but we still don't have any clients attached to it because we haven't really deployed the client side of it. 08:59.420 --> 09:06.900 So now I'm going to show you how to create an MSI for being able to deploy on the Windows platform. 09:07.400 --> 09:09.260 So let me get out of there. 09:10.800 --> 09:15.000 So we'll go back to our downloads that we had here. 09:15.500 --> 09:24.360 And to build an MSI, we use a tool called Wix, which is a typical MSI framework build framework. 09:24.620 --> 09:26.700 And it's very easy to do. 09:26.940 --> 09:32.900 Let me just open the source code, which we downloaded from the GitHub page. 09:32.900 --> 09:37.100 And in the docs directory, you will find a directory called Wix. 09:37.440 --> 09:47.240 And this directory contains all the scripts required to build the Wix, to use Wix to build the MSI. 09:47.240 --> 09:54.680 So I'm just going to paste it and just extract that one directory into the downloads directory. 09:56.060 --> 09:58.300 Okay, so I can see it here. 09:59.080 --> 10:01.400 And let me go into it. 10:02.260 --> 10:06.920 And I'll just quickly show you guys all the scripts here. 10:06.920 --> 10:09.020 We have a number of different scripts. 10:09.900 --> 10:19.620 And what we want to do is we want to build in this case, a customized version of our MSI that already embeds our special configuration. 10:19.640 --> 10:35.510 So that MSI will be used can be used to then deploy using any number of software management tools like Group Policy or SCCM or anything like that. 10:36.070 --> 10:50.270 So in order for these scripts to work, I need to create a directory called output and copy into it the binary that I want to deploy, which would be the Windows binary. 10:50.510 --> 10:55.790 I'll put and call it velociraptor.exe. 10:55.790 --> 11:05.370 Okay, additionally, I want to copy the client configuration into the output directory as well. 11:05.510 --> 11:10.410 So now I have two files in the output directory. 11:10.410 --> 11:12.890 And these two files will be packaged. 11:12.890 --> 11:17.870 That's really all it is that's required to be packaged in the MSI. 11:18.970 --> 11:25.170 So I'm just going to run the build custom script to create the custom MSI for me. 11:25.790 --> 11:34.910 And all it does is it simply runs the Wix tool set with the right scripts and options to just build the MSI. 11:34.910 --> 11:41.210 It's going to take a second and it will just create an MSI that I can then use. 11:43.610 --> 11:46.250 Okay, so okay 11:49.350 --> 11:56.830 , now if I have a look, there is custom MSI here ready for me to build, to deploy. 11:57.450 --> 12:00.250 So I'm just going to install it on my machine here. 12:02.810 --> 12:06.890 And it will just install Velociraptor and it's ready to go. 12:07.810 --> 12:10.270 Okay, so that's all it took. 12:10.370 --> 12:16.230 And if we have a look at it over here, and we should be able to see the client already checking in. 12:16.230 --> 12:23.010 So it's installed it on this machine and checked into that Debian machine in the cloud that's running the server. 12:23.010 --> 12:28.190 So that is really all that's required to deploy Velociraptor client and server. 12:28.330 --> 12:35.290 So now I would actually just take that MSI and deploy it across the fleet and get all the endpoints. 12:35.290 --> 12:36.230 So that's great. 12:36.230 --> 12:49.110 So we've actually managed to install Velociraptor in a few minutes with a proper SSL certificate, automatic DynDNS setup, and it's ready to go. 12:49.110 --> 12:50.770 We've seen all the clients. 12:50.770 --> 12:54.450 And now what can we do with these clients? 12:54.890 --> 12:59.810 So let me just give you guys a quick introduction to the UI. 13:00.530 --> 13:06.310 Okay, so when you first go to the Velociraptor UI, you will see the dashboard. 13:06.890 --> 13:13.410 Over here on the left side, you can see the number of different options of the different screens of the UI. 13:13.770 --> 13:21.990 The home screen is just a dashboard that tells you a of the server. 