Velociraptor — Forensique & Collecte Distante

Server Velociraptor  port 8000/8889
      TLS mutuellement authentifi
Client Velociraptor  agent sur chaque endpoint
     Windows Linux macOS

# Télécharger le binaire
wget https//github.com/Velocidex/velociraptor/releases/download/v0.73/velociraptor-v0.73-linux-amd64
# Générer la configuration
/velociraptor config generate -i
# → Renseigner : hostname, port, certificats auto-générés
# Lancer le serveur
/velociraptor --config serverconfigyaml frontend -v
# Créer un admin
/velociraptor --config serverconfigyaml user add admin --role administrator
# Accès GUI : https://localhost:8889

# docker-compose.yml
services:
  velociraptor:
    image: wlambert/velociraptor:latest
    ports:
      - "8000:8000"   # Agents
      - "8889:8889"   # GUI
    volumes:
      - ./server.config.yaml:/etc/velociraptor/server.config.yaml
      - velociraptor_data:/var/lib/velociraptor
    command: frontend -v
volumes:
  velociraptor_data:

# Générer le MSI Windows depuis le serveur
/velociraptor --config serverconfigyaml config repack 
  --exe velociraptor-windows.exe clientconfigyaml velociraptor-client.exe
# Installer sur Windows (admin)
velociraptor-client.exe service install
# Linux — service systemd
/velociraptor --config clientconfigyaml client -v
# Déploiement masse via GPO (Windows)
# MSI téléchargeable depuis la GUI → Déploiement > Agent Installers

SELECT Column1, Column2
FROM plugin(arg1='value', arg2='value')
WHERE condition
LIMIT 100

-- Processus en cours d'exécution
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
ORDER BY CreateTime DESC
-- Connexions réseau actives
SELECT Pid, FamilyString, TypeString,
       Laddr.IP, Laddr.Port, Raddr.IP, Raddr.Port, Status
FROM netstat()
WHERE Status = "ESTABLISHED"
-- Fichiers modifiés récemment (< 24h)
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs='C:/Users/**')
WHERE Mtime > now() - 86400
  AND NOT IsDir
-- Clés Run (persistance registry)
SELECT Key.FullPath, Name, Data
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/**")
-- Services Windows
SELECT Name, DisplayName, State, PathName, StartMode
FROM wmi(query="SELECT * FROM Win32_Service WHERE State='Running'")
WHERE PathName =~ "Temp|AppData|ProgramData"
-- Connexions DNS récentes (cache)
SELECT Name, Data.Strings
FROM read_reg_key(globs="HKLM/SYSTEM/CurrentControlSet/Services/Dnscache/Parameters/Cache/**")
-- Scheduled Tasks suspectes
SELECT Name, Command, Arguments, UserId
FROM scheduled_tasks()
WHERE UserId != "SYSTEM" AND UserId != "NT AUTHORITY"
-- Prefetch (exécutions récentes Windows)
SELECT Name, Mtime, Atime, Hash
FROM glob(globs="C:/Windows/Prefetch/*.pf")
ORDER BY Mtime DESC
LIMIT 20

# Artefacts Windows essentiels (GUI → Hunt Manager)
WindowsKapeFilesTargets          Collecte complte KAPE logs artefacts
WindowsEventLogsEvtx             Tous les event logs Windows
WindowsForensicsPrefetch         Historique dexcution
WindowsForensicsSRUM             Historique rseau/CPU par process
WindowsRegistryUserAssist        Applications rcemment lances
WindowsPersistencePermanentWMI   Persistence WMI
WindowsSysAllUsers               Comptes locaux
WindowsNetworkNetstatEnriched    Netstat  process associ
# Artefacts Linux
LinuxSysUsers                    /etc/passwd /etc/shadow
LinuxSysCrontab                  Crontabs systme et utilisateurs
LinuxForensicsLastLogin          lastlog wtmp btmp
LinuxNetworkNetstat              Connexions actives
LinuxSysBashHistory              Historique bash par utilisateur

# Via la GUI :
# Hunt Manager → New Hunt → Sélectionner artefact → Launch
# Cas d'usage courants :
# 1. Chercher un IOC sur tout le parc
#    Artefact : Windows.Search.FileFinder
#    Paramètre : SearchFilesGlob = **/*mimikatz*
# 2. Vérifier si un processus tourne quelque part
#    VQL : SELECT * FROM pslist() WHERE Name =~ "cobaltstrike"
# 3. Collecter les event logs sur tous les endpoints
#    Artefact : Windows.EventLogs.Evtx
# 4. Chercher des clés de registry suspectes
#    Artefact : Windows.Registry.NTUser

# Dump mémoire via Velociraptor
# Artefact : Windows.Memory.Acquisition
# → Génère un fichier .raw téléchargeable depuis le serveur
# Analyse avec Volatility ensuite
volatility3 -f memoryraw windowspslist
volatility3 -f memoryraw windowsnetscan
volatility3 -f memoryraw windowsmalfind

Wazuh alerte  Shuffle workflow
   Shuffle appelle API Velociraptor
   Velociraptor collecte artefacts sur lendpoint
   Rsultats stocks sur le serveur Velociraptor
   Transfert vers TheHive attachments
   Analyste SOC consulte les preuves

# API Velociraptor (Python)
import requests
# Lancer une collecte sur un client
url = "https://velociraptor:8889/api/v1/StartFlowOnClient"
headers = {"Authorization": "Bearer API_KEY"}
payload = {
    "client_id": "C.abcdef1234567890",
    "flow": {
        "artifacts": ["Windows.KapeFiles.Targets"],
        "parameters": {"request": {"env": [{"key": "Device", "value": "C:"}]}}
    }
}
r = requests.post(url, json=payload, headers=headers, verify=False)
flow_id = r.json()["flow_id"]