Crikeycon 2019 Velociraptor Workshop

Velociraptor
Hunting Evil with open source!
<Mike Cohen> mike@velocidex.com

What we will do today
● Install a secure deployment of Velociraptor in 15 minutes.
○ We could have several thousand end points on the same deployment!
● Interactively view files/registry from an endpoint.
○ Use Fuse to run third party tools on remote endpoints.
● Collect artifacts from endpoints
○ Run hunts to collect artifacts from end points in seconds. Execution artifacts like amcache,
chrome extensions, installed programs, evidence of sysinternal tool execution.
○ Write custom artifact to collect Image File Execution Options backdoors, acquire process
memory dump for processes that match a yara sig.
● Collect events from endpoints in real time:
○ Process execution, service installations, dns lookups
○ Write our own artifact: Watch for usb drive insertion then list all doc files added to it. Search for
classification markings.
○ Watch user’s temp dir and when a new doc file is added check it for macros.

What we will do today
● Collect and preserve evidence
in DFIR case
○ Browser cache, registry
hives, event logs
○ Do this locally or
remotely.
All the above can be done:
● Locally, interactively
● One endpoint remotely at a time
● On 5,000 (or more) endpoints at
once!!!
Deploy Access
Collect Monitor

Required downloads - preinstall needed software
● Get the latest Velociraptor windows binary from GitHub
● Notepad++ - a better notepad
● Winfsp is a windows version of Fuse.
● Chrome is a better web browser.
● Libreoffice or Excel are excellent spreadsheets
● Sysinternal tools:
○ Psexec
○ Autoruns
○ Or just grab everything
● These slides!

What is Velociraptor?
A FOSS project heavily influenced by
● Google’s GRR
● Facebook’s OSQuery
● Google’s Rekall
Both a triaging tool and an endpoint monitoring and collection tool
Implements a powerful Velociraptor Query Language (VQL) engine.
https://docs.velociraptor.velocidex.com/
https://github.com/Velocidex/velociraptor

Rapid Response
Interactively investigate a single endpoint
Module 1

Velociraptor Demo
● A quick 15 minute demo of the GUI to show some high level capabilities.
● I will be using a cloud deployment with some test machines
○ There are not many machines on this deployment but hopefully you will get a taste as to what
it looks like!
● Don't worry - you will get to install this on your own machine shortly!
○ Try to think of use cases in your own daily work
○ I will present some test cases of how we use it.

Velociraptor gets its own SSL cert
Search for clients by hostname
User authentication via
GSuite SSO with (2FA)
Production metrics via
Grafana/Prometheus

Search for hostname: autocomplete,wildcards
Labels: grouping hosts
Last active < 1 min ago
Last IP address

Unique Client ID
Client Version

The Virtual File System (VFS)
Refresh directory
Client Filesystem
Access to VSC

Server Monitoring
Making sure everything is working well!

Monitoring server health
Using top for basic overview. Is the system melting down? (Idle system with ~2k
endpoints)

We use Prometheus and Grafana dashboards
● Download from Prometheus and Grafana
● Unzip into a directory and use the provided configurations.
● Launch commands in separate console shells
● We won't be installing them today but see the appendix for instructions.
prometheus.exe --config.file prometheus.yml
grafana-server.exe Configure this with the browser
http://localhost:3000/
Default user:password
(admin:admin) change it!

Example: Rollout
Rollout begins with SCCM - server on AWS
~2k clients peaking at 40% cpu load and
230mb resident size
Interrogate flows
Keep an eye on CPU load
and peak memory use

Launch a hunt across the fleet

Typical hunt - Collect All Chrome Extensions
Collection rate per second
Peak CPU load

Hunt for IOC across the fleet
CPU Utilization increases
with hunt start then falls off
when all the clients are
done.
Open file handles
increases temporarily as
results are written to disk.
Normally open file handles
are a bit more than
connected clients.
Flow completion rate spikes as the
hunt progresses

Velociraptor is extremely efficient
1. Most operations occur on the end point via the VQL queries.
2. Server just writes the results to disk
3. Post processing can be done via the API (see later)
4. Server load is very low - typically you can get away with a single frontend
even for medium to large deployment size.
5. We typically use larger slower disks for the file store (Cheaper)
a. The file store accepts uploaded bulk data and VQL CSV files
b. These are always written and appended, never deleted or modified.
c. We can implement any desirable archiving/purging policies - everything is just a file.