13:21.990 --> 13:24.830 You can see how many connected clients there are. 13:25.370 --> 13:33.590 And over here, you can see all the GUI users that are currently configured and what kind of roles they have. 13:34.510 --> 13:38.490 You can see that I only created one user called administrator. 13:38.730 --> 13:40.570 I can create other ones. 13:40.790 --> 13:47.130 And then over here, we can see there is a server version with the version of the server that's currently running. 13:48.410 --> 13:49.890 So that's great. 13:49.930 --> 13:56.610 Normally, when I would use Velociraptor, I might want to look at a specific endpoint. 13:56.910 --> 13:59.430 So I would usually search for it. 13:59.450 --> 14:01.090 And over here, there's a search box. 14:01.090 --> 14:04.490 I can use the host name. 14:04.490 --> 14:09.290 You can see that it has some kind of completion going on here. 14:10.090 --> 14:13.030 Or I can actually label machines. 14:13.030 --> 14:16.850 You can see I can take this machine and create a label. 14:18.290 --> 14:20.030 And let's say I call it test. 14:20.030 --> 14:26.210 The label can be anything, but it simply adds the label to that machine. 14:26.210 --> 14:27.870 So now it's called test. 14:27.870 --> 14:32.010 Now I can actually search for label test. 14:32.010 --> 14:35.730 And labels are useful later on when we do hunting and so on. 14:35.730 --> 14:38.250 We can select specific labels. 14:39.030 --> 14:44.650 So once we search for a machine that we want to look at, in more detail, we can just click on it. 14:44.650 --> 14:50.530 And this is just an overview screen to show us what this machine is all about. 14:50.530 --> 14:54.330 This is a Windows server data center machine. 14:54.510 --> 14:58.090 And then we've got some basic information about it. 14:58.290 --> 15:08.970 In this screen, probably the most important thing is the agent version and when it was last seen and the last IP address that we've seen coming from that machine. 15:08.970 --> 15:17.410 If we click over to the drill down page, then we can see more details about it, about the machine. 15:17.550 --> 15:22.630 You can see more information about the platform and all that sort of stuff. 15:22.630 --> 15:26.010 But this is probably a more interesting thing. 15:26.010 --> 15:30.850 It shows us the footprint of the agent on the endpoint. 15:31.170 --> 15:37.330 So we can see that it takes like 35, around 35 megabytes of memory. 15:37.550 --> 15:43.990 And the CPU load is virtually zero because the agent's not really doing anything. 15:44.030 --> 15:57.610 So when we do some heavy hunting and we might actually do a lot more work on the machine on the endpoint, then it's useful to see how much memory we're actually using and how much impact we're having on the endpoints. 15:58.030 --> 16:05.910 And then this particular one shows us also the users that exist on the endpoints. 16:05.950 --> 16:09.250 But this is just kind of an overview information about it. 16:09.250 --> 16:18.290 We always collect telemetry so you can always see the most recent telemetry from the endpoint about footprint and so on. 16:18.510 --> 16:22.210 The next tab over shows us the interactive shell. 16:22.210 --> 16:28.190 This is an easy UI that allows us to just create, just run shell commands on the machine. 16:28.330 --> 16:36.890 We try generally not to run too many shell commands because they can be unpredictable, but it's possible to just break into a shell. 16:37.070 --> 16:40.110 Over here we've got a number of different options. 16:40.110 --> 16:45.290 We can run our shell commands through PowerShell or CommandShell or Bash. 16:45.530 --> 16:54.710 Usually I would prefer to run with PowerShell because it's just a little more reliable with regards to escaping quotes and stuff like that. 16:55.290 --> 17:06.330 So here's an example, ipconfig slash all examples will show us everything about the interface. 17:06.330 --> 17:10.970 You can see that over here, this is the time and who ran the command. 17:10.970 --> 17:16.130 So when you have multiple users, you can see who actually issued this shell command. 