Velociraptor Installation

Reference: https://kravensecurity.com/threat-hunting-with-velociraptor-environment-setup/

Server Installation

Start by downloading the latest debian linux package from https://docs.velociraptor.app/downloads/

Start the installation wizard with:

./velociraptor-v0.75.2-linux-amd64 config generate -i

• I set the admin user to my firstname.lastname and my default password
• When it asks you to set a domain name do not do this, and leave it at localhost. If you do set it, you will need to change the config files later to have the ip address of the server rather than the name you set

Now create an installation package with the server.config.yaml

./velociraptor-v0.75.2-linux-amd64 --config server.config.yaml debian server --binary [full path of downloaded binary]
sudo dpkg -i velociraptor-server-0.75.2.amd64.deb

I ran to an issue where the "dpkg frontend lock was locked by another process with pid 9422," I had to run sudo dpkg-reconfigure -plow unattended-upgrades and turn it off to kill the process. Alternatively, you can run `sudo kill 9422'

Restart and check the status of the service with:

systemctl restart velociraptor_server.service
systemctl status velociraptor_server.service

Open the web interface by going to https://127.0.0.1:8889 and sign in with the username and password you set

Client Installation

On the server, go to the server artifacts tab, create a new collection (+) and search for Server.Utils.CreateMSI

Select it, then select launch

Then click on the new entry and go to the "Uploaded Files" tab. Under vfs_path there is a file you can download. Download it, and get it to the client. Once there, run it on the client.

After the msi runs, velociraptor should be in the "services" of the client. Then, if you go back to the ubuntu server, it should show up in the client list when you click the search button