Velociraptor Hands-on Labs¶

Choose the Interactive Lab for a short guided investigation with no installation, or use the Full Lab to deploy Velociraptor and operate the complete endpoint collection workflow in virtual machines.

Hands-on DFIR proof of concept

Connect it. Hunt it. Explain it.

Build a recoverable server-and-client lab, prove that endpoint evidence can be collected, investigate a controlled file indicator, and document a conclusion that does not exceed the available evidence.

⏱ 3–5 hours core◆ Guided beginner✓ Evidence required

Start the Full Lab

Self-hosted · 3–5 hours

Velociraptor Full Lab

Installation required

Outcome-led, not screenshot-led

This lab gives you a safe question, checkpoints, and expected results rather than asking you to copy every screen. Velociraptor versions and interface labels may differ slightly; record meaningful differences in your notes.

Use an isolated, authorised environment

Collect evidence only from systems you own or are authorised to examine. Use harmless test files and commands, protect credentials, and snapshot the virtual machines before changing the baseline.

Before you begin

You need: an x86-64 computer with virtualisation enabled, one Ubuntu server VM, one Windows client VM, administrator access, an isolated network, temporary authorised download access, and storage for snapshots and collected evidence.

How to use this lab

Keep this page open and return after each linked journey. Stop at a checkpoint when the expected result is missing; fix that boundary before launching a hunt or adding another endpoint.

Recommended first

Beginner Core Lab¶

Deploy one server and one Windows client, run a process hunt, then validate one controlled filename or hash indicator.

Expected time: 3–5 hours across three sessions.

Optional extension

Wider endpoint hunt¶

After the core works, add another authorised client, apply labels, and compare the same artifact across a defined group.

Expected time: one additional session.

Session 1Build and snapshot
Session 2Connect and collect
Session 3Hunt and report

Objective¶

You are supporting case DFIR-1042. A harmless test file has appeared on an authorised Windows workstation. Deploy the core Velociraptor topology, prove that the client is connected, establish a process baseline, find the controlled file, and preserve enough context for another analyst to reproduce your conclusion.

The Beginner Core Lab uses only:

one Ubuntu VM running the Velociraptor server and Admin GUI;
one Windows VM running the Velociraptor client; and
an isolated network connecting them.

Complete this pair before adding labels, clients, or wider hunts.

01

Activity 1: Build the environment¶

Download checklist¶

Record the filename, version, architecture, checksum, source, licence conditions, and download date for each item.

Item	Purpose	Authoritative source
Ubuntu Server ISO	Velociraptor server operating system	Ubuntu releases
Windows installation media	Authorised endpoint for collection	Microsoft evaluation centre
Velociraptor release	Server and matching client packages	Velociraptor releases

Vendor access and versions

Some media requires registration or licence acceptance. Use a currently supported release and keep the server and client versions compatible.

Create the virtual machines¶

VM	Suggested lab allocation	Role
Ubuntu server	2 vCPU, 4 GB RAM, 40 GB disk	Server, frontend, datastore, and Admin GUI
Windows client	2 vCPU, 4 GB RAM, 40 GB disk	Authorised endpoint under examination

Create the isolated VMs shown in the proof-of-concept topology.
Record each VM's operating system, resources, hostname, address, network, and administrator account.
Confirm their clocks are synchronised and only authorised lab or update traffic is possible.
Take a clean base-os snapshot of both VMs.
Follow Deploy the Velociraptor server through Admin GUI login and artifact project import.
Record the version, configuration choices, service state, listening ports, and GUI address.
Take a working-velociraptor-server snapshot.

Milestone 1Server readyThe isolated VMs have recorded addresses and snapshots, the services respond, and the Admin GUI opens.

Expected result The server and frontend services are running, the documented ports respond, and you can sign in to the Admin GUI.

02

Activity 2: Connect and collect¶

Follow these checkpoints in order. Keep this page open and return after each linked journey.

The client package is readyChoose one method in Deploy Windows clients. The installation methods are alternatives, not cumulative tasks.
The client is connectedInstall it with the matching configuration, confirm the writeback file, and find the client in the Admin GUI.
Identity is recordedSave the client ID, hostname, operating system, first-seen time, last-seen time, and label state.
The baseline is collectedFollow Creating a Process Hunt and target only the authorised Windows client.
The result is traceableSave the artifact, hunt ID, scope, collection time, row count, logs, and one representative process row.
The core is recoverableStop the completed hunt and take a working-velociraptor-core snapshot.

