DEATHcon 2022 Velociraptor workshop
An introductory Velociraptor workshop for DFIR practitioners, covering VQL, NTFS, event logs, YARA and memory artifacts. Includes lab material and recordings.
DEATHcon Velociraptor workshop was held November 2022. We cover some basic VQL use cases including NTFS, Event Logs, Yara and memory artifacts.
The workshop was implemented with Velociraptor 0.6.6 although the data generation can be applied to any version.
Workshop slidesWorkshop introductionLab 1 and 2Lab 3 and Conclusion