Velociraptor - Dig Deeper
summary
Installs from a single binary and boots a front end plus clients, generates server/client configs and Debian packages, then runs real exercises: collect bash history and .ssh/authorized_keys, export per-flow ZIPs and run hunts across thousands of endpoints. The power is the Velociraptor Query Language (VQL) for artifacts, enrichment and event-style monitoring; endpoints do the heavy work and the server stores CSV/JSON results. Typical runtime footprint is small (30–300 MB memory footprint) and continuous monitoring and surgical collection both work at scale.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:55What is Velociraptor
- 3:40Download Velociraptor
- 5:43What makes Velociraptor interesting
- 7:10Velociraptor overview
- 9:15Configuration
- 14:00Testing
- 28:34Servers
- 29:02Deployment
- 29:20Interactive
- 33:04Virtual File System
- 36:19Determining User Activity
- 41:05HighLevel Questions
- 42:19Encoding Expert Information
- 42:53Artifacts
- 46:35Collect Artifacts
- 53:22Scenario
- 55:47SSH logs
related talks
46mVelociraptor - Dig Deeper in Linux
36mEnhancing Lateral movement and Data Access Identification on Windows Systems
36mSQLViking: Pillaging your Data
50mRemote execution of Python scripts using Viri
14mDFIR - Don't Forget Your Roots!
25mHands-on Practice
43mClimbing out from the digital mud with unikernels
31mHigh-load Open Source VDI for the CyberCamp cyber range platform