17:16.130 --> 17:23.330 And over here we have kind of a little bit of a UI here that kind of hides the results a little bit. 17:23.470 --> 17:31.990 When you have many shell commands, then it's easy to see, it's really easy to lose it. 17:31.990 --> 17:34.510 So it allows you to kind of hide them a little bit. 17:34.810 --> 17:39.250 And this one just kind of hides them inside of a kind of indented cell. 17:39.250 --> 17:41.270 So it's just the UI kind of feature. 17:41.570 --> 17:51.390 But we can essentially type something else, google.com, and then run it. 17:51.390 --> 17:54.750 And you'll see that this spinner will just wait while the command is running. 17:55.470 --> 17:58.570 And then when they complete, we will see the results. 17:58.570 --> 18:00.950 So we can see that the results. 18:00.950 --> 18:07.770 So this is kind of handy when you have to do interactively look at the machine. 18:10.170 --> 18:13.870 The next one over is the VFS. 18:13.870 --> 18:20.050 The VFS is a way for us to interactively examine the machine, the machine's file system. 18:20.110 --> 18:27.030 So over here we have these are accesses, different types of things that we can look at. 18:27.210 --> 18:37.890 And what we're looking at here is really just the server's cache of what the file system sort of looks like. 18:37.890 --> 18:41.370 But it isn't just checking the file system on the endpoint. 18:41.370 --> 18:43.730 It's just what it already knows about. 18:44.190 --> 18:50.670 So when you navigate to a directory that hasn't been listed before, then it doesn't know about it. 18:50.670 --> 18:54.010 And it tells you no data available for this directory. 18:54.510 --> 18:57.130 So initially, there will be no data available. 18:57.130 --> 19:01.610 So you can click on this button here to refresh the directory. 19:01.850 --> 19:13.470 And what it will do is it will just issue a directory refresh query to the endpoint and just list the directory, and then refresh the server's view of it. 19:13.650 --> 19:18.030 So you can sort of go through and click and refresh, click and refresh. 19:18.030 --> 19:25.630 Or you can simply just do this recursive refresh, and it just goes off. 19:25.730 --> 19:33.330 And it takes a little bit longer, but it just recursively refreshes all the subdirectories. 19:33.530 --> 19:38.170 So you can kind of look through them without having to click all the time. 19:38.790 --> 19:40.870 So this is a bit of a UI thing. 19:41.950 --> 19:56.510 And for example, if we have a look at our files, we can have... for instance, you would know that there is an ntuser.dat in the user's home directory. 19:57.510 --> 20:01.910 And we don't actually have the data, we just know about it. 20:01.910 --> 20:03.450 So we listed the directory. 20:03.450 --> 20:09.210 And if we actually want to see that file, then we can fetch that file specifically from the endpoint. 20:09.550 --> 20:12.910 So we can just click on this thing, and it goes off and fetches it. 20:12.910 --> 20:20.730 And then we'll have a little icon here, which is, you know, just indicates that the server has a copy of that file now. 20:20.730 --> 20:26.590 So we're able to see it from the server, and we can also download it and things like that. 20:26.590 --> 20:40.750 And for those of you who know, you would have seen that typically the ntuser.dat is locked when a user is logged in, but Velociraptor will fall back to raw NTFS parsing in case it's locked. 20:40.750 --> 20:44.250 So it will actually retrieve the data, even if it's locked. 20:44.250 --> 20:46.790 And you can see hex view and so on. 20:47.610 --> 20:53.550 So that's essentially the VFS view, which is the virtual file system. 20:53.750 --> 20:57.410 And it's just a view over in the NTFS. 20:57.410 --> 21:04.870 I think we can actually see what it looks like in a raw NTFS parser. 21:04.870 --> 21:16.350 So we can see all those hidden files like the MFD, and we can collect the MFD in exactly the same way as we did before from the server, just by pressing this button. 21:17.510 --> 21:21.730 MFD is somewhat larger, so it's going to take a little bit longer. 21:22.270 --> 21:29.550 Okay, so the question is, what are we doing when we're pressing these GUI buttons? 21:29.550 --> 21:34.830 And we can essentially just look at it in the same way and download it and so forth. 21:35.850 --> 21:42.450 So you might wonder what is actually happening here with the Velociraptor endpoints? 