You know you're in Melbourne Australia when....
Velociraptor
- 713 Followers
- 94 Following
- 86 Posts
Velociraptor - Endpoint visibility and collection tool. https://docs.velociraptor.app/
@doublehelix yet in the state of Queensland that will cost you a $42k fine per kept rabbit. They sure mean business here π
@shortstack @eric_capuano it was awesome to have to visit! Hope you enjoyed down under and the sunshine state π
@joachimmetz with great power comes great responsibility π
Velociraptor has an RBAC model that helps with controlling access to different features, such as adding a new artifact, creating a hunt with it etc. There is also auditing etc.
Typically though the velociraptor admins are considered domain admins with same power as running a domain wide gpo scheduled task.
Eric CapuanoEver had an employee lose a laptop (or have stolen) and wished you could remotely wipe it? Of course, MDM and similar solutions often have this capability, but assuming you don't -- I wrote a @velocidex artifact that will get the job done. It's been tested multiple times to great success. π₯
π£WARNING - THIS WILL DESTROY THE SYSTEM, but sometimes (lost or stolen laptop) that's exactly what you want to do.π£
I am not submitting this to the artifact exchange because it's too risky to just have folks unknowingly import this into their VR deployments, so if you want it, get it here: https://gist.github.com/ecapuano/679791ffe049a0b2e81a645df3084944 #velociraptor
We are excited to announce our in-person Velociraptor training course is now scheduled for BlackHat 2023 https://blackhat.com/us-23/training/schedule/index.html#digging-deeper-with-velociraptor-30129
This is a rare opportunity to learn about Velociraptor from the development team themselves, in person and in Vegas! This course will be sold out ...
"Nurture-boy" Ric Flair
βα΅€βdα΅£α΅€α΅’dQuarterly maintenance. Upgrading my Velociraptor server and testing rapid response readiness. Use for ad hoc DFIR investigations and emergency management of live collections. @velocidex #velociraptor
Very practical tool for #DFIR
Christiaan BeekLatest research where we use @velocidex to hunt for DLL injection files abused by actors: https://www.rapid7.com/blog/post/2023/02/09/evasion-techniques-uncovered-an-analysis-of-apt-methods/ #plugx
Recon InfoSecIf you couldn't catch Marcus Guevara's talk during @cactuscon, here's the recording - https://www.youtube.com/live/OIfOhFOmX-8?feature=share&t=1h40m59s
"Is Dead Memory Analysis Dead?" is a π₯ talk, complete with donkeys and DFIR
Featuring some of our favorites, @velocidex and EchoTrail ππ€
CactusCon 11 - Day 2 (1/28) Track 1
Live stream of Track 1 from CactusCon 11DAY 2 - 1/28 (ALL TIMES IN AZ LOCAL)Join us on Discord! Register at https://cactuscon.com/register, then jump into th...