Hunting Malware with Velociraptor (YARA & Memory Forensics)
John Hammond
21 min, 19 sec
A detailed walkthrough of Velociraptor's forensic capabilities, showcasing file analysis, memory inspection, artifact collection, and live response at scale.
Summary
- Demonstrates Velociraptor's utility in sourcing machine information from file names and conducting investigations across multiple machines.
- Highlights the tool's ability to perform at-scale capabilities and deep forensics on individual machines in real-time, bypassing the traditional time-consuming forensic processes.
- Shows the use of Velociraptor for hunting with Yara rules, drilling into specific machines, and analyzing artifacts and memory.
- Presents advanced Velociraptor features such as memory analysis, process inspection, and real-time data carving for malware investigation.
- A comprehensive overview of Velociraptor's features and capabilities is provided, along with resources and community support available for those interested in utilizing the tool.
Chapter 1
Introducing Velociraptor's forensic capabilities and discussing its at-scale hunting and live, deep forensics abilities.
- Explains the significance of the hostname in filenames for sourcing machine information.
- Describes how Velociraptor can be used for forensics across many machines and for focused investigations on a single machine.
- Emphasizes Velociraptor's advantage in speed and efficiency over traditional forensic tools like Volatility.
Chapter 2
Showcasing how to use Velociraptor for Yara hunting and artifact analysis.
- Runs a Yara hunt to demonstrate how Velociraptor can search across multiple machines using Yara rules.
- Discusses the use of various artifacts and how Velociraptor can access most endpoint data, like processes and files.
- Details how to use Yara for process analysis, showing a practical example with malware installed in the demo environment.
Chapter 3
A deep dive into performing advanced forensic tasks using Velociraptor, including memory analysis and data carving.
- Discusses memory acquisition and analysis capabilities, including pulling DLLs and analyzing virtual address descriptors (VADs).
- Shows how to conduct targeted memory analysis to search for specific conditions like .NET assembly injections.
- Demonstrates the power of Velociraptor's live analysis and the ability to query individual memory sections.
Chapter 4
Demonstrating real-time data carving and extraction with Velociraptor for malware analysis.
- Uses Velociraptor to carve data from memory, highlighting its ability to perform remote at-scale reverse engineering.
- Shows the decoding of strings from malware in memory and provides a blog reference for more information.
- Presents how to refine searches for malware analysis using advanced Velociraptor queries.
Chapter 5
Illustrating how Velociraptor can be used in practical case studies for malware analysis.
- Details an example of analyzing a malicious JavaScript payload and the subsequent Powershell commands executed.
- Discusses the use of Velociraptor for enriching artifacts with process chain information for in-depth analysis.
- Highlights the ability to monitor and reverse engineer malware execution in real-time.
Chapter 6
Exploring advanced hunting and analysis techniques with Velociraptor, including file scanning and config decoding.
- Explains the use of Yara to scan for malicious files on disk and how Velociraptor can process the results.
- Shows how to decode and analyze Cobalt Strike configurations using Velociraptor's capabilities.
- Demonstrates the process of normalizing and parsing complex malware data for forensic analysis.
Chapter 7
Discussing the Velociraptor community and upcoming training opportunities.
- Highlights the supportive Velociraptor community on Discord and GitHub, emphasizing the inclusive environment for learning and sharing.
- Mentions the upcoming Black Hat training for a comprehensive learning experience.
- Encourages participation in the community for those interested in further exploring Velociraptor's forensic capabilities.