Enterprise Acquisition at Scale — Velociraptor and Remote Forensics

Traditional IR is sequential: collect from one host, image it, analyze it, repeat. Enterprise IR requires a fundamentally different model — collect from all affected hosts in parallel, triage at scale, and prioritize deep investigation based on fleet-wide results.

The Velociraptor IR Workflow

IOC or Suspected Host Identified
          │
          ▼ Deploy Hunt to Fleet (5 min)
    ┌─────────────────────────────────┐
    │ Fleet Hunt (all endpoints)      │
    │ - Process list (Pslist)         │
    │ - Network connections (Netstat) │
    │ - IOC file hash sweep           │
    │ - Persistence check (RunKeys,   │
    │   TaskScheduler, WMI)           │
    └────────────┬────────────────────┘
                 │ Results return in 5–15 min
                 ▼
         Triage fleet results
         Identify confirmed + suspect hosts
                 │
                 ▼ Deploy Triage Collection to Confirmed Hosts
    ┌─────────────────────────────────┐
    │ Targeted Investigation          │
    │ - KapeFiles !BasicCollection    │
    │ - Memory acquisition            │
    │ - Command history               │
    │ - Browser artifacts             │
    └────────────┬────────────────────┘
                 │ Results in 15–30 min
                 ▼
         Parallel analysis begins
         while remaining hosts still collecting

Key VQL Patterns for IR

IOC Hash Sweep (Fleet Hunt)

-- Does any endpoint have a file with this SHA256?
-- Run as a fleet hunt across all endpoints

SELECT Fqdn, OSPath, Size, Mtime,
       hash(path=OSPath).SHA256 AS SHA256
FROM glob(globs=[
  "C:/Users/*/AppData/**",
  "C:/Windows/Temp/**",
  "C:/ProgramData/**"
])
WHERE NOT IsDir
  AND hash(path=OSPath).SHA256 = 
    "4a3f7e2c8b1d5e9f3c7a2e6b4d8f1a5c..."

Result: within 5 minutes, a list of every endpoint in the fleet where the malicious binary exists.

C2 IP Sweep

-- Which endpoints are currently connecting to the C2 IP?
SELECT Fqdn, Pid, Name, FamilyString,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort,
       Status
FROM netstat()
WHERE Raddr.IP = "185.220.101.9"
  AND Status = "ESTABLISHED"

Persistence Key Sweep

-- Which endpoints have the malicious Run key?
SELECT Fqdn, Key, Name, Data
FROM read_reg_key(globs=[
  "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\**",
  "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\**"
])
WHERE Data =~ "svcupd.exe|malware_name"

Targeted Memory Acquisition

-- Collect memory only from endpoints where C2 process is confirmed
-- (Used after C2 sweep identified affected hosts)
SELECT upload(
  file=winpmem(),
  name=format(format="%s_memory.raw", args=[hostname()])
) AS Upload
FROM scope()
WHERE len(list=(
  SELECT * FROM netstat()
  WHERE Raddr.IP = "185.220.101.9" AND Status = "ESTABLISHED"
)) > 0

Fleet Triage: KAPE via Velociraptor

# Standard IR triage collection deployed fleet-wide
# Velociraptor artifact: Windows.KapeFiles.Targets

# Deploy via Velociraptor GUI:
# Hunts → New Hunt → Add Artifact → Windows.KapeFiles.Targets
# Target: !BasicCollection
# Output: Velociraptor file store (downloadable per client)

# Or via VQL:
SELECT * FROM Artifact.Windows.KapeFiles.Targets(
  _BasicCollection=TRUE,
  Device="C:"
)