← threat hunter
Take Quiz →
Host & Memory Hunting at Scale
advanced 6h
Hunt for adversary artifacts across an entire fleet using Velociraptor VQL, analyze memory with Volatility 3, and reconstruct attacker timelines with Plaso super-timelines.
Lessons
1 Host Hunting Strategy — From Endpoint Telemetry to Fleet-Wide Patterns
25 min 2 Velociraptor VQL — Fleet Hunts, Custom Artifacts, and Live Response
30 min 3 Parent-Child Process Hunting — Lineage Anomalies and LOLBin Chains
30 min 4 Memory Forensics for Hunters — Volatility 3, malfind, and MemProcFS
35 min 5 Plaso Super-Timeline — Correlating Host Artifacts Across Time
30 min 6 Hunt-to-IR Handoff — Packaging Evidence and Escalation Standards
25 min Module Quiz
Test your knowledge before moving on.