21:42.590 --> 21:46.970 Well, Velociraptor is really a VQL engine. 21:46.970 --> 21:49.370 It just runs these query languages. 21:49.530 --> 21:56.290 VQL is the query language that runs the entire Velociraptor architecture. 21:56.530 --> 22:04.410 When we click on the UI, what we're doing is we're issuing VQL queries on the endpoints. 22:04.410 --> 22:06.860 We're just issuing different kinds of queries. 22:08.070 --> 22:15.090 And so if we go back to our overview here, then we have the Collector tab. 22:15.810 --> 22:19.820 And this Collector tab shows us all the artifacts that we've collected. 22:20.250 --> 22:27.190 So an artifact is simply a VQL query. 22:27.490 --> 22:37.350 So every time we click through the UI behind the scenes, the UI simply issues a different kind of artifact to collect from the endpoints. 22:37.350 --> 22:42.410 In other words, it just simply issues different kinds of VQL queries. 22:42.410 --> 22:45.870 And you can see that by simply looking at the Request tab. 22:45.870 --> 22:54.170 The Request tab is showing us all the raw requests that is going out to each endpoint. 22:54.170 --> 22:57.530 And we can see over here, queries. 22:57.530 --> 22:59.770 This is the VQL queries that are going out. 22:59.770 --> 23:06.190 So really, whenever we talk to the endpoint, all we're doing is sending VQL queries to the endpoint. 23:07.390 --> 23:10.390 And that's basically all it is. 23:11.330 --> 23:21.690 So for instance, here, when we ran the PowerShell, we're looking at different PowerShell and we can see, you know, we sent a command, that was the query, and so on. 23:21.970 --> 23:23.110 Let's have a look. 23:23.190 --> 23:28.950 So when the query is going to the endpoint, then it will execute on the endpoint. 23:29.330 --> 23:32.550 And the next tab that's interesting is the query log. 23:32.550 --> 23:42.470 So as the query is executing on the endpoint, the endpoint is logging some interesting things about the query, so like errors or anything like that. 23:42.470 --> 23:48.270 So we can see over here, that as the query is running, we get logs. 23:49.130 --> 23:59.510 And then finally, it tells us how many rows the query is returning, because ultimately, all queries just return rows, because, you know, it's just a query. 23:59.530 --> 24:05.570 So the results tab simply shows us the rows that are returned for each query. 24:05.570 --> 24:15.670 In this case, when we ran the PowerShell, it just returns a row and has a column called std out, and then std error and the return code. 24:15.910 --> 24:24.890 Over here, when we listed the directory, it has a bigger query, and it returns more rows and more columns. 24:25.310 --> 24:27.270 But ultimately, it's still the same. 24:27.270 --> 24:28.570 It's just a table. 24:28.570 --> 24:32.130 Everything we do is just a table that's returning. 24:32.810 --> 24:36.850 All the queries are simply tables. 24:37.450 --> 24:41.410 So we looked at the VFS UI, and it's kind of a nice UI. 24:41.410 --> 24:52.290 It's intuitive, and it's kind of what we're used to when we look at, you know, Windows Explorer, something like that, people quite understand this sort of file system hierarchy. 24:52.630 --> 24:59.530 But we've seen that it actually just creates artifact collections in the background, but we can actually just collect other artifacts. 25:00.650 --> 25:05.150 So if we click on this plus button here, we will collect a new artifact. 25:05.810 --> 25:07.850 And over here, we have a search screen. 25:07.850 --> 25:12.690 So we can search for a number of different kind of artifacts. 25:12.970 --> 25:17.810 For example, a prefetch artifact. 25:18.170 --> 25:34.330 So as you know, prefetch is a set of files that are stored in the Windows prefetch folder, and they maintain a list of information about executables that are typically run. 25:34.330 --> 25:42.430 But one of the cool things about them is that they actually maintain a timeline of each executable when it was run. 25:42.830 --> 25:59.390 So it's often useful to build a timeline based on the prefetch information, because then we will be able to pinpoint when a particular binary was run, which might be useful for a GFIR investigation. 