Windows rapid triage with velociraptor and kape

 During malware incidents or any cyber attack, we need to first triage the system to collect useful artifacts so that it can help in our analysis greatly. 

The main link I followed:

https://github.com/secure-cake/rapid-endpoint-investigations/wiki/REI-Wiki-Part-1:-Intro

We will use velociraptor to collect artifacts and kape tool to parse those artifacts. 

Let's first ready the tools.

Download velociraptor from the below link:

Velociraptor (download): https://docs.velociraptor.app/downloads/

Now register, download kape from the below link and save here C:\Tools\KAPE

https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape

Once the kape is installed, now we need to download some executables and put it in this folder KAPE\Modules\bin

• NirSoft BrowsingHistoryView: https://www.nirsoft.net/utils/browsing_history_view.html (SAVE TO: ..KAPE\modules\bin\browsinghistoryview.exe

• NirSoft Browser Downloads View: https://www.nirsoft.net/utils/web_browser_downloads_view.html (SAVE TO: ..KAPE\modules\bin\browserdownloadsview.exe)

• ObsidianForensics Hindsight: https://github.com/obsidianforensics/hindsight (SAVE TO: ..KAPE\modules\bin\hindsight.exe)

• Hayabusa: https://github.com/Yamato-Security/hayabusa/releases (Install/Unzip Hayabusa, then COPY all of the installation-directory contents to a "hayabusa" directory AND rename the hayabusa-2.x.x-win-x64.exe to "hayabusa.exe": ..KAPE\modules\bin\hayabusa) meaning in this hayabusa folder, you need to copy all hayabusa content as well as hayabusa.exe

Now you need to download the Invoke-KAPE.ps1 script from the below link and copy to the root of your kape directory i.e. C:\Tools\KAPE

https://github.com/swisscom/Invoke-Forensics/blob/main/Invoke-Kape.ps1

Also download the Custom EvtxECmd Module (!EvtxECmd-Triage.mkape) from the below link and save to KAPE\Modules\!Local folder/directory.

https://github.com/secure-cake/rapid-endpoint-investigations

Other requirements:

Powershell 7.x and Microsoft Excel.

Now we already downloaded the velociraptor. We just now need to make an offline collector file which will be executed on the infected machine. 

The step by step process is documented on the following link and my ovi.it88 google drive, folder name is Windows IR by Patterson Cake (4 hour workshop) and file name is RTW_Lab-1_Velociraptor_Offline_Collector-Rev2.pdf

https://github.com/secure-cake/rapid-endpoint-investigations/wiki/REI-Wiki-Part-3:-Configuration-and-Execution

Once the above steps (offline collector building and execution) are done, now we need to use kape to parse the collected artifacts. We will get .zip format artifacts from the infected system like the above SS once we run our velociraptor exe collection file. Now we will unzip it, parse it with this script (https://github.com/secure-cake/rapid-endpoint-investigations/blob/main/rtw-script-rev1.ps1), and combine portions of the parsed data into an Excel workbook for analysis.

We need one more script (expand-archive-triage-data-rev3.ps1) here for unzipping our data automatically. From the above link, you can download the script.

I normally download my all working scripts on this folder/directory: C:\tools\scripts

And I use visual studio code desktop software to execute the script. From the VS software, File > Open folder --> then select your scripts folder to populate the script in your VS code software like the below SS.

For your better understanding, the Kape_Rapid_Triage_Excel_ RTW.ps1 script is now called rtw-script-rev1.ps1

Now we need to copy our velociraptor triage zip data inside the triage_data folder. See above SS. If we have multiple device/system collected zip files, then all those zip files need to be placed inside this triage_data folder. Then running the expand-archive-triage-data-rev3.ps1 script will unzip files. Multiple zip files are unzipped in separate folder. RTW_Lab2_Scripts_to_Parse_Collection-Rev4.pdf --> How to run the script from VS code software is mentioned on this file on my ovi.it88 google drive. 

Now its time to execute this script rtw-script-rev1.ps1

• Make sure Invoke-Kape.ps1 is placed under C:\Tools\KAPE this folder. 
• Edit the case directory variables. It will prompt you for $casename directory as per new script. So make sure what name you put, same name is already created on the corresponding folder. 
• Edit the EVTX triage variables for example, from when you start to collect the logs and what are the event id of those logs. 
• Edit the MFT File Listing file extensions, as desired.

Now execute the script. 

Once done, you will get the data like the above image. Now start your investigation. 

Avi