Now it is your turn!
Deploy Velociraptor on your own machine
Module 2

Architecture Overview
Client
Send Chan
Recv Chan
Data
store
File
Store
Front
End
GUI
Server
Externally accessible URL
Client.server_urls
In practice this will need a DNS name!
Path on disk to store files
Datastore.filestore_directory
Path on disk to store metadata
Datastore.location
TLS (Self signed or
Letsencrypt)

Create a deployment configuration
F:>velociraptor.exe config generate > velo.config.yaml
F:>velociraptor.exe --config velo.config.yaml user add mic
F:>velociraptor.exe --config velo.config.yaml frontend -v
Generates new keys
Add GUI user
Use --read_only to
add read only users
Start frontend

Standalone deployment
● In this mode Velociraptor self signs its SSL cert.
● You can limit GUI connectivity by binding it to 127.0.0.1 (default)
● By default uses basic auth with a fixed password provided by the admin.
This mode is useful for standalone isolated deployment (e.g. behind NAT or inside
corp network).

Cloud based deployment
● When deploying in the cloud use “autocert” mode.
● Velociraptor will get and manage its own certs from let’s encrypt
automatically.
● Optionally we can configure Velociraptor to use Google OAUTH. Then you
can specify G-Suite password policy, 2FA etc.
This mode is useful when there is direct internet connectivity to the server.
Caveat - in this mode you must serve the GUI over port 443 and ports 80 and 443 must be externally
accessible by any IP. Bonus: you get user’s GSuite avatars!

2. Create a client to deploy
● First make a client configuration from the deployment configuration:
F:>velociraptor.exe --config velo.config.yaml config client > velo_client.yaml
● Client config allows a client to connect to the deployment (crypto keys etc).
● Clients self enroll when they first connect - derive unique client id.
● The Velociraptor client is a single statically linked binary - no need for
package management, dependencies etc - run anywhere.

Start the client manually with verbose output

Search for the client in the GUI

How do I deploy Velociraptor to my endpoints?
1. Interactive client - just like we just did
○ Useful for debugging - making sure we have connectivity etc.
2. Agentless configuration
○ Push Velociraptor via group policy - configure to run for specified time and then exit.
3. Self installation:
○ Share velociraptor on a network share (similar to agentless above)
○ With group policy (or interactively) push the command
shareVelociraptor --config sharevelo.conf service install
4. Build an MSI and push via SCCM
○ Can tweak the name of the service, binaries etc. Use provided wix file.
5. For cloud endpoints can specify in VM metadata startup script
○ Exact mechanism depends on your cloud provider.

Exercise: Interactively investigate the endpoint
● Locate the $MFT - master file table of your NTFS drive.
● Download the $MFT for later processing.
● Locate your user’s NTUSER.dat (c:users<username>ntuser.dat)
● Try to download it the regular way
○ It should be locked it wont work (see the error logs)
○ Grab it using raw NTFS access
● Check for run keys
○ HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
○ HKEY_USERS<SID>SOFTWAREMicrosoftWindowsCurrentVersionRun

Interactive shell
● Sometimes it is very useful to run shell commands on an endpoint when
interactively investigating it.
● Velociraptor can run an interactive shell on the server only. This feature is not
available from the GUI and requires server level access.
● Try it:
velociraptor.exe --config velo.config.yaml shell C.11a3013cca8f826e

Exercise: Get a shell on your endpoint.

Shell level auditing - Automated Shell artifact

Velociraptor Artifacts
Module 3

Automation FTW!
So far we saw how to use Velociraptor to interactively read files on the endpoint.
That is pretty boring! The real power rests in Artifacts and VQL.
● What if we could tell the endpoint to collect arbitrary information, parse it and
filter it on demand:
○ Without needing to push new code to the endpoint?
○ Without having to upgrade clients in the field?
● Then we could flexibly adapt to emerging threats in minutes!
○ Search registry for Yara sig, then parse out the filename, then upload the file to the server.
○ Search files in this directory for a zip signature, then search within the zip file for a keyword.
● What if we could collect all these from thousands of endpoints in seconds?

