Threat Hunting & Incident Response with Velociraptor with Eric Capuano and Whitney Champion

Course Learning Objectives:

Upon successful completion of this course, students will be able to:

• • Deploy and configure Velociraptor in various environments, including local and cloud-based deployments

• • Utilize Velociraptor for proactive threat hunting and real-time incident response

• • Execute custom Velociraptor Query Language (VQL) queries to collect forensic artifacts and analyze endpoint data

• • Automate detection, triage, and remediation workflows to streamline incident response operations

• • Conduct deep forensic investigations, including persistence analysis, binary hunting, and network anomaly detection

• • Leverage advanced Velociraptor features such as scheduled hunts, telemetry streaming, and automated labeling

Course Outline

Section 1: Getting Started with Velociraptor

• • Introduction to Velociraptor (Lecture)

    • • Overview of Velociraptor’s capabilities and architecture
    • • Understanding the server-client model

• • Deploying a Velociraptor Server (Lecture)

    • • Local deployment on WSL
    • • Cloud deployment options (AWS, self-hosted)

• • Deploying Velociraptor Clients (Lecture)

    • • Methods for deploying endpoint agents (EXE vs. MSI)
    • • Automating agent deployment at scale

• • Introduction to the Velociraptor GUI (Lecture)

    • • Navigating the interface
    • • Executing queries and analyzing results

🔬 Lab 1.0 – Deploying Local Velociraptor Server on WSL
🔬 Lab 1.0b (Optional) – Deploying Cloud Hosted Velociraptor Server
🔬 Lab 1.1 – Prepare to Collect Volatile Data
🔬 Lab 1.2 – Build and Deploy Client MSI
🔬 Lab 1.3 (Optional) – Building Custom MSIs

Section 2: Working with Artifacts and Notebooks

• • Understanding Velociraptor Artifacts (Lecture)

    • • Client vs. Server artifacts
    • • How artifacts facilitate data collection and automation

• • Using Notebooks for Analysis (Lecture)

    • • Creating and modifying notebooks
    • • Automating data correlation with VQL

Section 3: Advanced Data Collection & Threat Hunting

• • Manual and Automated Binary Deployments (Lecture)

    • • Deploying security tools (Sysmon, EDR) via Velociraptor
    • • Automating deployments with hunts and real-time monitoring

• • Real-time Eventing & Telemetry Streaming (Lecture)

    • • Leveraging event-based artifacts for proactive monitoring
    • • Using Windows ETW and Sysmon forwarding

• • Scheduling Hunts and Automating Detection (Lecture)

    • • Setting up scheduled hunts for continuous monitoring
    • • Integrating Velociraptor with existing security workflows

• • Auto-labeling Systems for Efficient Investigations (Lecture)

    • • Automating endpoint classification based on behavioral data

🔬 Lab 3.1 – Deploy Sysmon
🔬 Lab 3.2 – Enable Eventing & Telemetry Streaming
🔬 Lab 3.3 (Optional, Recommended) – Deploy LimaCharlie EDR
🔬 Lab 3.4 (Optional) – Critical Service Deployment & Monitoring
🔬 Lab 3.5 (Optional) – Scheduled Hunts
🔬 Lab 3.6 (Optional) – Pushing Client Data to a CMDB
🔬 Lab 3.7 – Auto Labeling Systems

Section 4: Incident Response and Forensic Analysis

• • Stacking Analysis & Baselining Systems (Lecture)

    • • Identifying anomalies in processes, network connections, and services

• • Real-time Event & Telemetry Analysis (Lecture)

    • • Analyzing Sysmon logs, ETW events, and DNS queries in real-time

• • Analyzing Event Logs with Sigma (Lecture)

    • • Running Sigma rules for historical and real-time threat detection

• • Scoping an Intrusion (Lecture)

    • • Using artifacts to identify compromised hosts
    • • Correlating known indicators of compromise (IOCs)

• • Deep Forensic Investigation (Lecture)

    • • Analyzing process execution timelines
    • • Identifying persistence mechanisms
    • • Uncovering untrusted binaries and malware

• • Hunting Covert C2 Beacons (Lecture)

    • • Using YARA rules for in-memory malware detection

• • Eradication & Remediation (Lecture)

    • • Removing persistence mechanisms and active threats
    • • Ensuring complete containment and recovery

🔬 Lab 4.1 – Stacking Analysis with Notebooks
🔬 Lab 4.2 – Real-time Event & Telemetry Analysis
🔬 Lab 4.3 – Analyzing Event Logs with Sigma
🔬 Lab 4.4 – Initial Scoping
🔬 Lab 4.5 – Process & Network Analysis
🔬 Lab 4.6 – Binary Presence & Evidence of Execution
🔬 Lab 4.7 – Finding Persistence
🔬 Lab 4.8 – Malware Discovery
🔬 Lab 4.9 (Optional) – Identifying Initial Access
🔬 Lab 4.10 – Hunting Covert C2 Beacons
🔬 Lab 4.11 – Eradication

Section 5: Additional Considerations & Deprovisioning

• • Hardening Velociraptor Deployments (Lecture)

    • • Implementing authentication, encryption, and secure configurations

• • Deprovisioning & Cleanup (Lecture)

    • • Removing lab infrastructure (optional for cloud users)

🔬 Lab 5.0 (Optional) – Deprovision Cloud Resources