Velociraptor
Named by 14 kept items in this workspace.
12 items name it under tools and 2 under classification.technologies.
Search every workspace for Velociraptor. It matches the name as written, so it can find other things that share it.
The items that name it 14
DFIR/endpoint monitoring
Used for live process listing/analysis to inspect process command lines
Open-source DFIR tool cited as part of the trend of legitimate tools drifting into adversary use
DFIR tool previously seen used by threat actors for command and control; callbacks hosted via Cloudflare Worker pages in this campaign
Legitimate open source digital forensics and incident response (DFIR) tool abused by threat actors across three incidents to set up C2 communications and remote command execution
Legitimate, open source digital forensics and incident response (DFIR) tool; misused by threat actors in both incidents to establish C2 communications with a compromised endpoint
Forensic/DFIR platform; used to run the Hunt MacOS.System.QuarantineEvents hunt (created by Wes Lambert) to parse quarantine database fields
DFIR/endpoint tool used to run Yara hunts (Linux.Detection.Yara.Glob) across a fleet of Linux hosts
Used to hunt for webshells across the host using Yara rules
Endpoint hunting/forensics tool; used with MTF-Hunt to find dropped AsyncRAT plugin DLLs and Mutants-Hunt to find AsyncRAT/QuasarRAT mutexes on infected machines.
open-source DFIR tool used for network-wide hunts: Windows.System.TaskScheduler hunt, reading Run keys from user/system hives, finding suspicious files in AppData/user profiles, DNSCache hunt for DNS resolutions; uses VQL query language with built-in notebooks
Incident handling/response lab tool, accessed via VNC in the course
All technologies in this workspace.