#DFIR
All CosmicBytez Labs articles tagged #DFIR, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-19583: Velociraptor Permission Bypass via Client Monitoring Artifacts
Velociraptor fails to gate client monitoring artifacts, letting low-privileged users schedule restricted commands like Linux.Sys.BashShell.
- HOWTO
Osquery Endpoint Visibility & Threat Hunting
Use SQL to query your endpoints like a database. Deploy osquery across Linux and Windows hosts to surface process trees, network connections, user activity…
- HOWTO
Velociraptor DFIR Setup, Hunts, and Forensic Collection
Deploy Velociraptor for endpoint visibility, run fleet-wide hunts, collect forensic artifacts, and accelerate incident response with VQL queries.
- Project
Velociraptor DFIR: Endpoint Forensics and Incident Response
Deploy Velociraptor — the open-source DFIR platform — to collect forensic artifacts, run live endpoint hunts with VQL, and build an incident response...
- HOWTO
Incident Response Playbook: Ransomware
Complete ransomware incident response playbook following NIST framework. Covers detection, containment, eradication, recovery, and lessons learned.