What are Velociraptor Artifacts?
● Define a specific group of files to fetch as well as a table of data
● The artifact also defines how to fetch this data using a VQL query.
● Declare parameters with default values which users can override
○ Allows users to customize the artifact if needed
○ Allows artifacts to be used by other artifacts!
● Once an artifact is defined, users don't need to worry about the VQL - they
can collect the artifact at a click of a button!
● This makes artifacts reusable by many other users.

Collecting artifacts
Client
File
Store
Front
End
GUI
Server
Step 3: Compile VQL in artifact and schedule for
endpoint.
Step 2: Read artifact definition.
Step 1: User wants
to collect artifact
Ste 4: Client evaluates the
VQL producing a table
with rows and columns.
Client may also upload
files to the server.

Lets try this!
Collect amcache from your machine

AMCache Artifact
Name and description give human
readable context around the
artifact.
Parameters allow the artifact to be
customized
Preconditions test if the artifact is
supported.
A series of VQL queries is run
which produce a result set (table).

This part of the VFS shows all instances of
this artifact collected from that endpoint
Collect the amcache from your machine
Each artifact
specifies its own
set of columns

Hunt Results
Artifacts return:
1. A table with columns and rows.
2. Potentially a set of files
You can download a Zip file containing
all rows as a CSV file and all
downloaded files from the Managed
Launched Flows/Results.
Or just download the CSV file from the
VFS view.

Hunting for evil
Common lateral movement techniques
Module 4

The pyramid of pain!
Indicators of compromise come in many
flavors:
Indicators which are easy to detect are also
easy for attackers to modify.
Detecting the tools or techniques means it is
very hard for attackers to adapt.
We should be aiming for that!
http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

SANS Hunt Evil poster
https://digital-forensics.sans.org/media/SANS_Poster_2018_Hunt_Evil_FINAL.pdf

PsExec: Running sysinternals tools
● Many APT groups use sysinternal tools like psexec for lateral movement or
privilege escalations.
● Sysinternal tools require users to accept a EULA.
● This makes them add an “EulaAccepted” value to the registry.
● We can hunt for this to see the first time a particular sysinternal tool was run
on the system (from the registry key modification time).
● This works best for machines which should never run such tools (i.e. non-
developer/sysadmin machines) with a clean build.
● Test this by running (this gives a system shell):
PsExec.exe -s -i cmd.exe

name: Windows.Registry.Sysinternals.Eulacheck
description: |
Checks for the Accepted Sysinternals EULA from the registry key
"HKCUSoftwareSysinternals[TOOL]". When a Sysinternals tool is
first run on a system, the EULA must be accepted. This writes a
value called EulaAccepted under that key.
parameters:
- name: Sysinternals_Reg_Key
default: HKEY_USERS*SoftwareSysinternals*
sources:
- precondition:
SELECT OS From info() where OS = 'windows'
queries:
- LET users <= SELECT Name, UUID FROM Artifact.Windows.Sys.Users()
- SELECT Key.Name as ProgramName,
Key.FullPath as Key,
timestamp(epoch=Key.Mtime.Sec) AS TimeAccepted,
{
SELECT Name FROM users WHERE UUID=regex_replace(
source=Key.FullPath, re=".+(S-[^]+).+", replace="$1")
} as User,
EulaAccepted
FROM read_reg_key(globs=split(string=Sysinternals_Reg_Key, sep=',[s]*'))
Parameters can be overridden
but have defaults
If the precondition returns no
rows the artifact does not run.
One or more VQL statements.
The last statement is a SELECT
returning a sequence of rows

Artifact Name
Who launched the artifact

The Velociraptor
Query Language
Module 5

Why a query language?
● Able to dynamically adapt to changing requirements - without needing to
rebuild clients or servers.
○ For example, a new IOC is released for detection of a specific threat
○ Immediately write a VQL artifact for the threat, upload the artifact and hunt everywhere for it.
○ Turn around from IOC to full hunt: A few minutes.
● Share artifacts with the community
○ VQL Artifacts are simply YAML files with VQL queries.
○ Can be easily shared and cross pollinate other Artifacts
○ Can be customized by users in the GUI in seconds.
● Public Artifact Reference here

What is VQL?
SELECT X, Y, Z FROM plugin(arg=1) WHERE X = 1
Column Selectors
VQL Plugin with
Args
Filter Condition

Example - search files by glob

VQL functions
return a single
value and take
args - operate
one row at a time
VQL plugins
return many rows
and take various
args

Data Collection
For triage and acquisition
Module 6

Triage and data collection
● You get a call requesting to preserve user activity on a machine for an
ongoing DFIR investigation.
● But you do not have Velociraptor deployed (and you do not have a server)!
● You can collect an artifact on the command line too.
Velociraptor does not actually need a server to collect artifacts! We can
collect artifacts into a zip file from the command line.

