Endpoint Forensics with Velociraptor
intermediate 40 min 4 tasksSubscription
Use Velociraptor and its VQL query language to hunt a live Windows endpoint at scale: surface persistence (autoruns, scheduled tasks), running processes, and network artifacts, and pull out the IOCs that confirm an intrusion.
This lab is available with a Purple Edge subscription. Sign in to view the full overview and start the lab.
Part of these paths
Unlock this lab
Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.
Updated 2026-06-15