Velociraptor Hands on Labs

This SUSA exercise uses Instant Velociraptor and local process triage. For server deployment, client enrolment and filename or hash hunts, continue to CDK's Velociraptor labs.

Interactive Lab

Your case: an unexpected notepad.exe has been reported on one workstation you are allowed to examine. Collect a list of running processes, compare the two Notepad entries, check the collection log, download the results and choose a finding to share with another analyst. Allow about 10 to 15 minutes. Follow the step instructions above the interface; open Need a hint? if you get stuck. Use Reset lab to start again.

The client and process rows are sample data. The simulation does not examine your workstation. Use the search box, collection buttons, Results and Log tabs, and download button to complete the lab. Greyed out controls are disabled. Blue panels contain instructions and questions. Feedback turns green for a correct answer and red for an incorrect answer; read the explanation and try again when needed.

The workflow follows Velociraptor's collection guide and uses a subset of the fields in Windows.System.Pslist. The wizard and export are simplified; labels, fields and colours may vary with your installed version and chosen theme. The Full Lab below practises the same mechanics with a harmless Notepad baseline.

Full Lab

Instant Velociraptor / local collection

Velociraptor Full Lab

One Windows workstation

Objective

SUSA-LOCAL-01 / process observation

One workstation. One process collection. A reviewable observation.

Follow the SUSA Instant Velociraptor setup to select your workstation, collect a process list while Notepad is open, and write down what the results show.

Tick a checkpoint after saving its evidence. Progress is self reported; this page cannot check your workstation.

Before you start

Use a Windows SUSA workstation or disposable Windows VM that you are allowed to examine. Follow the SUSA setup instructions to download and verify Velociraptor. Create a case folder outside Velociraptor's temporary data folder for your exports. Keep the GUI accessible only from your workstation (localhost).

The local GUI command is documented by Velociraptor. Record your installed release; its temporary datastore and shutdown behaviour matter when preserving evidence.

01

Activity 1: Start locally

Your first winConfirm that the connected client is your own workstation.

1. Complete download, PATH and startup. Leave the Velociraptor process running.
2. Open the local GUI at https://127.0.0.1:8889/, or the local URL printed by your installed release.
3. Open Client search, select the local client and compare its hostname and OS with your workstation. Record the client ID, version, last seen state, collection date and time zone. Use your actual client ID throughout this exercise.

Look for: your workstation's hostname and a recent last seen time. If the hostname does not match, select the correct client before collecting.

Local identity saved I saved the executable version, source and verification details. I saved the local client ID, hostname, OS and clock context.

02

Activity 2: Collect processes

Your next winFind Notepad in the results and check that the collection succeeded.

1. Open Notepad and leave it running. Record when you opened it. Windows versions can use different executable paths and usernames.
2. On the verified client, open Collected Artifacts, start a new collection, and select Windows.System.Pslist. Review the selected client and launch the collection.
3. Open Results and find notepad.exe. Record its PID, executable path and username when available. Open Log and check the collection completed successfully.

Look for: a Notepad process row and a completed collection with no relevant errors. If the row is absent, confirm Notepad is still running and the client and artifact are correct, then collect again. Save both attempts; a missing row alone does not establish that a process never ran.

Collection evidence saved I saved the process row, artifact name and flow ID. I reviewed and saved the collection status, logs and timestamps.

03

Activity 3: Preserve and explain

Your final winSave the results and notes so another analyst can review them after you close the GUI.

1. Export the process results using the available download/export control. Save them with the flow ID, artifact, client identity, timestamps and logs in your case folder outside the temporary datastore.
2. Write a short note: Observation: the client returned a notepad.exe row with the recorded PID and path. Interpretation: the process was observed during collection. Limitation: this snapshot does not establish a complete activity history, malicious behaviour or who started it.
3. Check the exports open from the case folder before stopping the local Velociraptor process. Close Notepad when finished. The default datastore is in a temporary folder and may be removed by Windows cleanup or reboot. Save the exports before ending the session.

Reviewable handover saved I opened the exports from a folder outside the temporary datastore. I saved an observation, interpretation and limitation with the collection context.

Local triage complete

Keep the observation and its context together

0 of 6 evidence checkpoints saved.

Continue to CDK's server/client labs when you need deployment, multi client collection and hunts.