Velociraptor: stand up a lab server and collect from one endpoint

Artifacts, clients, and the server

Velociraptor is an endpoint collection and hunting platform. Clients run on endpoints and execute artifacts, which are named, parameterised VQL queries such as Windows.System.Pslist or Linux.Network.Netstat. The server schedules collections and stores what comes back. Everything an analyst does in the GUI is an artifact collection that can be repeated.

Lab mode in one command

velociraptor gui starts a server and a client on the same machine, writes a temporary datastore, and opens the web interface on localhost. It is meant for learning, not production. For a second lab VM, generate a config with velociraptor config generate -i and install the client package it produces.

velociraptor-v0.73-linux-amd64 gui --datastore /lab/velo-ds

# server config and a client for another lab VM
velociraptor config generate -i
velociraptor --config server.config.yaml debian client

A first collection

In the GUI, search for the client, choose New Collection, and add artifacts. The same collection can run from the command line against the local host, which is useful when testing an artifact before sending it to a fleet.

velociraptor artifacts collect Windows.System.Pslist --format csv
velociraptor artifacts collect Windows.Network.Netstat --format json
velociraptor artifacts collect Windows.Forensics.Prefetch --format csv

Pid,Ppid,Name,CommandLine,Username,Exe
4120,912,powershell.exe,"powershell -nop -w hidden -f C:\Users\Public\u.ps1",LAB\kim,C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Worked case: one alert, three artifacts

An EDR alert in the lab names WS-07 and a hidden PowerShell window. The analyst collects Pslist, Netstat, and Prefetch. Pslist gives the command line and parent. Netstat shows the PowerShell process connected to a lab address on 443. Prefetch shows the script interpreter first ran at 09:12, which bounds the timeline. Two more artifacts round out a first triage: Windows.Sys.StartupItems for autoruns and Windows.EventLogs.EvtxHunter to search the host’s event logs for the script name.

Downloading the collection as a zip from the GUI keeps the raw results and the artifact definitions together. That zip, with its hash, goes into the case folder.