Live Incident Response with Velociraptor

[@velocidexenterprises8702]

Really excellent talk with so much information. Great to see Velociraptor wielded by such a skillful defender! A must watch presentation for any Blue Teamer or defender out there!

[@rpt3066]

Dont know what more motivation is needed to use this awesome tool - for FREE! Thank you Eric C for sharing invaluable experience for FREE & Mike C for sharing this tech for FREE 👑🙌

[@edwardwhite8253]

Absolutely incredible and in-depth demo! The pacing, the contents are all great! Bravo Eric!

[@whoamisecurity9586]

Your radar is awesome Eric 🎉 Unbelievable Incident response Demo ⚔️

[@gerarddunphy]

Incredible demo showing how Velociraptor truly takes IR capabilities to a whole other level! This is a game changer! The only thing missing was did the threat actor actually exfil those plans to the death star :) Thank you for this great insight! I have a new lab to build post haste!

[@efemboygg]

Hey, this is really cool. went over velociraptor in a couple of my sans courses and needed it for an assignment I'm doing right now. ty,

[@rolyperez8695]

I heard about this at the NCFI and started using it. Cederpelta was the one i used to use. Greetings from LaredoTx.

[@KenPryor]

This was amazing. I just started learning about Velociraptor recently and have much to learn. This video was extremely helpful.

[@MuhammadImran-xu4fw]

Awesome, impressed :) How about if the adversary does the cleanup while doing lateral movement?

[@shamshoque2546]

Really great structured information. Thanks. How to integrate hyabusa in hunt profile????

[@getoutmore]

This was so awesome!!! I could have watched this for hours. Motivated me so much to get my hands on this. Do you have more stuff Like this? Im hungry to learn! Thanks you for the Video

[@dananderson6992]

Well done live hunt. thanks for sharing.

[@aliakbar307]

Hi, thanks for the great video. I have a question. How the shellcode is decrypted and which component will decrypt it?

[@mitchimpey1726]

Great Demo Eric. Excellent example and a great presentation. Thanks, appreciated !

[@EricCapuano]

Thank you! Glad you enjoyed it.

[@domiflichi]

Wow! Incredible video, thank you!

[@christophernst2048]

Hey - I really liked the video and the demos you gave on Velociraptor! 🙂 In the end of the Video you mention that this demo was part of a SANS class. Would you mind disclosing which SANS course this was part from?

[@holeraholera]

Great stuff! Thank you. Have you thought about releasing the collected data so that we can play with it in our own velociraptor server?

[@clomok]

Wow, such a cool talk. Does velociraptor have to be implemented with a single network? Is there a way to have velociraptor clients from different networks communicate with a single server?

[@EricCapuano]

Absolutely. The server doesn’t know/care what network the agent checks in from. You can host the server in the cloud and have hosts on many different networks checking in.

[@clomok]

@@EricCapuano that sounds like a wonderful setup. Can you imagine a situation where velociraptor replaces a MSP's end point detection and aggregates all clients to a universal dashboard?

[@PrinterJamOnToast]

This is so cool, I hope to work for a company that uses this some day.

[@TurboRetard]

Im deploying it where I work, glad the sysadmin is open minded to give me free reign on cyber security

[@Impact_Creativity]

what an amazing video! thanks for all the info, really usefull!

[@WarThunderista]

Amazing stuff :D

[@sirisiri2048]

This is awesome Really in-depth analysis Just had one question where can I find this data or the malware ? Is their a repository you have used for this ?

[@EricCapuano]

Sadly this was run inside of our live training range so the data is not available otherwise. I’ll see about trying to capture and release the data in the future!

[@clasherbak]

How did you prepared the demo environment with more than 60 workstations? is that a simulator tool? awsome talk by the way and thank you!

[@EricCapuano]

I used a large virtual environment we've built for other trainings like OpenSOC & our Network Defense Range.

[@frzen]

Great talk thanks

[@EIDEID99]

wait @23:39 , if a user login , will 4624 stored in the AD on in his/her PC.

[@EricCapuano]

A 4624 (successful logon) gets generated on the system being logged onto to... The authentication event (4768) shows up on the domain controller.

[@civicnox]

Good video

[@ChristopherReevesNZ]

Issues that I see with this: 1. This seems to rely on AD GPO (or some sort of deployment tool), these days people are also using Macs and *inux so you might not get all the coverage. Secondly on this point is if GPO is disabled at the AD / workstation level then this too is rendered useless. 2. I personally don't know of one analyst that knows VQL let alone SQL 3. The UI is 🤮 4. Tools like Crowdstrike kinda do this using ML/AI without all the manual stuff 5. Dropping session seems quite POCCY to me 6. A lot of this stuff can be done using windows remote management in a scripted way