/ir-velociraptor

name: ir-velociraptor
description: >
  Endpoint visibility, digital forensics, and incident response using Velociraptor
  Query Language (VQL) for evidence collection and threat hunting at scale. Use when:
  (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for
  indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry
  and artifacts for incident analysis, (4) Performing live response and evidence
  preservation, (5) Monitoring endpoints for security events, (6) Creating custom
  forensic artifacts for specific threat scenarios.
version: 0.1.0
maintainer: SirAppSec
category: incident-response
tags: [forensics, incident-response, endpoint-detection, threat-hunting, vql, dfir, live-response, evidence-collection]
frameworks: [MITRE-ATT&CK, NIST]
dependencies:
  tools: [velociraptor]
references:
  - https://docs.velociraptor.app/
  - https://github.com/Velocidex/velociraptor
  - https://docs.velociraptor.app/artifact_references/

Velociraptor Incident Response

Overview

Velociraptor is an endpoint visibility and forensics platform for collecting host-based state information using Velociraptor Query Language (VQL). It operates in three core modes: **Collect** (targeted evidence gathering), **Monitor** (continuous event capture), and **Hunt** (proactive threat hunting).

**When to use this skill**:

• Active incident response requiring endpoint evidence collection
• Threat hunting across enterprise infrastructure
• Digital forensics investigations and timeline analysis
• Endpoint monitoring and anomaly detection
• Custom forensic artifact development for specific threats

Quick Start

Local Forensic Triage (Standalone Mode)

# Download Velociraptor binary for your platform
# https://github.com/Velocidex/velociraptor/releases

# Run GUI mode for interactive investigation
velociraptor gui

# Access web interface at https://127.0.0.1:8889/
# Default admin credentials shown in console output

Enterprise Server Deployment

# Generate server configuration
velociraptor config generate > server.config.yaml

# Start server
velociraptor --config server.config.yaml frontend

# Generate client configuration
velociraptor --config server.config.yaml config client > client.config.yaml

# Deploy clients across endpoints
velociraptor --config client.config.yaml client

Core Incident Response Workflows

Workflow 1: Initial Compromise Investigation

Progress: [ ] 1. Identify affected endpoints and timeframe [ ] 2. Collect authentication logs and suspicious logins [ ] 3. Gather process execution history and command lines [ ] 4. Extract network connection artifacts [ ] 5. Collect persistence mechanisms (scheduled tasks, autoruns, services) [ ] 6. Analyze file system modifications and suspicious files [ ] 7. Extract memory artifacts if needed [ ] 8. Build timeline and document IOCs

Work through each step systematically. Check off completed items.

**Key VQL Artifacts**:

• `Windows.EventLogs.RDP` - Remote desktop authentication events
• `Windows.System.Pslist` - Running processes with details
• `Windows.Network.NetstatEnriched` - Network connections with process context
• `Windows.Persistence.PermanentWMIEvents` - WMI-based persistence
• `Windows.Timeline.Prefetch` - Program execution timeline
• `Windows.Forensics.Timeline` - Comprehensive filesystem timeline

Workflow 2: Threat Hunting Campaign

Progress: [ ] 1. Define threat hypothesis and IOCs [ ] 2. Select or create custom VQL artifacts for detection [ ] 3. Create hunt targeting relevant endpoint groups [ ] 4. Execute hunt across infrastructure [ ] 5. Monitor collection progress and errors [ ] 6. Analyze results and identify positive matches [ ] 7. Triage findings and escalate confirmed threats [ ] 8. Document TTPs and update detections

Work through each step systematically. Check off completed items.

**Common Hunt Scenarios**:

• Lateral movement detection (PsExec, WMI, remote services)
• Webshell identification on web servers
• Suspicious scheduled task discovery
• Credential dumping tool artifacts
• Malicious PowerShell execution patterns

Workflow 3: Evidence Collection for Forensics

Progress: [ ] 1. Document collection requirements and scope [ ] 2. Create offline collector with required artifacts [ ] 3. Deploy collector to target endpoint(s) [ ] 4. Execute collection and verify completion [ ] 5. Retrieve collection archive [ ] 6. Validate evidence integrity (hashes) [ ] 7. Import into forensic platform for analysis [ ] 8. Document chain of custody

Work through each step systematically. Check off completed items.

# Create offline collector (no server required)
velociraptor --config server.config.yaml artifacts collect \
  Windows.KapeFiles.Targets \
  Windows.EventLogs.Evtx \
  Windows.Registry.Sysinternals.Eulacheck \
  --output /path/to/collection.zip

# For custom artifact collection
velociraptor artifacts collect Custom.Artifact.Name --args param=value

VQL Query Patterns

Pattern 1: Process Investigation

Search for suspicious process execution patterns:

-- Find processes with unusual parent-child relationships
SELECT Pid, Ppid, Name, CommandLine, Username, Exe
FROM pslist()
WHERE Name =~ "(?i)(powershell|cmd|wscript|cscript)"
  AND CommandLine =~ "(?i)(invoke|download|iex|bypass|hidden)"

Pattern 2: Network Connection Analysis

Identify suspicious network connections:

-- Active connections with process context
SELECT Laddr.IP AS LocalIP,
       Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP,
       Raddr.Port AS RemotePort,
       Status, Pid,
       process_tracker_get(id=Pid).Name AS ProcessName,
       process_tracker_get(id=Pid).CommandLine AS CommandLine
FROM netstat()
WHERE Status = "ESTABLISHED"
  AND Raddr.IP =~ "^(?!10\\.)" -- External IPs only

Pattern 3: File System Forensics

Timeline suspicious file modifications:

-- Recent file modifications in suspici