Store output in this zip file
(can be a file share).
Collect this artifact (can be
given multiple times to
collect multiple artifacts).
Triage artifacts just collect
files.

Zip file contains all the collected files as
well as CSV with artifact result set

Crikeycon 2019 Velociraptor Workshop

Exercise: Obtain a timeline of users
home directory

Generic.Forensic.
Timeline
Collect timeline from all user home
directory.

Tweaking
existing
Artifacts
Copypasta FTW

Find an artifact similar to what you need
Click this to edit a
built-in artifact

New artifact will
be written under
the custom
directory.Change the artifact name
to add a new one. If you
do not change the name
the custom definition will
override the built-in.

Exercise: Collect timeline of recent files
Modify the Generic.Forensic.Timeline artifact to include a last modified time
restriction. Only collect timeline of files changed within the last day.
The VQL condition is:
WHERE Mtime > now() - 24 * 60 * 60

Exercise: Customize triage artifacts
The Windows.Triage.Collectors.* artifacts simply collect relevant files.
● Modify one of the triage artifacts to collect all word documents in a user’s
home directory that were created in the last month.

Running VQL interactively - the console

Exercise: Detect Att&ck Techniques
https://attack.mitre.org/techniques/T1183/

First plant a signal on your machine
REG ADD "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File
Execution Optionsnotepad.exe" /v Debugger /t REG_SZ /d "C:Program
FilesNotepad++notepad++.exe -notepadStyleCmdline -z" /f
Test this: Type notepad - you get notepad++ (useful but….)

Solution: Windows.Persistence.Debug
SELECT Key.Name AS Program,
Key.FullPath as Key,
Debugger
FROM read_reg_key(
globs=”HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options*”)
WHERE Debugger

Exercise: Dumping process memory

Dump process memory when yara sig matches
Advanced malware like the Cobalt Strike Beacon is only memory resident. It is
very hard to detect on the network (due to maleable C&C) but it is very easy to
detect on the endpoint by scanning the memory of running processes.
We will simulate something similar with notepad:
● Open notepad and write a secret message in it “This is a secret”
● Hunt for the process with the Windows.Detection.ProcessMemory artifact.
● Fetch the crash dump.

Windows.Detection.ProcessMemory
- LET processes = SELECT Name as ProcessName, CommandLine, Pid
FROM pslist()
WHERE Name =~ processRegex
- LET hits = SELECT * FROM foreach(
row=processes,
query={
SELECT ProcessName, CommandLine, Pid,
Strings.Offset as Offsets
FROM proc_yara(rules=yaraRule, pid=Pid)
})
- SELECT * FROM foreach(
row=hits,
query={
SELECT ProcessName, CommandLine, Pid, Offsets, FullPath,
upload(file=FullPath) as CrashDump
FROM proc_dump(pid=Pid)
})
First find all processes
with a name matching the
regex
For each of those scan
their memory with yara
rules.
For each hit, create a
process crash dump and
then upload the crash
dump to the server

Security Auditing
Hunting for anomalies and baselining
Module 7

Collect installed Chrome Extensions
We want to know what chrome extensions are installed by our user base.
Collect Windows.Applications.Chrome.Extensions on your own machine.
This is an example of a fairly complex artifact:
● We need to parse the manifest of extensions to map strings like name,
description etc.
● Can you follow the VQL?

Selected artifacts
Search known artifacts
Artifact description,
parameters and VQL
sources (might include
comments)

What is a hunt?
● A hunt is just an automated way to collect one or more artifacts across the
entire deployment.
● It is just a management abstraction - each endpoint just collects the artifacts
in the usual way.
○ The hunt just keeps count of endpoints that participate in the hunt.
○ It is possible to download all results from the hunt as one result set (zip file etc).
○ On the server we can issue VQL to interact with the hunt.
● Hunts are very fast:
○ All currently connected machines are scheduled immediately
○ We typically run a hunt in about 10-20 seconds for currently connected machines.
○ Velociraptor protects itself from too much concurrency - so server load is limited. Feel free to
run as many hunts as you need to.