25:59.390 --> 26:04.830 So we can choose the prefetch artifact. 26:05.010 --> 26:17.410 And we can see that the artifact gives us a bit of an explanation about what it is that it's doing, a little bit of background information, then it can take a bunch of parameters. 26:17.850 --> 26:22.090 And over here, we can see this is the PQL source that's actually going to run. 26:22.370 --> 26:23.890 So we can look at it. 26:23.890 --> 26:26.490 But we don't really need to kind of understand it too much. 26:26.490 --> 26:29.150 If we want to collect this, we simply click add. 26:29.670 --> 26:33.550 And then we will fold that top pane up. 26:33.550 --> 26:37.810 So that will give us access to all the parameters that we can configure. 26:38.450 --> 26:47.090 And the parameters are actually then used to control the query, the VQL query, or by the artifact. 26:47.130 --> 26:57.370 But you know, here we can, this particular artifact allows us to filter by timestamps or, you know, or binary regular expressions or other things like this. 26:58.830 --> 27:05.550 So, but we're just going to just run it, but usually the defaults do kind of the right thing. 27:05.630 --> 27:11.770 So when we run it, it will immediately issue that collection and collect that from the endpoint. 27:12.290 --> 27:12.590 Right? 27:12.590 --> 27:18.290 So it basically goes off and builds a timeline from the prefetch data. 27:18.290 --> 27:23.250 So every time we run a binary, it has some, some timing here. 27:23.430 --> 27:25.070 So this is really great, right? 27:25.070 --> 27:29.450 We basically can, can see what, what the results are. 27:29.590 --> 27:30.490 Right? 27:30.490 --> 27:44.010 Another very interesting one is to look for scheduled tasks, scheduled tasks, because that's a pretty common, a pretty common persistence mechanism. 27:44.650 --> 27:49.070 And then, you know, all we have to do is simply click add and then just launch it. 27:49.750 --> 27:50.890 And off we go. 27:50.890 --> 27:56.990 It just, it goes off and calculates it and take a couple of seconds and do that. 27:57.770 --> 27:57.930 Okay. 27:57.930 --> 27:59.830 And then we have the results here. 27:59.910 --> 28:04.330 So this is basically how we would collect a bunch of information. 28:06.170 --> 28:07.130 Right? 28:10.130 --> 28:12.390 So, so far it was kind of nice. 28:12.390 --> 28:18.490 We collected specific information from the endpoint about prefetch, about task scheduler, et cetera. 28:18.870 --> 28:22.890 What if we wanted to collect it from all our machines at once? 28:23.110 --> 28:32.470 We have, I mean, in this case, we only have one machine connected to this deployment, but typically we might have say 10,000 endpoints connected to the deployment. 28:33.010 --> 28:38.550 When we want to collect the same artifact from many machines at once, we call this a hunt. 28:38.650 --> 28:50.630 And over here we have the hunt manager, which is exactly the same idea, except it just automatically collects it from all the machines that are connected at once. 28:50.670 --> 28:55.210 So we have a similar GUI, very similar UI to before, right? 28:55.210 --> 28:58.030 Except now we're doing it in a hunt. 28:58.070 --> 29:03.910 So let's just say that we wanted to find all the information about running processes. 29:03.910 --> 29:06.850 So we wanted to use PSLIST as a hunt. 29:06.850 --> 29:19.970 So we just choose add, and again, we can configure it somehow and see that we can do a regular expression for which processes we want to look at and so on. 29:20.370 --> 29:23.390 But this time, hunt has an expiry. 29:23.390 --> 29:30.030 What this means is that once we start this hunt, it will just continue running until the expiry time. 29:30.030 --> 29:38.650 And anytime a new machine comes back online and connects to our endpoint, it will pick that collection up and it will just run it. 29:38.650 --> 29:43.310 So we don't have to catch the machine when it's on. 29:44.010 --> 29:52.210 Basically, we just schedule it and it will just run it when the machine comes online in its convenience, right? 