Preparing the Kingdom

In this lab, we verified access to the GOAD environment, installed and configured Sysmon on all of the Windows systems to collect logs, installed and configured Velociraptor on our Ubuntu VMs, and finally deployed the Velociraptor on all Windows VMs.

IP Addresses

Name	IP
Ubuntu	10.2.10.140/24
Win11	10.2.10.238/24
Kali	10.2.10.116/24
SRV-02 (CASTELBLACK)	10.2.10.22/24
SRV-03 (BRAAVOS)	10.2.10.23/24
DC-01 (KINGSLANDING)	10.2.10.10/24
DC-02 (WINTERFELL)	10.2.10.11/24
DC-03 (MEEREEN)	10.2.10.12/24

Lab Procedure

Part 1: Verifying Access to the GOAD Environment

To begin, I made sure I had access to all of my VMs. I checked access to my GOAD 5 VMs first, which have their hostnames and IPs noted above. Next, I logged into my Windows 11 VM, noting the IP address above as well. Kali and Ubuntu worked the same as well!

I am NOT able to SSH into my Ubuntu VM. Will verify if this is necessary.

Part 2: Installing Sysmon and Configuring Logging

Now that I have verified access to all of my VMs, I will begin installing Sysmon (System Monitor) on all of the Windows systems in my environment. Sysmon is responsible for logging system activity (process creation, network connections, file changes, etc). I will be able to monitor for suspicious activity with Sysmon.

First, I downloaded Sysmon from the [official Sysinternals page](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon).

for this journal, I am showing my process on my Client Win11 VM. This process is being done on ALL of my Windows systems.

Along with this, I downloaded [this configuration file](https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml).

Sysmon Config Pusher was giving me a very hard time, so I did it manually.

sysmon.exe -accepteula -i sysmonconfig.xml

sysmon.exe -c

To verify that Sysmon is generating logs, I navigated to Event Viewer > Applications and Services Logs > Microsoft > Sysmon/Operational:

I am able to see logging working correctly through opening Notepad and pinging google.com:

The same tests were conducted on each machine and all showed proper logging!

Part 3: Installing and Configuring Velociraptor

Now that I have Sysmon working across my Windows 11 VMs, I can begin setting up Velociraptor on my Ubuntu VM. This will allow me to establish a central platform to monitor and collect forensic data from endpoints in my environment. On my Ubuntu VM, I navigated to [Velociraptor’s official site](https://www.velocidex.com/) and downloaded the latest binary for Linux:

After it is downloaded, I moved the downloaded binary to /opt/velociraptor. I ran the following commands to set up Velociraptor as a server:

I followed the interactive prompts to configure the server. Lastly, I ran the following command to start the server:

sudo ./velociraptor-xyz-linux-amd64 --config server.config.yaml debian server

Now I can access the web interface!

Part 4: Deploying Velociraptor Agents

Lastly, I need to deploy Velociraptor agents to all of the Windows VMs in the GOAD environment. They will connect back to my Velociraptor server, which will establish endpoint detection/response.

To begin, I generated an agent for Windows in Velociraptor through the Build Windows client MSI section:

created a file to ship, and I then downloaded the file to ship off to my Windows VMs:

From my Windows VMs, I was able to secure copy the file over from Ubuntu via scp account@ubuntuserverip:/opt/velociraptor/nameofcreatedinstallfile C:\destinationpathofwindowsbox\. I ran the MSI from here (just by double-clicking) and navigated to the Velociraptor folder C:\Program Files\Velociraptor. I ran Velociraptor.exe --config client.config.yaml to install the agent!

Checking my Velociraptor web interface, I am able to verify all of the Windows VMs have connected and are reporting data!

I was able to query the clients and was able to get their client IDs and hostnames:

This concludes my work for this lab!