Detection
20 Nov 2023
DEATHcon2023: Practical DEATH by Velociraptor
A practical Velociraptor and VQL workshop for investigators, covering accessors, query performance, RDP patching, BlackLotus and LNK analysis.
13 Sep 2023
Content Management Like a Boss!
Velociraptor content management and automation techniques for teams maintaining detection and investigation content.
17 Nov 2022
Bulk Velociraptor detection content for incident responders and threat hunters. Collects shared detection artifacts in one repository.
5 Nov 2022
DEATHcon 2022 Velociraptor workshop
An introductory Velociraptor workshop for DFIR practitioners, covering VQL, NTFS, event logs, YARA and memory artifacts. Includes lab material and recordings.
17 Sep 2022
Notebook and VQL - data munging your way to victory!
A practical introduction to VQL data manipulation for Velociraptor users, with examples for building artifacts and analysing investigation data.
12 Jan 2022
WMI Event Consumers: what are you missing?
Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.
9 Nov 2021
Cobalt Strike Payload Discovery And Data Manipulation In VQL
Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.
26 Jun 2019
Endpoint Hunting in an AntiEDR World
Endpoint hunting techniques for defenders investigating activity that bypasses EDR. Includes presentation slides and examples of detection evasion.
29 May 2019
Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.
12 May 2019
Blue Team Hacks - Binary Rename
Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.
2 Apr 2018
Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.
3 Apr 2017
Blue Team Hacks - WMI Eventing
Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.