Endpoint Detection and Response using - Velociraptor
Velociraptor is a sophisticated digital forensic and incident response tool that improves visibility into endpoints. It was developed by DFIR professionals who needed a powerful and efficient way to hunt for specific artifacts and monitor activities across fleets of endpoints.
Velociraptor Query Language gives Velociraptor power and flexibility. VQL is a framework for creating highly customized artifacts, which allows you to collect, query, and monitor almost any aspect of an endpoint, groups of endpoints, or an entire network. It can also be used to create continuous monitoring rules on the endpoint, as well as automate tasks on the server. (source: https://docs.velociraptor.app/docs/overview/)
From an incident response perspective, it is necessary for the responder to have the ability and skill to quickly triage to patient zero without performing an interactive logon. This is also because during an incident, multiple endpoints might be involved and performing an interactive logon on each of these endpoints is not an ideal response for any responder.
In this lab, we will download and install Velociraptor on Windows for us to have a quick glimpse of what it looks like.
First, go to https://github.com/Velocidex/velociraptor/releases
Then, download the desired choice of release.
To instantly run Velociraptor,
First, open Command Prompt as Administrator and change the directory where the downloaded file is saved.
Next, run the following syntax: <velociraptor_file> gui
#note: Recommended if you want to install Velociraptor as a self-contained client and server on your local machine for testing purposes.
