Live Incident Response with Velociraptor

Recon InfoSec CTO, Eric Capuano, performs a hands-on demonstration of a live incident response against a compromised environment using nothing but the free and open source Velociraptor agent. Gain exposure to this incredibly powerful tool and many of its most common use-cases for IR, including use of notebooks for analysis and enrichment. 

[velocidexenterprises]

Really excellent talk with so much information. Great to see Velociraptor wielded by such a skillful defender! A must watch presentation for any Blue Teamer or defender out there!

[whoamisecurity]

Your radar is awesome Eric 🎉 Unbelievable Incident response Demo ⚔️

[rpt]

Dont know what more motivation is needed to use this awesome tool - for FREE! Thank you Eric C for sharing invaluable experience for FREE & Mike C for sharing this tech for FREE 👑🙌

[edwardwhite]

Absolutely incredible and in-depth demo! The pacing, the contents are all great! Bravo Eric!

[gerarddunphy]

Incredible demo showing how Velociraptor truly takes IR capabilities to a whole other level! This is a game changer! The only thing missing was did the threat actor actually exfil those plans to the death star :) Thank you for this great insight! I have a new lab to build post haste!

[KenPryor]

This was amazing. I just started learning about Velociraptor recently and have much to learn. This video was extremely helpful.

[rolyperez]

I heard about this at the NCFI and started using it. Cederpelta was the one i used to use. Greetings from LaredoTx.

[getoutmore]

This was so awesome!!! I could have watched this for hours. Motivated me so much to get my hands on this. Do you have more stuff Like this? Im hungry to learn! Thanks you for the Video

[christophernst]

Hey - I really liked the video and the demos you gave on Velociraptor! 🙂
In the end of the Video you mention that this demo was part of a SANS class. Would you mind disclosing which SANS course this was part from?

[shamshoque]

Really great structured information. Thanks. How to integrate hyabusa in hunt profile????

[dananderson]

Well done live hunt. thanks for sharing.

[mitchimpey]

Great Demo Eric. Excellent example and a great presentation. Thanks, appreciated !

[MuhammadImran-xufw]

Awesome, impressed :)
How about if the adversary does the cleanup while doing lateral movement?

[PrinterJamOnToast]

This is so cool, I hope to work for a company that uses this some day.

[Impact_Creativity]

what an amazing video! thanks for all the info, really usefull!

[holeraholera]

Great stuff! Thank you. Have you thought about releasing the collected data so that we can play with it in our own velociraptor server?

[aliakbar]

Hi, thanks for the great video. I have a question.
How the shellcode is decrypted and which component will decrypt it?

[sirisiri]

This is awesome
Really in-depth analysis
Just had one question where can I find this data or the malware ? Is their a repository you have used for this ?

[clomok]

Wow, such a cool talk. Does velociraptor have to be implemented with a single network? Is there a way to have velociraptor clients from different networks communicate with a single server?

[clasherbak]

How did you prepared the demo environment with more than 60 workstations? is that a simulator tool? awsome talk by the way and thank you!