Velociraptor Hunt - Rewind is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Velociraptor, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Lateral Movement, Collection.
Investigate a multi-stage intrusion across six workstations using Velociraptor, correlating artifacts to uncover how the attacker moved, escalated, and stole data before anyone noticed.
Categories: Endpoint Forensics.
MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Lateral Movement, Collection.
Tools: Velociraptor.
Difficulty: medium.