DEATHcon2023: Practical DEATH by Velociraptor on Matthew Green | DFIR, Threat Intelligence & Research

GUI mode and lab setup

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

This lab is a guided walk-through for running Velociraptor in GUI mode.

GUI mode will be used throughout the workshop.

We also walk through importing additional content into Velociraptor.

The Velociraptor GUI is configured to open automatically upon boot, but the credentials are available below:

URL: https://127.0.0.1:8889/
Username: admin
Password: password

Dependencies #

Windows 10+ VM with administrator level access.

UEFI enabled for UEFI use cases (detail later)

Internet access if you would like to do content import.

VQL and accessors

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

This lab is an introduction to help understand how Velociraptor can access data.

GUI mode will be used throughout the workshop. We will be using VQL plugins and running queries against various accessors to compare the results.

This is a fairly long lab best suited to newer users, feel free to skip a head if you have good understanding of VQL and how it can interact with Windows systems.

VQL performance and YARA

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

This lab is an introduction to look at Velociraptor performance when using yara.

We will be walking through the best way to run Velociraptor queries with a few different use cases.

Dependencies #

Velociraptor available on the desktop to run as per Lab: GUI mode walk through

Open cmd, browse to desktop and run: velociraptor .exe gui –-datastore=./VRdata -v

The Velociraptor GUI is configured to open automatically upon start, but the credentials are available below:

Patched RDP

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

This lab is a walkthrough of the patched Terminal Services DLL use case - T1505.005. We will firstly replicate the scenario, then walk through how I would build a cross artifact detection using Velociraptor.

Dependencies #

VM with internet access and Velociraptor available on the desktop to run as per Lab: GUI mode walk through

Artifact Exchange content has been imported into your Velociraptor instance - Lab: GUI mode walk through

UEFI and BlackLotus

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

This lab is a walkthrough of Velociraptor UEFI visibility and simulation on how we would deploy capability to detect BlackLotus from a technical detection article.

Generic Velociraptor visibility from the Windows EFI API.
Install BlackLotus malware sample.
We will walk through several detection capabilities for BlackLotus style attacks that can be used at scale via Velociraptor.

Dependencies #

VM with UEFI installed. I have also added a task below to walk through this process.

LNK analysis

Mon, 20 Nov 2023 00:00:00 +0000

Objective #

Since Microsoft announced that Office applications will block macros from the Internet, adversaries have adapted their initial access techniques. This lab will walk through ****analysis of one of these techniques: LNK files with an embedded decoy document and a payload.

We will run some analysis using Velociraptor, then consider methods to detect at scale.

Dependencies #

VM with internet access and Velociraptor available on the desktop to run as per Lab: GUI mode walk through