From the course: Complete Guide to Open Source Security

Unlock the full course today

Join today to access over 24,800 courses taught by industry experts.

Hunting with Velociraptor

Hunting with Velociraptor

From the course: Complete Guide to Open Source Security

Start my 1-month free trial Buy for my team

Hunting with Velociraptor

“

- [Instructor] The true power of Velociraptor is that it can query thousands of endpoints as easily as it can query a single host. We're certainly not going to see this power with just three clients, but let's see what we can do with it. Velociraptor has its own VQL query language, which we can use to search our hosts, and it comes with a number of preexisting queries, which we can use. If we click the menu hamburger and the hunt manager and we press the plus symbol to start a new hunt, we'll give this a description of checking SSH logins and we'll leave the default as run everywhere. We'll check the start hunt immediately box, and this will run the hunt as soon as we launch it. If we don't check this, we can prepare our hunts and then run them when we are ready to do that. We can see that all three of our clients are affected. We can now move on to select artifacts. We've got three major categories of preexisting searches here, generic, Linux and Windows. For this query, we'll scroll…

Contents