29:52.210 --> 29:55.650 So we click next. 29:55.650 --> 30:02.270 We can specify description, process listing, let's say. 30:03.830 --> 30:04.950 Next. 30:05.210 --> 30:11.370 And here we can choose to run it everywhere or just choose the right labels. 30:11.370 --> 30:14.170 If you recall before, we created the label before. 30:14.170 --> 30:15.130 We'll test. 30:15.130 --> 30:21.170 We can simply restrict it to all those machines that have that label or run everywhere. 30:21.930 --> 30:25.710 And run everywhere will assign the hunt to all the machines. 30:26.710 --> 30:28.050 So we click next. 30:28.050 --> 30:30.590 Now it's showing us this is going to be the request. 30:30.590 --> 30:32.190 This is what we're going to be sending. 30:32.930 --> 30:34.170 Looks good. 30:34.210 --> 30:35.450 Let's go. 30:35.770 --> 30:39.250 When we create the hunt, it's created in a paused state. 30:39.250 --> 30:41.570 So it's not actually running yet. 30:41.910 --> 30:45.350 We click start to actually start it. 30:45.810 --> 30:47.230 And off it goes. 30:47.310 --> 30:52.130 As soon as we click start, it schedules it to all the machines that are currently connected. 30:52.130 --> 30:55.330 So far, it's only got one machine. 31:00.290 --> 31:01.570 And it's finished. 31:01.570 --> 31:06.210 So as soon as the machines will finish, it essentially creates that. 31:06.350 --> 31:09.390 We can have a look at all the clients that are connected. 31:09.390 --> 31:12.410 There's really only one in this case, but there could be many more. 31:12.550 --> 31:17.590 The status tab shows us if there's any errors. 31:18.290 --> 31:22.190 And over here, we can see the results of the hunt. 31:23.410 --> 31:27.990 So over here, we can see this is a process listing of this machine. 31:30.630 --> 31:39.670 If we wanted to process this data using another tool, then we simply need to prepare a download over here. 31:39.670 --> 31:46.490 And it will create a zip file that contains all of the information in this hunt from all the machines. 31:46.490 --> 31:47.550 Let's take a look. 31:47.550 --> 31:49.190 What does the zip file look like? 31:49.430 --> 31:53.210 This is only going to be a small one because it's really only the one machine. 31:53.470 --> 32:02.230 But we're going to see a CSV and adjacent file of all of the results combined from all the machines. 32:02.730 --> 32:08.930 And as well as that, we actually have the collection split up for each machine. 32:08.930 --> 32:10.170 These are the logs. 32:10.690 --> 32:15.510 And these are the artifacts that we ended up collecting as part of these hunts. 32:15.510 --> 32:18.510 So that sort of split up individually and combined. 32:19.470 --> 32:26.370 And also, if any of these hunts collect files, then we will be able to get that in the zip as well. 32:26.670 --> 32:31.330 So this is just a way that we can use to export data. 32:31.550 --> 32:36.490 Now over here, you can see that it's still kind of in the running state. 32:36.670 --> 32:38.410 And some people are confused by that. 32:38.410 --> 32:43.910 But this is just, that hunts always run, they simply expire. 32:44.130 --> 32:54.690 So when we created until the expiry time, when we started till the expiry time, for that time period, it will be active, and then it will become stopped by itself. 32:55.190 --> 33:02.310 And it will no stop means that it no longer accepts new new clients that come online at that time. 33:02.310 --> 33:05.010 So that's, that's basically hunts. 33:06.210 --> 33:08.450 Okay, so that's, that's pretty cool. 33:08.450 --> 33:12.070 We can see how we can export the data and use it in another tool. 33:12.270 --> 33:20.270 Sometimes, we really want to be able to post process the data within the tool within FlossRaptor. 33:20.590 --> 33:28.270 So the next feature I wanted to show you guys is the notebook feature. 33:28.270 --> 33:43.580 Notebook is basically like a collaborative analyst tool that we can use to, to analyze the results from a particular investigation, put them together and post process them. 33:43.950 --> 33:47.090 So I'm just going to show you quickly how I would build a notebook. 33:47.630 --> 33:53.350 So I would click this plus button here, which creates a new notebook. 