Threat Hunting

CLRaptor: Hunting reflected assemblies with Velociraptor

Main area: Threat Hunting · 1,281 words · 7 min read

Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.

• Threat Hunting
• DFIR
• Velociraptor

Published at InfoGuard Labs ↗ (opens in a new tab)

How To Hunt For UEFI Malware

Main area: Threat Hunting · 1,403 words · 7 min read

UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.

• DFIR
• Velociraptor
• Malware
• Threat Hunting

Published at Rapid7 ↗ (opens in a new tab)

Cobalt Strike Payload Discovery And Data Manipulation In VQL

Main area: Threat Hunting · 1,573 words · 8 min read

Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.

• DFIR
• Detection
• Velociraptor
• VQL
• Threat Hunting