Exercise: Hunt for chrome extensions.
Prepare your hunt through the new
hunt wizard:
● Select the artifacts to be
collected
● Provide a useful description, the
description will be visible in the
hunt manager UI
● It is possible to restrict the hunt
to a subset of end points:
○ By label
○ By OS
○ By an arbitrary VQL
query
● Once the hunt is created we
need to start it explicitly.

Post processing using VQL
● We can run VQL statements on the server.
○ When run on the server we gain access to additional VQL plugins:
i. The clients() plugin lists all clients.
ii. The hunt_flows() plugin lists all flows belonging to a hunt.
iii. The hunt_results() plugin lists all results in the same hunt.
● Count the most popular chrome extensions in your deployment:
SELECT count(items=User) AS TotalUsers,
Name, Description, Identifier
FROM hunt_results(
hunt_id=huntId,
artifact='Windows.Applications.Chrome.Extensions')
ORDER BY TotalUsers DESC
GROUP BY Identifier

Velociraptor
Monitoring
Module 8

VQL: Event Queries
● Normally a VQL query returns a result set and then terminates.
● However some VQL plugins can run indefinitely or for a long time.
○ These are called Event VQL plugins since they can be used to generate events.
An Event query does not complete on its own - it simply returns partial
results until cancelled.
VQL pluginQuery
Rows
Partial Result
Sets
● Wait time
● Max rows

Client monitoring architecture
● The client maintains an Event Table
○ A set of VQL Event Queries
○ All run in parallel.
● When any of the queries in the event table
produces a result set, the client sends it to
the Monitoring Flow.
● The Server's Monitoring Flow writes the
events into log files in the client's VFS.
● The set of events the client should be
monitoring is defined as a set of Event
Artifacts in the server's config file.
● If the Event Table needs to be refreshed,
existing event queries are cancelled and a
new event table created.
Client Event
Table
Server
Monitoring
Flow
Client's
VFS

Example Monitoring configuration
Events:
artifacts:
- Windows.Events.ServiceCreation
- Windows.Events.ProcessCreation
version: 1
NOTE: Artifacts are compiled on the server -
The client does not need to have these
artifact definitions.
Simply add new artifact names to the
Events section in the config file.
Clients will update their monitoring
artifacts when the version number is
increased.
Currently monitoring is configured in
the configuration file so we need to
restart the server to pick up new
artifacts.

Process Execution Logs
All Event artifacts are collected under
the monitoring part of the VFS
You can download the CSV file or
post process events via server side
VQL or the API

Example: Log DNS queries on the endpoint
Historical record of IP/DNS mapping.
Note: This is recorded on the end
point so works even at Starbucks!
Good for fast flux domains.

Exercise - Generic.Client.Statistics
Our users are concerned about the potential resource usage of the Velociraptor
client.
SELECT * from foreach(
row={
SELECT UnixNano FROM clock(period=atoi(string=Frequency))
},
query={
SELECT UnixNano / 1000000000 as Timestamp,
Times.user + Times.system as CPU,
MemoryInfo.RSS as RSS
FROM pslist(pid=getpid())
})
The clock plugin generates an event
periodically (every 10 sec)
At each clock event we run this query
and emit its results to the server
event stream.

Example:Windows.Events.ServiceCreation.
SELECT System.TimeCreated.SystemTime as Timestamp,
System.EventID.Value as EventID,
EventData.ImagePath as ImagePath,
EventData.ServiceName as ServiceName,
EventData.ServiceType as Type,
System.Security.UserID as UserSID,
EventData as _EventData,
System as _System
FROM watch_evtx(filename=systemLogFile) WHERE EventID = 7045
watch_evtx() VQL plugin can watch
an event log for new events which it
then emits as rows.
Event ID 7045: A service was
installed in the system

Let’s detect service installation
Watch the system event log file
for new events with ID 7045
(service creation). Which fields
are of interest?
In another terminal install and
remove the velociraptor service

Let’s go back to psexec: Service creation
● PsExec works by copying itself to an admin share then creating a service
remotely to start it.
● Test this with the previous artifact - you should see a new service created:
PsExec.exe -s -i cmd.exe
● But we can change the name of the created service using the -r flag.
PsExec.exe -s -r svchost -i cmd.exe

