Lab 8.1 — Endpoint Collection

Lab Overview

The Scenario

Your SOC received an alert from Wazuh about suspicious outbound connections from a Linux endpoint (velociraptor-client). The alert flagged periodic connections to an unusual external IP. Rather than remoting into the machine directly, you'll use Velociraptor to remotely investigate what's running on the endpoint.

Unbeknownst to you, the endpoint has been compromised. Multiple artifacts have been planted:

• A C2 beacon script phoning home periodically
• An encoded payload used during initial access
• A crypto miner consuming CPU resources
• A webshell for persistent web access
• An SSH backdoor for alternative access
• Cron persistence to survive reboots
• A systemd service for additional persistence

Your job: use Velociraptor's collection artifacts to find at least 3 of these suspicious items and document your findings.

Part 1: Accessing Velociraptor and Finding the Client

Step 1: Log Into the Velociraptor GUI

Open the Velociraptor web interface:

• URL: Provided via the "Open Lab" button (port 8889)
• Username: admin
• Password: cyberblue

After logging in, you'll see the Velociraptor dashboard showing server status and connected clients.

Step 2: Locate the Client

1. Click the magnifying glass icon (🔍) in the left sidebar or click "Show All" in the search bar
2. You should see one connected client: the pre-configured Linux endpoint
3. Click on the client name to open its detail view

Record the following:

• Client ID
• Hostname
• Operating system
• Last seen timestamp

Click to enlarge

Part 2: Collecting Running Processes

Step 3: Create a New Collection

1. With the client selected, click the "Collected Artifacts" tab
2. Click the "New Collection" button (+ icon)
3. In the artifact search bar, type: Linux.Sys.Pslist
4. Select the artifact and click "Launch"

Step 4: Analyze Process Results

Once the collection completes (usually 5-10 seconds), click on the result to view the data. Look for:

• Unusual process names — anything that doesn't match standard system services
• Suspicious paths — processes running from /tmp, /var/tmp, or hidden directories (starting with .)
• High CPU usage — crypto miners often show elevated CPU
• Network-facing processes — web servers or listeners you didn't expect

Create a table of suspicious processes:

PROCESS COLLECTION RESULTS
═══════════════════════════
PID    | Name         | Path                          | CPU % | Suspicious?
-------|------------- |-------------------------------|-------|------------
[pid]  | [name]       | [path]                        | [cpu] | [Yes/No + reason]

Click to enlarge

Part 3: Collecting Network Connections

Step 5: Collect Network Data

1. Create a new collection using artifact: Linux.Sys.Netstat
2. Launch and wait for results

Step 6: Analyze Network Results

Look for:

• Outbound connections to external IPs (not 10.x.x.x, 172.16-31.x.x, or 192.168.x.x)
• Listening services on unexpected ports
• Connections from suspicious processes (cross-reference with your process list)
• Periodic or beaconing patterns (same destination, regular intervals)

Document any suspicious connections:

NETWORK CONNECTION RESULTS
══════════════════════════
PID    | Local Address    | Remote Address     | State       | Process     | Suspicious?
-------|------------------|--------------------|-------------|-------------|------------
[pid]  | [local:port]     | [remote:port]      | [state]     | [name]      | [Yes/No + reason]

Part 4: Collecting Scheduled Tasks and Persistence

Step 7: Collect Cron Jobs

1. Create a new collection using artifact: Linux.Sys.Crontab
2. Launch and review results

Step 8: Collect Systemd Services

1. Create a new collection for systemd services
2. Look for any non-standard services

Step 9: Check for Additional Persistence

Collect the following artifacts to check more persistence locations:

• Linux.Sys.BashHistory — command history
• Linux.Sys.SSHKeys — authorized SSH keys

Document ALL persistence mechanisms you find:

PERSISTENCE MECHANISMS FOUND
═════════════════════════════
Type           | Location                    | Details                    | Risk
---------------|-----------------------------|-----------------------------|------
Cron job       | [crontab location]          | [schedule + command]        | [H/M/L]
Systemd svc    | [service file]              | [service details]           | [H/M/L]
SSH key        | [authorized_keys path]      | [key fingerprint]           | [H/M/L]

Part 5: Building the Investigation Report

Step 10: Compile Your Findings

Combine all your collection results into a single investigation report:

ENDPOINT COLLECTION REPORT
═══════════════════════════
Endpoint: [client hostname]
Client ID: [Velociraptor client ID]
Investigation Date: [today's date]
Analyst: [your name]

SUMMARY OF FINDINGS
───────────────────
Total suspicious items identified: [count]

FINDING 1: [Title]
  Category: [Process / Network / Persistence]
  Evidence: [specific data from collection]
  Risk Level: [Critical / High / Medium / Low]
  Recommendation: [what should be done]

FINDING 2: [Title]
  Category: [Process / Network / Persistence]
  Evidence: [specific data from collection]
  Risk Level: [Critical / High / Medium / Low]
  Recommendation: [what should be done]

FINDING 3: [Title]
  Category: [Process / Network / Persistence]
  Evidence: [specific data from collection]
  Risk Level: [Critical / High / Medium / Low]
  Recommendation: [what should be done]

TIMELINE
────────
[Reconstruct a timeline of how the compromise likely occurred based on your findings]

Deliverable Checklist

Before completing the lab, ensure you have:

• Process Collection — ran Linux.Sys.Pslist and identified suspicious processes
• Network Collection — ran Linux.Sys.Netstat and identified suspicious connections
• Persistence Collection — checked cron, systemd, SSH keys, and bash history
• At Least 3 Suspicious Items — documented with evidence from Velociraptor collections
• Investigation Report — compiled findings with risk levels and recommendations

What's Next

In Lab 8.2 — Process Tree Investigation, you'll dive deeper into process analysis. Instead of just listing running processes, you'll trace parent-child relationships to reconstruct execution chains and determine how a suspicious process was launched.