Create and review hunts¶

Use the preserved process, filename, and hash hunt procedures to collect endpoint evidence and review the results in a notebook.

Introduction to Velociraptor¶

Creating a Process Hunt¶

A Windows reverse shell named 1.exe was generated and executed on the Windows Server 2019 host, connecting to the Kali machine. The session was then switched from Command Prompt to PowerShell.

[*] Started reverse TCP handler on 10.0.0.22:4444 
[*] Command shell session 1 opened (10.0.0.22:4444 -> 10.0.0.40:49886) at 2024-09-18 19:56:51 -0400

Shell Banner:
Microsoft Windows [Version 10.0.17763.3650]
-----       

C:\Users\Administrator\Downloads>whoami
whoami
ws2019\administrator

C:\Users\Administrator\Downloads>powershell
powershell
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

Create New Hunt by clicking Hunt icon and + icon

In the Configure Hunt tab, add the description Process Hunt

In the Select Artifacts tab, search for pstree. Select Generic.System.Pstree

This artifact displays the call chain for every process on the system by traversing the process’s parent ID.

In the same tab, search for pslist and select Windows.System.Pslist

This artifact list processes and their running binaries

In the Configure Parameters tab, Edit Generic.system.Pstree

Select IncludePstree

Select Review then Launch. Select the Hunt and click Play button to launch it.

Once the Hunt is complete (indicated by Total schedules and Finished clients), click the stop button to stop the Hunt.

Check the results on the Notebook tab on web GUI.

As shown in the screenshot below, the suspicious activity is detected.

Alternatively, if you prefer to Download Results as a CSV file and view it in an Excel, this can be done in the Results Section > Download Results

Adding Client Labels¶

To create a label, click the magnifying glass icon, select the target host, then click the label icon. Name the new label (e.g., windows).

Verify that the label has been created.

Creating a Filename Search Hunt¶

A malicious PowerShell script called justascript.ps1 was created then removed on Windows client.

Create a new hunt with the description Filename search

For Include Condition, select Match by label

For Include Labels, select windows

On the Select Artifacts tab, type filename and select Windows.Forensics.FilenameSearch

On the Configure Parameters tab, click spanner icon to configure.

In the yaraRule, replace my secret fie.txt with justascript.ps1

Select Review then Launch. Run hunt by clicking the play icon. Once the hunt is finished, stop the hunt by clicking the stop icon. View results in the Notebook tab. Velociraptor detects that the script is in the Recycle bin.

Creating a Hash Hunt¶

Mimikatz is a tool used to find and steal passwords from Windows computers. The mimikatz.exe was copied over to Windows client and have been renamed as justanexe.exe.

Create a new hunt with the description Hash Hunt

For Include Condition, select Match by label

For Include Labels, select windows

On the Select Artifacts tab, type hash and select Generic.Detection.HashHunter

On the Configure Parameters tab, click spanner icon to configure.

On SHA256List, copy and paste sha256 hash of mimikatz.exe 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1

Select Launch. Run hunt by clicking the play icon. Once the hunt is finished, stop the hunt by clicking the stop icon. View results in the Notebook tab. Velociraptor matches the SHA256 hash with justanexe.exe