Exercise: Detect psexec with renamed service.
We need to modify the Windows.Events.ServiceCreation artifact to detect psexec
with renamed service name by yara scanning the service file but this has a race!
● Windows.Events.ServiceCreation watches the event log file. Windows Event
logs are flushed lazily (~10 seconds or more). If a psexec process is
terminated before the event hits the log file we will be unable to find the file
😞.
● We therefore need to use some more efficient mechanism to be notified of a
service creation event - WMI. Still not perfect but better….
● Try this by closing the psexec window very quickly or running a very quick
command like PsExec.exe -s -r svchost -i cmd.exe /c dir c:

Exercise: Windows.Detection.PsexecService
- LET file_scan = SELECT File, Rule, Strings, now() AS Timestamp,
Name, ServiceType
FROM yara(
rules=yaraRule,
accessor="ntfs",
files=PathName)
WHERE Rule
- LET service_creation = SELECT Parse.TargetInstance.Name AS Name,
Parse.TargetInstance.PathName As PathName,
Parse.TargetInstance.ServiceType As ServiceType
FROM wmi_events(
query="SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Service'",
wait=5000000,
namespace="ROOT/CIMV2")
- SELECT * FROM foreach(
row=service_creation,
query=file_scan)
Register a WMI event for creation of
new service objects. The WITHIN 1
reduces the race condition to 1
second.

The diff() plugin
The diff plugin is an event plugin which runs a non-event query periodically and
reports the difference between each execution.
● Start with a simple query: Get all files in the user’s temp directory
SELECT FullPath FROM glob(globs='c:/Users/*/AppData/Local/Temp/**')
● Now diff it every 10 seconds

Example: Monitor insertion of USB thumb drives
Windows.Detection.Thumbdrives.List
LET removable_disks = SELECT Name AS Drive, atoi(string=Data.Size) AS Size
FROM glob(globs="/*", accessor="file")
WHERE Data.Description =~ "Removable" AND Size < maxDriveSize
LET file_listing = SELECT FullPath, timestamp(epoch=Mtime.Sec) As Modified, Size
FROM glob(globs=Drive+"**", accessor="file") LIMIT 1000
SELECT * FROM diff(
query={ SELECT * FROM foreach(row=removable_disks, query=file_listing) },
key="FullPath",
period=10)
WHERE Diff = "added"
Diff the file listing every 10 seconds
and record added files.

Exercise: Scan USB drives for Office Macros
Windows.Detection.Thumbdrives.OfficeMacros
SELECT * FROM foreach(
row = {
SELECT * FROM Artifact.Windows.Detection.Thumbdrives.List()
WHERE FullPath =~ officeExtensions
},
query = {
SELECT * from olevba(file=FullPath)
})
We can just use the previous
artifact directly.

Exercise: Scanning Office Docs for keywords
Windows.Detection.Thumbdrives.OfficeKeywords
SELECT * FROM foreach(
row = {
SELECT * FROM Artifact.Windows.Detection.Thumbdrives.List()
WHERE FullPath =~ officeExtensions
},
query = {
SELECT * FROM Artifact.Generic.Applications.Office.Keywords(
yaraRule=yaraRule, searchGlob=FullPath, documentGlobs="")
})
Use this artifact to get events
Collect this artifact for each
event. We can also provide
parameters to the artifact.Artifact reuse FTW!

Server VQL and the Velociraptor API
Module 9

VQL can be run on the server!
30 Day active client count
grouped by version
1 Day active client count

The Velociraptor API
The API is extremely powerful!
Needs to be protected!
The point of an API is to allow a client
program (written in any language) to
interact with Velociraptor.
The server mints a certificate for the
client program to use. This allows it to
authenticate and establish a TLS
connection with the API server.
By default the API server only listens
on 127.0.0.1 - you need to reconfigure
it to open it up.
API
Server
GUI
Client
program
(Python)
X509
Cert
X509
Cert
TLS with mutual
certificate verification.

