Velociraptor - Dig Deeper in Linux
summary
Velociraptor deploys agents to thousands of endpoints (demo shows ~1,000) and uses its query language VQL to run parsing, binary decoding and yara carving on-host; examples include grok-parsed syslog hunts for SSH accepted/password logins, a binary parser that detects unencrypted private keys, recovery of deleted logs via carving, and continuous event streaming (watch syslog / sysmon via eBPF). Queries are packaged in the artifact exchange and run as parallel hunts so results return in seconds at scale.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:22Overview
- 1:55What is Velociraptor
- 2:49What Velociraptor looks like
- 4:45Velociraptor efficiency
- 5:22VQL
- 6:10VQL artifacts
- 9:29Example
- 10:52SSH logs
- 13:04Grog
- 13:47Notebook
- 21:39Recap
- 22:00Artifact
- 22:52Hunt
- 25:22Unsecured Search Keys
- 26:28Parse Private Keys
- 28:32Binary Format
- 32:11Parser
- 33:21Search
- 35:00Carving
- 39:38Event Monitoring
- 39:48Streaming Queries
- 40:17Event Queries
- 40:45Watch syslog
- 43:30Sysmon
related talks
01h 42mVelociraptor - Dig Deeper
36mEnhancing Lateral movement and Data Access Identification on Windows Systems
20mLeveraging Osquery for DFIR at Scale
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
29mHunting and Stopping Threats with Elastic Security
58mGRR: Find All the Badness, Collect All the Things
40mLeveraging Suricata in the Enterprise: Shifting from Events to Insights
48mHunting Stealth Adversaries with Graphs & AI