Before continuing, verify that the client is recently active and that the returned row belongs to its hostname and collection. A green status alone does not prove that the expected evidence was collected.

Milestone 2First collection returnedA known client ran the selected process artifact and returned reviewable rows with collection context.

Expected result The client remains connected and the process hunt returns evidence that can be traced to the selected endpoint, artifact, hunt, and collection time.

03

Activity 3: Hunt and report¶

Restore or clone working-velociraptor-core. Confirm the Admin GUI opens, the client is active, and the process collection can still be reviewed.

Investigation scenario¶

The case owner asks whether a specifically named test file exists on WIN-LAB01. Your job is to define the smallest safe scope, predict the result, collect evidence, compare it with a negative control, and state only what the collection supports.

On the authorised Windows VM, create or select one harmless file and record its name, path, SHA-256 value, and creation time.
Predict whether a filename hunt, hash hunt, or both should find it.
Use Creating a Filename Search Hunt or Creating a Hash Hunt in Create and review hunts.
Scope the hunt to the lab client or a label that contains only authorised test clients.
Launch the hunt and preserve the hunt ID, artifact, parameters, scope, logs, and returned row.
Search for a different filename or hash as a negative control and record that result.
Explain any difference between the prediction and the returned evidence.
Remove the harmless test file and confirm the endpoint returns to its working baseline.

Answer these questions before writing the case note:

Which client and path returned the controlled indicator?
Did the filename, hash, and collection time match your prediction?
What did the negative control demonstrate?
Does the result prove execution, compromise, or only file presence?
What additional evidence would you collect before escalating the case?

Use this structure for the case note:

Case: DFIR-1042
Question and scope:
Client and collection time:
Artifact, hunt ID, and parameters:
Positive result:
Negative control:
Conclusion and confidence:
What the evidence does not prove:
Cleanup and recovery:

Milestone 3Finding documentedAnother analyst can reproduce the hunt, connect the result to the endpoint, and understand the conclusion and its limitations.

Expected result The positive hunt finds the controlled indicator, the negative control does not, and the case note records scope, provenance, limitations, and cleanup.

Extend the working core to a second client

Only after Milestone 3 succeeds, add one more authorised endpoint. Apply a lab label, repeat the same artifact across that label, and compare client coverage, collection times, and results. Record how you verified that no unlabelled endpoint entered the hunt scope.

Full Lab evidence checklist¶

This checklist applies to the VM-based Full Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead.

Do not aim to reproduce every screenshot or optional integration. Complete the challenge by showing that your selected route works and that your conclusion is traceable to collected evidence.

VM specifications, addresses, isolated network, time synchronisation, and snapshot names.
Core download filenames, versions, checksums, sources, and licence constraints.
Velociraptor version, configuration, service state, ports, and successful Admin GUI login.
Client ID, hostname, operating system, connection time, and installation method.
Process hunt ID, artifact, scope, time, row count, and representative result.
Controlled filename or SHA-256 value with its path and creation time.
Indicator hunt parameters, logs, and positive result.
A negative control and explanation of the difference.
Conclusion, confidence, limitations, cleanup, and recovery confirmation.

0 of 9 recorded Mark each item when you have saved the evidence.

Troubleshooting¶

Symptom	First check
Admin GUI does not open	Confirm the server service, GUI bind address, port, firewall, and the certificate mode selected during configuration.
Client does not appear	Confirm the matching client configuration, writeback file, frontend address, network route, and client service.
Hunt has no clients	Check target scope, labels, client last-seen time, and whether the hunt was launched.
Hunt has no rows	Confirm the selected artifact and parameters, then verify the controlled process or file exists on the scoped endpoint.
Collection affects the endpoint	Stop the hunt, preserve logs, reduce scope or artifact cost, and restore the last verified snapshot if required.

Clean up¶

Stop test hunts, remove the harmless indicator, protect exported evidence and case notes, remove temporary credentials or access, and restore disposable VMs when appropriate.