Rapid malware execution investigation via velociraptor, excel

 We will be using velociraptor and excel to find out malware execution on the system by differential analysis. 

Context = Any true positive alert you get or you were targeted by a sophisticated advanced persistent threat. We need actionable intelligence to pivot more.

Workflow:

Following the below two links, collect the build the collector and collect the artifacts first from the fresh system and the infected system. 

https://mahimfiroj.blogspot.com/2026/09/windows-rapid-triage-with-velociraptor.html

https://github.com/secure-cake/win-mal-investigations (Preferred) 

Reference file: SLIDES_Windows-Malware-Investigations-02082024.pdf (Saved on my ovi.it88 google drive)

Here we also have some important script that will be helpful during IR.

https://github.com/secure-cake/win-mal-investigations/tree/main/misc-powershell

Once collection is done, now we need to follow the following workflow again from the 4th point:

In this case the artifacts does not require parsing. Here we will use excel to combine baseline and infected system data into a single workbook then we will use some excel conditional formatting to find the malicious thing that is not present on the baseline. We need to stage our data on the analysis system and make sure the folder naming hierarchy matches with this script - WinMal_Target_Baseline_Excel.ps1

Follow this. Need to do this on analysis system.

• A "baseline" folder (copy your baseline ZIP file here): "c:\cases\demo\baseline"
• A "target" folder (copy your target ZIP file here): "c:\cases\demo\target"
• Output directory for combined output and the Excel Workbook: "c:\cases\demo\output" (this is AUTO-CREATED by the script)

Now run the script. It will generate the excel - target-with-baseline-output.xlsx in the output folder. 

Now we need to perform the Differential Analysis:

Now open this file target-with-baseline-output.xlsx

You may see like excel is unable to show you the view properly. So do this. 

You need to first select all the sheets. 

Now click here (red arrow) to select all cells. Now right click and select Row Height and set the value as 16. Now select all the columns in each sheet and double click to any column to expand as per your need. 

https://www.youtube.com/watch?v=TsTBnAo07ks

From the Automate tab, click New Script > Create in Code Editor > Write a Script

Click on the default Script name and change it as for example: dns-diff:

And paste this on the editor section.

function main(workbook: ExcelScript.Workbook) {

    let conditionalFormatting: ExcelScript.ConditionalFormat;

    let selectedSheet = workbook.getActiveWorksheet();

    // Create custom from range A:A on selectedSheet

    conditionalFormatting = selectedSheet.getRange("A:A").addConditionalFormat(ExcelScript.ConditionalFormatType.custom);

    conditionalFormatting.getCustom().getRule().setFormula("=COUNTIF('baseline-dns'!$A$1:$A$100,A1)=0");

    conditionalFormatting.getCustom().getFormat().getFill().setColor("#ffe699");

    conditionalFormatting.setStopIfTrue(false);

    conditionalFormatting.setPriority(0);

  // Set height of row(s) at all cells on selectedSheet to 15

  selectedSheet.getRange().getFormat().setRowHeight(15);

}

https://github.com/secure-cake/win-mal-investigations

In the above link, you will get all the scripts. 

Now do the same steps 5 times more for the other 5 scripts.

Now you can select a "target" worksheet, eg "target-netstat," click "run" to execute the "netstat-diff" code (you need to see which sheet you are currently in and that corresponding script you need to run), and all items that are UNIQUE to the "target-netstat" NAME will be highlighted "yellow" for your review! Repeat this for each worksheet: select the "target" worksheet, then click the associated "worksheet-diff" automation function.

This is how it look like for target-dns sheet:

Avi