33:53.750 --> 34:01.250 And I can call it whatever I want, like test notebook, for example, give it some description. 34:02.690 --> 34:06.350 And here I can choose collaborators that I would like to collaborate. 34:06.350 --> 34:14.310 So it's like a collaborating, you know, a Google Doc or something like that is it's very pretty familiar concept. 34:14.610 --> 34:18.010 When I submit it, it will create a new notebook over here. 34:18.370 --> 34:23.750 And, and you'll see that down here we have the title will be copied into here. 34:23.930 --> 34:28.030 So that over here, we can see all the notebooks that I currently have. 34:28.030 --> 34:33.430 And when I click over here, I have to actually click on the title itself to bring it into focus. 34:33.430 --> 34:38.110 And I will see that it creates, this is called a cell. 34:38.150 --> 34:40.950 So a notebook is consisting of different cells. 34:41.010 --> 34:44.670 And over here, again, this is called a markdown cells. 34:44.670 --> 34:46.890 You can see its type is markdown. 34:47.070 --> 34:51.210 So I can simply use, just describe this. 34:51.210 --> 34:54.850 And normally I would put like some background for the investigation. 34:55.450 --> 34:59.390 Demo cell for demo. 35:00.250 --> 35:00.810 Right. 35:00.810 --> 35:07.690 And I actually can also copy paste, copy image, take a screenshot. 35:07.690 --> 35:10.070 I can actually paste the image in here. 35:11.650 --> 35:12.250 Right. 35:12.250 --> 35:13.850 And this is just markdown. 35:13.850 --> 35:17.970 If you're familiar with the markdown, it's very, very familiar. 35:18.310 --> 35:21.150 When we save it, it simply renders it. 35:21.150 --> 35:24.230 So it's just a markdown here where I can put some notes. 35:24.230 --> 35:32.330 So that's not the most interesting thing, but let's say that I wanted to do more interesting post-processing. 35:32.330 --> 35:38.670 Well, I can create another cell and add it from a particular flow or hunt that I've created previously. 35:38.910 --> 35:41.550 So from a particular collection. 35:41.850 --> 35:45.550 So let's just add cell from flow. 35:45.550 --> 35:50.630 I choose the client and these are the flows that ran before. 35:50.630 --> 35:50.830 Right. 35:50.830 --> 35:54.130 So here I've got my task schedule, for instance. 35:54.610 --> 35:58.430 So all this does is it creates VQL. 35:58.430 --> 36:03.130 It pre-fills the VQL for me with the right cell IDs and all this sort of stuff. 36:03.190 --> 36:10.510 This is simply a VQL query that just post-processes the information that we've already collected. 36:10.510 --> 36:13.510 So it doesn't go out to the client and collect the information again. 36:13.510 --> 36:15.630 It just post-processes it. 36:15.690 --> 36:25.350 It's useful in order for us to see, to be able to post-process it and filter it and so on. 36:25.350 --> 36:30.790 So for instance, in this particular case, we are looking at task schedule and this task scheduler. 36:31.090 --> 36:37.190 And, you know, maybe a particular malicious task would have maybe PowerShell. 36:37.190 --> 36:45.470 We wanted to know which tasks are running PowerShell. 36:45.530 --> 36:48.370 So this one will return all the tasks. 36:48.370 --> 36:50.110 And now we would like to filter it. 36:50.130 --> 37:01.010 Where commands, and this is the regular expression operator, matches PowerShell. 37:01.010 --> 37:01.230 Okay. 37:01.230 --> 37:05.730 And then if I press save, okay, there's no PowerShell here. 37:08.070 --> 37:08.790 Okay 37:13.710 --> 37:13.790 . 37:14.230 --> 37:17.510 So we have Google update or whatever. 37:17.510 --> 37:33.850 So you can basically run DLL is a common, this machine is not actually owned, but is not compromised, but so you can see it. 37:33.850 --> 37:39.430 So here, for example, we can filter by run DLL, see all the, all the commands that have run DLL. 37:39.570 --> 37:43.950 So this allows us to do these post-processing kind of operations. 37:44.290 --> 37:52.150 We can do the same thing, add cell from hunt and looking at our process listing hunt, same thing. 37:52.330 --> 37:58.490 It simply creates the table for us, the query for us initially, right? 