HackBlue

Tools · Incident response playbooks · 07 / 20

Velociraptor for live response: collecting triage artifacts from endpoints

Set up a Velociraptor lab server, deploy a client to a test VM, run artifact collections for processes, autoruns, and event logs, and hunt across clients with VQL.

11 min read · practice only with authorization

What Velociraptor does

Velociraptor is an open-source endpoint visibility and digital forensics tool. A server manages clients on endpoints. Analysts run artifacts, which are packaged queries written in the Velociraptor Query Language (VQL), to collect files, registry keys, event logs, process lists, and more, from one host or across thousands in a hunt.

Lab setup

For learning, run the server in GUI mode on your machine, which creates a local server and client in one step. For a more realistic lab, generate a config, run the server on one VM, and install the client MSI on a Windows test VM.

Snippet
# quick local lab
./velociraptor gui

# server + client lab
./velociraptor config generate -i
./velociraptor --config server.config.yaml frontend -v
./velociraptor --config server.config.yaml config client > client.config.yaml
# then build or install the client on the test VM with client.config.yaml

Lab: triage one host

In the GUI, select the test client and start a new collection with Windows.System.Pslist, Windows.Sys.StartupItems or Windows.Persistence.PermanentWMIEvents, Windows.EventLogs.EvtxHunter filtered on Event ID 4624, and Windows.KapeFiles.Targets with a basic triage target. Download the results and review them. Then open a notebook and run a VQL query directly.

Snippet
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)(Users|ProgramData|Temp)'

Hunting across clients

A hunt runs an artifact on every matching client. Use it to answer scoping questions during an incident, such as which hosts have a file with a given hash or a specific Run key value. Keep hunts targeted, because collecting large files from many hosts can strain the network.

Diagram

Velociraptor collection flow

  1. Client check-in

    Endpoint agent connects to the server.

  2. Choose artifacts

    Pick packaged VQL artifacts or write a query.

  3. Collect or hunt

    One host for triage, many for scoping.

  4. Review results

    Download, notebook analysis, export to timeline.

Check yourself

1. What language are Velociraptor artifacts written in?

2. You need to check every endpoint for a file hash. Which feature fits?

3. Which command starts a quick local lab with server and client?