Intro to Velociraptor or How to eliminate a red team in under 30min

This segment was stripped and sanitized from a longer briefing given by Recon CTO, Eric Capuano, during a recent hunt exercise. This video only demonstrates a fraction of the capability of Velociraptor, many other use-cases exist but were not covered due to time constraints.
Learn more about Velociraptor here: www.velocidex.com/
Links to code snippets:
- Sysmon deploy VQL: gist.github.com/ecapuano/327d...
- Winlogbeat deploy VQL: gist.github.com/ecapuano/ed81...
- Eradication.ps1: gist.github.com/ecapuano/d18b...
/ eric_capuano
/ recon_infosec

[@michaelfranco8687]

Looks like you could’ve gone for “under 15 minutes” 😂 nice content. I don’t know how there are not more subscribed!

[@slackspace2281]

This is awesome ! do you mind sharing the eradication script pls

[@slackspace2281]

please ignore this, just saw the link ...keep up the awesome work

[@Penzziphotography]

thanks for sharing