Velociraptor hunts: one VQL question across every lab endpoint

VQL in a notebook

VQL looks like SQL, but its sources are plugins: pslist(), glob(), parse_csv(), and many more. Notebooks on the server run VQL against collected results, so a hypothesis can be tested on one host’s data before it becomes a hunt.

SELECT Name, Path, Command
FROM Artifact.Windows.System.TaskScheduler()
WHERE Command =~ '(?i)(appdata|\\users\\public|temp).*\\.(ps1|vbs|js|exe)'

A custom artifact

Wrapping the query as an artifact gives it a name, a description, and parameters, so another analyst can run it without editing VQL.

name: Custom.Lab.UserWritableTasks
description: Scheduled tasks that run programs from user-writable folders.
parameters:
  - name: PathRegex
    default: '(?i)(appdata|\\users\\public|\\temp\\)'
sources:
  - query: |
      SELECT Name, Command, Arguments
      FROM Artifact.Windows.System.TaskScheduler()
      WHERE Command =~ PathRegex

Launching and reading a hunt

A hunt runs an artifact on every client that matches a label or operating system, including clients that come online later while the hunt is active. Results arrive per host. Set an expiry so the hunt does not keep running after the question is answered.

Hunt H.CR3A1  Custom.Lab.UserWritableTasks  Clients scheduled: 14  Completed: 14

Client   Name                 Command
WS-07    OneDriveSyncHelper   C:\Users\Public\u.exe
WS-11    AdobeUpdate          C:\Users\dana\AppData\Local\Temp\setup.exe

Worked case: deciding which rows matter

Two hosts match. WS-07 is the host from the earlier alert and the task name imitates OneDrive. WS-11’s task points at an installer the user ran yesterday from the vendor site; the hash matches the vendor’s published value. WS-07 becomes the incident; WS-11 is noted and closed.

The artifact stays in the server’s library. The next time someone asks “anything else like this?”, the answer takes minutes.