Home on Matt's DFIR blog

Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.

Velociraptor MCP is a Model Context Protocol bridge for exposing Velociraprtor to MCP. https://github.com/mgreen27/mcp-velociraptor

Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.

UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.

Workshop link DEATHcon Velociraptor workshop was held November 2023.

Content management is one of the most under rated Velociraptor capabilities used by mature users.

This is a technical post covering practical methodology to extract configuration data from recent Qakbot samples.

A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. https://github.com/mgreen27/DetectRaptor)

DEATHcon Velociraptor workshop was held November 2022.

Velociraptor notebook is a feature that supercharges analysis and speeds up many components of incident response.

WMI Eventing is a fairly well known technique in DFIR, however some tools may not provide the coverage you expect.

Velociraptor’s ability for data manipulation is a core platform capability that drives a lot of the great content we have available in terms of data parsing for artifacts and live analysis.

This post is going to talk about using Windows IPSec for a quarantine use case.

In this post im going to talk about a live response use case leveraging the Velociraptor project worth sharing.

This post is going to talk about the Velociraptor project.

With the proliferation of EDR we have seen attackers at all levels upping their game to bypass brittle (and not so brittle) endpoint detection.

In this post Im going to talk about Office365 hidden inbox rules.

This is my second Binary Rename post, in this post I am focusing on static detection, that is assessing files on disk.

In this post I thought I would share an interesting proof of concept I developed to detect Binary Rename of commonly abused binaries.

In this post I thought I would share some practical new features implemented in a recent refactor of Invoke-LiveResponse.

In this post I thought I would share some information on Powershell download cradles I put together recently.

I thought I would share some research on Microsoft BITS after a recent tool released by the French ANSSI to parse BITS job artefacts.

Invoke-LiveResponse is a Powershell module I put together to enable raw disk collections over WinRM and local script execution.

In this post, I am going to talk about a Powershell module I have authored as a simple implementation for live response and file collections over Powershell remoting.

In this post I am going to cover a little Windows Management Instrumentation (WMI), and in particular an interesting use case for potential use in older environments with Process Monitoring gaps.

PowerShell is quickly becoming a tool of choice for many IT Operations staff and Security Practitioners alike.