Velociraptor Deployment

## Searching for files - glob()

* One of the most common operations in DFIR is searching for files
  efficiently.
* Velociraptor has the `glob()` plugin to search for files using a
  glob expression.
* Glob expressions use wildcards to search the filesystem for matches.
    * Paths are separated by / or \ into components
    * A `*` is a wildcard match (e.g. `*.exe` matches all files ending
      with .exe)
    * Alternatives are expressed as comma separated strings in `{}`
      e.g. `*.{exe,dll,sys}`
    * A `**` denotes recursive search. `e.g. C:\Users\**\*.exe`

---

## Exercise: Search for exe

* Search user’s home directory for binaries.

```sql
SELECT * FROM glob(globs='C:\\Users\\**\\*.exe')
```

Note the need to escape `\` in strings. You can use `/` instead and
specify multiple globs to search all at the same time:

```sql
SELECT * FROM glob(globs=['C:/Users/**/*.exe',
                          'C:/Users/**/*.dll'])
```

---

## Filesystem accessors

* Glob is a very useful concept to search hierarchical trees
* Velociraptor supports direct access to many different such trees via accessors (essentially FS drivers):

* `file` - uses OS APIs to access files.
    * `ntfs` - uses raw NTFS parsing to access low level files
    * `reg` - uses OS APIs to access the windows registry
    * `raw_reg` - search in a registry hive
    * `zip` - Search inside zip files

---

## The registry accessor

* Uses the OS API to access the registry
* Top level consists of the major hives (`HKEY_USERS` etc)
* Values appear as files, Keys appear as directories
* Default value is named “@”
* Value content is included inside the Data attribute
* Can escape components with / using quotes

`HKLM\Microsoft\Windows\"http://www.microsoft.com/"`

---

## The registry accessor

* The `OSPath` column includes the key (as directory) and the value (as a
  filename) in the path.

* The Registry accessor also includes value contents if they are small
  enough in the `Data` column.

---

## Exercise - RunOnce artifact

* Write an artifact which hashes every binary mentioned in Run/RunOnce
  keys.

* “Run and RunOnce registry keys cause programs to run each time that
  a user logs on.”

*  https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

* You can test this by adding a key

```text
   REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Notepad /t REG_SZ /d "C:\Windows\notepad.exe"
   ```

* Can you think of limitations?

---

## Exercise - RunOnce artifact

```
LET RunGlob = '''HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*'''

SELECT Name, Mtime, Data.value AS Data
FROM glob(globs=RunGlob, accessor="registry")
```

</div>

---

## Exercise: Hash all files provided in the globs

* Create an artifact that hashes files found by user provided globs.

* BONUS:
  * Support number of concurrent threads.
  * Accept a list of hashes and filter on those.

---

# Searching data

## Scanning file contents

---

## Searching data

* A powerful DFIR technique is searching bulk data for patterns
* Searching for CC data in process memory
* Searching for URLs in process memory
* Searching binaries for malware signatures
* Searching registry for patterns

Bulk searching helps to identify evidence without needing to parse
file formats

---

## YARA - The swiss army knife

* YARA is a powerful keyword scanner
* Uses rules designed to identify binary patterns in bulk data
* YARA is optimized to scan for many rules simultaneously.
* Velociraptor supports YARA scanning of bulk data (via accessors) and memory.

`yara()` and `proc_yara()`

---

## YARA rules

Yara rules has a special domain specific language

```yara
rule X {
   strings:
       $a = “hello” nocase
       $b = “Goodbye” wide
       $c = /[a-z]{5,10}[0-9]/i

condition:
       $a and ($b or $c)
}
```

---

## Exercise: drive by download

* You suspect a user was compromised by a drive by download (i.e. they
  clicked and downloaded malware delivered by mail, ads etc).
* You think the user used the Edge browser but you have no idea of the
  internal structure of the browser cache/history etc.
* Write an artifact to extract potential URLs from the Edge browser
  directory (also where is it?)

---

## Step 1: Figure out where to look

Looks like somewhere in `C:\Users\<name>\AppData\Local\Microsoft\Edge\**`

```
LET Globs = "C:/Users/Administrator/AppData/Local/Microsoft/Edge/**"

SELECT OSPath FROM glob(globs=Globs)
```

---

## Step 2: Recover URLs

* We don't exactly understand how Edge stores data but we know roughly
  what a URL is supposed to look like!

* Yara is our sledgehammer !

```
rule URL {
  strings: $a = /https?:\/\/[a-z0-9\/+&#:\?.-]+/i
  condition: any of them
}
```

---

## Step 3: Let’s do this!

```
LET Globs = "C:/Users/Administrator/AppData/Local/Microsoft/Edge/**"
LET URLRule = '''
rule URL {
  strings: $a = /https?:\/\/[a-z0-9\/+&#:\?.-]+/i
  condition: any of them
}
'''

SELECT *
FROM foreach(row={
   SELECT OSPath FROM glob(globs=Globs)
}, query={
   SELECT OSPath, String.Data AS Hit
   FROM yara(files=OSPath, rules=URLRule, number=10000000)
})
```

</div>

---

## YARA best practice

* You can get yara rules from many sources (threat intel, blog posts etc)
* YARA is really a first level triage tool:
    * Depending on signature many false positives expected
    * Some signatures are extremely specific so make a great signal
    * Try to collect additional context around the hits to eliminate
      false positives.
    * Yara scanning is relatively expensive! consider more targeted
      glob expressions and client side throttling since usually YARA
      scanning is not time critical.

---

## Uploading files

* Velociraptor can collect file data.
    * Over the network
    * Locally to a collection zip file.
    * Driven by VQL

The `upload()` VQL function copies a file using an accessor to the
relevant container

---

## Exercise: Upload Recent executables

* Collect all recent executables in users’ home directory

* Written in the past week

* Write your own VQL by combining `glob()` and `upload()`

```
LET Globs = "C:/Users/Administrator/**/*.exe"

SELECT Mtime, OSPath, upload(file=OSPath) AS Upload
FROM glob(globs=Globs)
WHERE Mtime > now() - 7 * 24 * 60 * 60
```

</div>