EDR operations: collection, isolation and response with Velociraptor
You deploy Velociraptor clients to endpoints, collect evidence during an incident, isolate a suspicious machine and tune detections for your organisation.
Level 401 · 14 lessons · 15 practice labs
Lessons
Deployment
- Velociraptor architecture: server, client, artefact
- Deploying clients and watching their health
- Writing queries in VQL
- Short task: enrol two clients and collect their process lists
Collection and review
- Collecting artefacts: processes, network, persistence
- A quick evidence pack during an incident
- Launching hunts across the fleet
- Continuous event monitoring: new processes and services
- Short task: collect evidence from a suspicious machine within 15 minutes
Response
- Isolating a host while keeping the management channel open
- Killing processes and quarantining files
- The EDR response playbook: who, when, with whose approval
- Short task: isolate the infected host and stop the bad process
Capstone
- Capstone: contain an incident spread across three machines with EDR
Practice labs
- Collect a client’s process list with VQL: Write a simple VQL query, run it on a client and filter the results for processes running with high privileges.
- Collect an evidence pack from a suspicious host in 15 minutes: Gather process, network connection and persistence artefacts in one collection and verify the downloaded pack.
- Find a tool that runs in memory but is not on disk using VQL: Write VQL combining process and module artefacts and catch the loaded module whose file was deleted.
- Hunt an indicator across the fleet: Launch a hunt for the given file name and hash on every client and report the hits.
- Monitor new service installs continuously: Set up continuous monitoring for new service events, create a test service and show the event arrives.
- Separate the real finding from noise in hunt results: Group a hunt with hundreds of hits by parent process and signature and find the one truly malicious host.
- Check client health and find the disconnected one: Review last-seen times in the server panel and identify the client that has not connected for 24 hours.
- Isolate a host while keeping the management channel open: Start isolation and show the host cannot reach the internet but is still connected to the EDR server.
- Kill the bad process and quarantine its file: Kill the process remotely, quarantine the binary and confirm with a persistence check that it does not restart.
- Verify identity so you do not isolate the wrong host: Tell apart two clients with the same name by IP, MAC and last user and isolate only the right one.
- Prove the host is clean before lifting isolation: Re-run persistence, network and process checks, show nothing is left and lift isolation.
- Find the attacker’s scheduled task across the whole fleet: Use the task name and command found on one machine to launch a VQL hunt across the fleet and map the spread.
- Assign a ready-made monitoring rule to a group of machines: Assign the new-process monitoring rule only to clients labelled as servers and show the first events arriving.
- Confirm from the console that a host is isolated: Check from the console and from the host which connections remain open on an isolated client and record the state in the case note.
- Pull the record and hash of a quarantined file: Find the original path, hash and quarantine time of a file in the quarantine list and add them to the case record.
About this course
You deploy Velociraptor clients to endpoints, collect evidence during an incident, isolate a suspicious machine and tune detections for your organisation.
What you will learn
- Deployment
- Collection and review
- Response
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.