Hunting Malware with Velociraptor (YARA & Memory Forensics)
Source: YouTube · John Hammond · published Jul 18, 2023 · 21:20
Velociraptor is presented as a high-scale threat hunting and live forensics tool that enables rapid response and deep analysis of malware like Cobalt Strike and Quackbot without requiring traditional, time-consuming memory acquisition.
Key Takeaways:
• The platform emphasizes scale, allowing Yara rules to hunt across many machines or zoom into deep forensics on a single endpoint, contrasting with slower traditional methods 0:35-1:17.
• Live memory analysis permits querying specific sections like VAD (Virtual Address Descriptors) to find injections or mapped files without pulling a full memory dump 4:00-6:58.
• Advanced carving artifacts can extract Cobalt Strike configuration directly from PE resources in memory for immediate reverse engineering 8:06-9:30.
• The tool provides visibility into .NET assembly injection and AMSI bypassing, tracking malicious JavaScript and PowerShell execution chains 10:26-12:03.
• VQL Notebooks allow analysts to pull raw malware samples from hunts, normalize them, and decode complex payloads like Cobalt Strike beacons in real-time 13:31-16:13.
The demonstration illustrates that Velociraptor's vast artifact ecosystem reduces the complexity of forensic analysis, empowering analysts to build custom "calculator-like" workflows for rapid security investigations.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
this is really useful because like that that hostname that's in that file name is actually the source machine so if you've got situations where maybe your bugging is messed up by the customer um you can actually get the source machine from from this file is oh what PS exact onto this target exactly that's wild I had no idea okay so like in mine I didn't Focus so much on a scenario I just wanted to install some malware and then show just some general workflow that we do um kind of the things that like I like to kind of talk about when I talk about Velociraptor is probably it's big um big kind of point of difference in terms of tools and that is it's at scale capabilities where you can hunt across like lots of machines at once but then you can also zoom in and do deep forensics live on a mac…