Velociraptor: OpenSOC CTF Tool Demo
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.
Summary
Endpoint Visibility with Velociraptor
Velociraptor is an open-source endpoint visibility and digital forensics tool designed for rapid response and fleet-wide interrogation during security incidents.
Forensic Querying with VQL
Using the Velociraptor Query Language (VQL), investigators can formulate expressive queries to inspect running processes, memory allocations, persistence mechanisms, and filesystem artifacts.
Hands-On Triage for OpenSOC Competitors
The demo guides participants through gathering live endpoint evidence, deploying hunting artifacts, and isolating compromised workstations during the OpenSOC defense challenge.
Related talks
Blue Team Village·9 min
Whitney Champion
Demonstrates using Osquery SQL syntax to query endpoint state and investigate security incidents during the OpenSOC defense CTF.
Blue Team Village·18 min
Project Obsidian
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
Blue Team Village·35 min
Mike Cohen
Velociraptor creator Mike Cohen demonstrates advanced enterprise endpoint forensics and live incident triage using Velociraptor Query Language (VQL).