Velociraptor Deployment

## The Windows Event Logs

---

## The Windows Event Logs

* The original and main use case of Sigma Rules

---

## The Windows Event Logs

* Pros:
   * Built into the system
   * Many solutions for forwarding events

* Cons:
   * Tradeoff between events to forward and network traffic/scale
   * Detection happens in SIEM so does not work offline
   * Long lead times between detection and response

---

## Exercise
### Write the previous detection as a Sigma Rule

* Create a new notebook - Use Default Template

---

## Exercise
### Add a new VQL Cell

---

## Exercise
### Write a Sigma rule to target PsExec!

---

## Exercise
### Write a Sigma rule to target PsExec!

```sql

LET Rules = '''
title: Detect PSExec Service
logsource:
  product: windows
  service: sysmon

detection:
  eventId:
    EventID: 1
  selection2:
    Image|re: psexesvc.exe$

condition: eventId and selection2

'''

SELECT * FROM Artifact.Windows.Sigma.Base(SigmaRules=Rules)
```

---

## Exercise
### Test the new rule

---

## Using Curated Rule Sets for triage

* Quickly determine what happened!

* Rules can be fairly noisy

* Can take a long time!

---

## Using Curated Rule Sets for triage
### The Windows.Hayabusa.Rules artifact

---

## Using Curated Rule Sets for triage
### Collect the artifact from the endpoint!

---

## Using Curated Rule Sets for triage
### Collect the artifact from the endpoint!

---

## Using Curated Rule Sets for triage
### Inspect the results

---

## Using Curated Rule Sets for triage
### Stack results: See what type of rules fired!

---

## Using Curated Rule Sets for triage
### Inspect hits

---

## Using Curated Rule Sets for triage
### Summary

* The curated rules are very noisy!
   * This is OK for triage purposes

* We just want to get the `vibe` of the compromise!
   * We can drill down later with specific artifacts.

* Performing the triage as a hunt can quickly triage the entire
  environment!

---

## Using Curated Rule Sets for triage
### Triage with on-endpoint Sigma evaluation vs. SIEM with log forwarding

* SIEM log forwarder needs to balance tradeoffs:
   * Which event logs to forward
      * Only forwarded events can be triaged
   * Higher storage costs
   * Higher bandwidth from endpoint
   * Endpoint must be online

* On endpoint evaluation:
   * Can access obscure or very noisy event logs 🙂
   * Can be done at scale 🙂
   * Efficient network transfers 🙂
   * Susceptible to log file erasure! 😟

---

## Customizing the Velociraptor Artifacts
### Managing your own Sigma Rules

* Sigma rules need tuning in many cases:
   * Some Sigma Rules are too noisy for your environment
      * We want to remove them
   * Custom Sigma Rules need to be added to your environment
   * Some Rules need to be modified.

---

## Exercise: Create your own custom pack!
### Download the artifact pack for the `Windows.Hayabusa.Rules` artifact

---

## Exercise: Create your own custom pack!
### Unpack it on the disk
### Create a new directory, add your new custom rule into it.

---

## Exercise: Create your own custom pack!
### Repack the artifact into a new artifact.

---

## Exercise: Create your own custom pack!
### Import the new artifact

---

## Exercise: Create your own custom pack!
### Collect new artifact