Create a client API certificate
velociraptor.exe --config velo.config.yaml config api_client > api_client.config.yaml

The API simply allows VQL to run on the server
creds = grpc.ssl_channel_credentials(
root_certificates=config["ca_certificate"].encode("utf8"),
private_key=config["client_private_key"].encode("utf8"),
certificate_chain=config["client_cert"].encode("utf8"))
options = (('grpc.ssl_target_name_override', "VelociraptorServer",),)
with grpc.secure_channel(config["api_connection_string"], creds, options) as channel:
stub = api_pb2_grpc.APIStub(channel)
request = api_pb2.VQLCollectorArgs(
max_wait=1,
Query=[api_pb2.VQLRequest(
VQL=" SELECT * from clients() ",
)])
for response in stub.Query(request):
package = json.loads(response.Response)
print (package)

Example of API program - fuse.
1. Download and install WinFSP - the fuse implementation for windows.
2. Start your client on another terminal - note its client ID. Make sure it is
properly communicating with the frontend.
3. Start the fuse feature using the api_client.yaml and the client id
a. Use q: as a drive letter to mount the client’s virtual filesystem.
velociraptor.exe --api_config api_client.config.yaml -v fuse q: C.11a3013cca8f826e
API config we generated
earlier.
Mount point (Drive)
Client ID

How does it work?
● When a file is accessed on q: drive, we make an API call to schedule a new
file upload collection on the client
○ This is equivalent to the GUI’s “Download this file” feature.
● When the file is received it can be passed to the fuse layer.
● When a directory is accessed on q: drive, we make an API call to list the
directory from the client.
○ This is equivalent to the “refresh directory” in the GUI
Overall effect is that it feels like we are navigating the endpoint’s filesystem
directly! Almost as if it is mounted.
However: All accesses to the endpoint are logged and audited on the server!

API
Server
My
workstation
Fuse
Program
accesses
file
Get File from File
Store
Client
File
store
Collect file from
client
Collect file from
client
File not in filestore
Get File from File
Store
Ok
The entire process is
managed by the API client
(Fuse program)
Ok

Using third party tools on the fuse mount
Any tool can be used on the fuse mount since it looks like a fixed disk.
Create a drive letter mapped into the file (or ntfs) path.

Server side artifacts
● We can run event artifacts on the server. This allows us to act on client events
Client Event Artifacts
Windows.Event.ProcessCreation
Server
Log files
Server VQL watches the log file for
specific events of interest

Exercise: Decode powershell encoded cmdline
● Powershell may accept a script on the command line which is base64
encoded. This makes it harder to see what the script does, therefore many
attackers launch powershell with this option
● We would like to keep a log on the server with the decoded powershell
scripts.
● Our strategy will be:
○ Watch the client’s process execution logs as an event stream on the server.
○ Detect execution of powershell with encoded parameters
○ Decode the parameter and report the decoded script.
○ Store all results as another artifact.
● For testing use this:
powershell -encodedCommand ZABpAHIAIAAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AIABmAGkAbABlAHMAIgAgAA==

VQL - Create an artifact with this query.
SELECT ClientId, ParentInfo, CommandLine, Timestamp, utf16(
string=base64decode(
string= parse_string_with_regex(
string=CommndLine,
regex='-encodedcommand (?P<Encoded>[^ ]+)'
).Encoded
)) AS Script
FROM watch_monitoring(artifact='Windows.Events.ProcessCreation')
WHERE CommandLine =~ '-encodedcommand'
Watch the monitoring logs (for all
clients) for any new rows for this
artifact.
Extract the encoded
command from the
command line, then
base64 and utf16
decode it.
We only care about powershell
command lines with encoded
commands

Collect the artifact with a python program.
1. Copy the example python API client directory to your machine.
2. Install the required libraries:
c:Python27Scriptspip.exe install -r requirements.txt
● Use the sample program to run the previous query.
c:Python27python.exe client_example.py api_client.config.yaml "SELECT * FROM
Artifact.Windows.Powershell.Decoded() "
● Python programmers can now do whatever with the data live...

Conclusions
What it can do is only limited by your imagination!
What will you think of?
https://github.com/Velocidex/velociraptor

Import the provided
dashboard as a
starting point. Feel
free to tweak as
needed

Lateral Movement wmi process creation
● WMI may be used to create processes remotely.
● Try it yourself
wmic process create cmd.exe

Crikeycon 2019 Velociraptor Workshop

More Related Content

What's hot (20)

Similar to Crikeycon 2019 Velociraptor Workshop (20)

Recently uploaded (20)

Crikeycon 2019 Velociraptor Workshop