Velociraptor in a nutshell
Per the documentation, “VQL is not useful without a good set of plugins that make DFIR work possible. Velociraptor’s strength lies in the wide array of VQL plugins and functions that are geared towards making DFIR investigations and detections effective”.
At the date of the entry of this content, the categories surrounding forensic analysis are:
Evidence of Execution
Volatile Machine State
Have a skim through
Searching Filenames and
NTFS Analysis to provide a solid brain dump to prep for the Nightmare.