Module 5: File and Memory Hunting

Hunt at the file and memory level. Build YARA rules for hunting, stack file metadata for anomalies, decode encoded payloads, and analyze memory artifacts.

4 lessons · 3 labs

WazuhVelociraptor

Path

  1. 01
    Lesson

    YARA for Hunters

    Building hunt-specific YARA rules vs detection rules. The three-lens indicator model, corpus testing, and _hunt vs _alert naming conventions.

  2. 02
    Lab

    Lab 5.1 — YARA Hunting Rules

    Build hunt-focused YARA rules targeting file characteristics from the lab scenarios. Test against malicious and benign corpora.

  3. 03
    Lesson

    Stacking File Metadata

    File frequency analysis, naming convention anomalies, path depth analysis, and creation time clustering. Finding the one suspicious file among thousands.

  4. 04
    Lab

    Lab 5.2 — File Metadata Stacking

    Use Velociraptor to stack file metadata across the endpoint. Identify outliers by creation time, naming pattern, and file location.

  5. 05
    Lesson

    Encoded Payload Identification

    Detecting Base64, XOR, PowerShell -Enc, and certutil patterns in log data and on disk. Decoding techniques and evasion-aware hunting.

  6. 06
    Lab

    Lab 5.3 — Encoded Payload Analysis

    Find and decode encoded payloads in shared Wazuh data. Trace the encoding chain from delivery to execution.

  7. 07
    Lesson

    Memory Artifact Indicators

    Process hollowing telemetry, injected thread signals, handle analysis, and RWX memory region detection. Hunting for fileless threats.