Velociraptor Incident Response Use Cases

This walkthrough demonstrates how to use Velociraptor for incident response during a Mimikatz infection.

📌 Scenario

An alert was triggered for Mimikatz on the wrk-price VM.
Your tasks are to:

1. Quarantine the infected machine.
2. Retrieve the malware for analysis.
3. Search across the network for other instances of Mimikatz.

🛑 Step 1: Respond to the Alert

You receive the following alert from Wazuh:

Quarantine the host wrk-price in Velociraptor:

• Navigate to the Client tab.
• Select the Quarantine button.

A popup will appear. Add a reason for quarantining and confirm.

Once quarantined, the client icon updates to reflect its status:

📂 Step 2: Collect the Malware Sample

Using VFS, navigate to the Downloads folder where Mimikatz was reported.

Collect mimikatz.exe to your Velociraptor server (note: Velociraptor server is Linux; Mimikatz runs only on Windows).

When collection is complete, download the file:

Verify in the Downloads directory that Mimikatz was retrieved.

🔍 Step 3: Hash & Verify

Get the SHA256 hash of the file:

sha256sum mimikatz.exe

Result: Confirmed as Mimikatz.

🌐 Step 4: Hunt Across the Network

Since the alert is a true positive, check for the presence of the file across other systems.

1. Create a new hunt.

2. Assign a tag and description, ensuring it runs across all clients.

3. Select the artifact: Windows.Search.FileFinder.

4. Configure search parameters:

   • Provide the path where the file was found on wrk-price.

   • Use double wildcards ** for recursive search.

• Leave default settings for Specify Resources and continue to Review.

• Launch the hunt and start execution.

• After a few seconds, the hunt completes across two clients (note: wrk-price is still quarantined).

📊 Step 5: Review Hunt Results

Open the Notebook tab for quick results review.

The results confirm:

• Mimikatz was also detected on wrk-colby.

✅ Next Steps

• Quarantine wrk-colby.
• Clean the system.
• Analyze logs from both wrk-colby and wrk-price for persistence, lateral movement, and exfiltration attempts.