Module 8: Endpoint Visibility & Response

The endpoint is where attacks land. Learn to look inside it.

5 lessons · 4 labs

Velociraptor
Operation APT Breach

Pivot from the Wazuh LSASS alert to Velociraptor and confirm credential theft on the endpoint.

Path

  1. 01
    Lesson

    Why Endpoint Visibility Matters

    What endpoints reveal that SIEM can't

  2. 02
    Lesson

    Velociraptor: Endpoint Investigation

    Artifacts, VQL basics

  3. 03
    Lab

    Lab 8.1 — Endpoint Collection

    Collect processes, connections, tasks.

  4. 04
    Lesson

    Live Process Investigation with VQL

    Using Velociraptor to investigate suspicious processes, parent-child trees, and process anomalies in real time

  5. 05
    Lab

    Lab 8.2 — Process Tree Investigation

    Investigate suspicious powershell.exe.

  6. 06
    Lesson

    Hunting Persistence with Velociraptor

    Using VQL artifacts to discover attacker persistence: tasks, services, registry, startup items across endpoints

  7. 07
    Lab

    Lab 8.3 — Persistence Hunt

    Find attacker's persistence mechanism.

  8. 08
    Lesson

    Endpoint Triage Workflow

    SIEM alert → Velociraptor → confirm

  9. 09
    Lab

    Lab 8.4 — SIEM to Endpoint

    Wazuh alert → Velociraptor investigation.