With support for multi-tenancy added to Velociraptor in version 0.6.6, we can now manage multiple organizations within a single Velociraptor deployment!
This artifact creates a new organization in a deployment. Upon doing so, the 'OrgId' is used to track information about the new organization.
The current user will be the administrator for this organization.
We can switch organizations, by navigating to 'User Settings', then clicking the name of the appropriate organization.
To list all created organizations, we can leverage the 'Server[.]Orgs[.]ListOrgs' artifact.
This artifact will list all of the organizations within the deployment, and provides an option to download client configuration files.
After creating a new organization and obtaining the client configuration files, we can proceed to add new users to the organization, as well as deploy clients.
That's it for now! Stay tuned to learn about more artifacts! 🦖
If an unknown application, or an application that doesn't typically communicate over the network at all suddenly shows signs of large amount of inbound our outbound traffic, it can be considered suspicious.
Similarly, deviations from normal patterns of communication from typical network-connected programs can also be considered suspicious.
This artifact parses the output of the 'journalctl' command. It is used to view systemd logs on a Linux host.
These logs can contain valuable information to incident responders, such as hardware events, kernel messages, network connectivity, service status, and user events.
Information provided by this artifact includes:
- Timestamp
- Message
- Boot ID
- Machine ID (h)
- Cursor
- Syslog facility/priority (h)
- Monotonic timestamp (h)
- Transport (h)
*h -> column is hidden from the output by default, and can be viewed with the column selector.
This artifact parses the $I files found in the Windows Recycle Bin folder ($Recycle.Bin, as of Windows Vista) to obtain the time of deletion and the original path and file name.
This folder contains:
- $I files ("Recycled" file metadata)
- $R files (the original data)
The contents of the Recycle Bin directory are organized by SID ('C:\$Recycle.Bin\%SID%\').
It's important to note that this artifact uses the API to read available $I data. There may be additional unallocated but readable $I files referenced in the MFT that may be recoverable.
This artifact enumerates the running processes on a Linux system. This can be useful to check for proper configuration or misalignment across a fleet of hosts, or for identifying suspicious processes generated by, or leveraged by malware.
Some of the Information provided by the artifact:
- Process ID
- Parent process ID
- Command line
- Executable
- Hash
- Username
- Created time
- RSS (how much memory allocated to the process)
After Microsoft decided to block Office macros by default, threat actors began pivoting to a usage of container files such as .iso, .rar, and .lnk files for malware distribution.
This is because TAs can then bypass the "Mark of the web" restrictions for downloaded files.
When downloaded, container files will have the MOTW attribute because they were downloaded from the internet. However, the document inside, such as a macro-enabled spreadsheet, will not.
This artifact parses the 'com[.]apple.LaunchServices.QuarantineEventsV2' sqlite database to provide defenders with information around files that have been downloaded from the internet.
Information includes:
- DL Time
- DL URL
- Origin
- Agent Name/Bundle
- User
- Event UUID
On macOS, when a user downloads a file from the internet/third party source, the file will have an extended attribute associated with it called 'com[.]apple.quarantine'.
This asserts that the file will not be opened/executed, until explicitly allowed by the user (via prompt).