Project Obsidian: Creating Custom Velociraptor Artifact Collectors
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
Summary
In this practical forensics lab from Project Obsidian at the DEF CON 30 Blue Team Village, investigators present a step-by-step guide to building custom artifact collectors using the Velociraptor endpoint visibility and response framework. The session begins at 03:00 by demonstrating how to select target forensic artifacts specifically tailored for compromised Linux server environments within the Velociraptor console.
At 06:00, the instructor configures a standalone offline collector binary, walking through artifact definition scripts written in Velociraptor Query Language (VQL) to harvest process tables, persistence hooks, and system logs. The guide demonstrates executing the compiled collector directly on target Linux endpoints at 09:00, highlighting operational privilege requirements and output packaging.
The lab details the process of bundling extracted evidence into compressed triage archives at 12:00. At 15:00, the instructor shows how to import the offline collection back into the central Velociraptor server, demonstrating how security analysts can rapidly run VQL queries across centralized triage data to reconstruct adversary actions without maintaining continuous network connectivity to the target host. (AI summary — Gemini Flash)
Related talks
Blue Team Village·35 min
Mike Cohen
Velociraptor creator Mike Cohen demonstrates advanced enterprise endpoint forensics and live incident triage using Velociraptor Query Language (VQL).
Blue Team Village·43 min
Mike Cohen
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.
HITCON·45 min
Industry experts analyze emerging threats surrounding Performing enterprise-wide DFIR and Threat Hunting with Yamato Security OSS tools.