37:58.490 --> 38:01.950 So for instance, we can say where, 38:07.320 --> 38:16.200 where name matches Velociraptor to see all the Velociraptor processes that are running. 38:16.200 --> 38:17.440 We can see there it is. 38:17.440 --> 38:19.660 The Velociraptor process is running. 38:19.660 --> 38:21.200 That's the hashes. 38:21.200 --> 38:23.320 That's the authentic code information. 38:23.440 --> 38:24.340 Is it signed? 38:24.340 --> 38:25.500 Yes, it is. 38:25.520 --> 38:26.020 And so on. 38:26.020 --> 38:32.200 So we can get this kind of high level information and the username is running it as a system. 38:32.340 --> 38:38.440 So this is a pretty cool, cool way of post-processing the different, different things. 38:38.940 --> 38:57.300 So I'm not going to get into too much into the, the artifacts and how to actually write the QL, but as a process to say that in this screen here, we can view all the different artifacts and let's just reiterate again, what an artifact is. 38:57.300 --> 39:11.920 As I said Velociraptor simply runs VQL, but if the UI simply required you to type a new query each time, and that would be very tedious and error prone, and it would just not be a very good user experience. 39:12.100 --> 39:27.820 So with Velociraptor, we have a concept of artifacts and artifact is simply a YAML file that contains the descriptions behind the particular VQL and the VQL itself. 39:28.240 --> 39:34.540 So let's have a look at something like, let's say the DNS, DNS cache. 39:34.640 --> 39:37.360 This is an example of a, of an artifact. 39:37.460 --> 39:45.400 And you can see that here in this screen, we can view all the different artifacts and we can actually edit them as well. 39:45.400 --> 39:50.080 So this particular artifact, you can see that it has some VQL here. 39:50.080 --> 39:53.540 It just queries the DNS cache on a Windows system. 39:53.780 --> 40:00.220 So we have some explanation of what it does, and then it just, it just does it right. 40:00.220 --> 40:07.240 So, so let's have a look at what does it look like in, we said it's a YAML file. 40:07.240 --> 40:13.600 So if we click the, to edit it a little bit. 40:13.900 --> 40:19.120 And so you can see that we can customize using this UI, we can customize the artifact. 40:19.840 --> 40:25.960 So we can simply add in here, the, the different, different things, right? 40:25.960 --> 40:28.520 So, you know, we could say, Oh, okay. 40:28.520 --> 40:40.100 You know, if we, maybe we wanted to add a filter or something else, we can simply, we can change this as required or write our own. 40:40.100 --> 40:46.700 And so we can go over here for instance, and let's open a new tab. 40:51.760 --> 40:53.080 Collected cache. 40:57.870 --> 40:58.390 Okay. 40:58.390 --> 41:01.050 Let's collect the DNS cache again. 41:02.290 --> 41:04.870 And it's very quick to do, to do that. 41:04.870 --> 41:09.710 As soon as we ask to collect it, it will, it will essentially do it instantly. 41:10.290 --> 41:13.210 It goes out to the end point and collects it instantly. 41:13.210 --> 41:19.530 And we can see all the different, all the different DNS names that are in cache at the moment. 41:20.130 --> 41:24.710 So hopefully this was a quick, short introduction to Velociraptor. 41:24.710 --> 41:29.110 We went through the installation process, which only took a couple of minutes. 41:29.310 --> 41:33.890 And then we went through some of the things that we can do with it. 41:34.210 --> 41:37.210 Again, the sky's the limit, really. 41:38.430 --> 41:51.690 We can collect different things and we would normally respond to the different incidents and collect, you know, connect different artifacts to, you know, all the time. 41:51.870 --> 42:05.490 But, you know, it's, it's just a very powerful tool that allows us to gain unprecedented visibility of the endpoints that we really can't get with other tools currently. 42:05.890 --> 42:06.550 Okay. 42:06.550 --> 42:07.810 Thanks for watching. 42:09.730 --> 42:17.250 And yeah, if you're interested in Velociraptor, have a look, go to the GitHub and download it. 42:17.250 --> 42:18.410 It's open source. 42:18.610 --> 42:21.450 And also contribute and join our community. 42:22.050 --> 42:24.290 Thanks again for listening. 42:25.290 --> 42:26.210 Thanks.