DEATHcon2023: Practical DEATH by Velociraptor
A practical Velociraptor and VQL workshop for investigators, covering accessors, query performance, RDP patching, BlackLotus and LNK analysis.
2023 workshop archive · Version details
Migrated from the original Notion material. Commands and examples are preserved from 2023 and have not been retested against current releases. Screenshots and lab behaviour may differ with newer versions.
This workshop was presented at DEATHcon in November 2023. It combines an introduction to Velociraptor and VQL with practical investigation and detection scenarios. Follow the six labs in order, or choose a topic below. Five labs include links to the original video recordings.
Before you start #
The original labs use a Windows 10 or later virtual machine with administrator access, Velociraptor GUI mode and internet access for downloads and artifact imports. The GUI walkthrough used Velociraptor 0.7.0-3 at the time of writing. The UEFI lab also requires a UEFI-enabled VM.
The exercises include malware samples and system changes. Use a disposable lab VM and take a snapshot before starting, as described in the original material.
Workshop labs #
GUI mode and lab setup
Run Velociraptor in GUI mode and import additional artifact content.
Watch recording ↗VQL and accessors
Explore disk, registry and process data using VQL notebooks and accessors.
Watch recording ↗VQL performance and YARA
Compare disk and memory queries and improve YARA scanning performance.
Watch recording ↗Patched RDP
Investigate patched Terminal Services DLLs and develop cross-artifact detections.
Watch recording ↗UEFI and BlackLotus
Explore EFI visibility, the EFI System Partition, measured boot and BlackLotus detection.
Watch recording ↗LNK analysis
Analyse shortcut files containing decoy documents and payloads, then hunt for indicators.
Resources #
For questions or feedback, get in touch.