Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry and artifacts for incident analysis, (4) Performing live response and evidence preservation, (5) Monitoring endpoints for security events, (6) Creating custom forensic artifacts for specific threat scenarios.
Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale. Use when: (1) Conducting forensic investigations across multiple endpoints, (2) Hunting for indicators of compromise or suspicious activities, (3) Collecting endpoint telemetry and artifacts for incident analysis, (4) Performing live response and evidence preservation, (5) Monitoring endpoints for security events, (6) Creating custom forensic artifacts for specific threat scenarios.
Velociraptor is an endpoint visibility and forensics platform for collecting host-based state information using Velociraptor Query Language (VQL). It operates in three core modes: Collect (targeted evidence gathering), Monitor (continuous event capture), and Hunt (proactive threat hunting).
When to use this skill:
Active incident response requiring endpoint evidence collection
Threat hunting across enterprise infrastructure
Digital forensics investigations and timeline analysis
Endpoint monitoring and anomaly detection
Custom forensic artifact development for specific threats
Quick Start
Local Forensic Triage (Standalone Mode)
# Download Velociraptor binary for your platform# https://github.com/Velocidex/velociraptor/releases# Run GUI mode for interactive investigation
velociraptor gui
# Access web interface at https://127.0.0.1:8889/# Default admin credentials shown in console output
-- Find processes with unusual parent-child relationshipsSELECT Pid, Ppid, Name, CommandLine, Username, Exe
FROM pslist()
WHERE Name =~ "(?i)(powershell|cmd|wscript|cscript)"
AND CommandLine =~ "(?i)(invoke|download|iex|bypass|hidden)"
Pattern 2: Network Connection Analysis
Identify suspicious network connections:
-- Active connections with process contextSELECT Laddr.IP AS LocalIP,
Laddr.Port AS LocalPort,
Raddr.IP AS RemoteIP,
Raddr.Port AS RemotePort,
Status, Pid,
process_tracker_get(id=Pid).Name AS ProcessName,
process_tracker_get(id=Pid).CommandLine AS CommandLine
FROM netstat()
WHERE Status = "ESTABLISHED"
AND Raddr.IP =~ "^(?!10\\.)" -- External IPs only
Pattern 3: File System Forensics
Timeline suspicious file modifications:
-- Recent file modifications in suspicious locationsSELECT FullPath, Size, Mtime, Atime, Ctime, Btime
FROM glob(globs="C:/Users/*/AppData/**/*.exe")
WHERE Mtime >timestamp(epoch=now() -86400) -- Last 24 hoursORDERBY Mtime DESC
Pattern 4: Registry Persistence
Hunt for registry-based persistence:
-- Common autorun registry keysSELECT Key.Name AS RegistryKey,
ValueName,
ValueData
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*")
WHERE ValueData =~ "(?i)(powershell|cmd|wscript|rundll32)"
Create custom VQL artifacts for specific investigation needs:
name:Custom.Windows.SuspiciousProcessdescription:|
Detect processes with suspicious characteristics for incident response.
parameters:-name:ProcessNameRegexdefault:"(?i)(powershell|cmd|wscript)"type:regex-name:CommandLineRegexdefault:"(?i)(invoke|download|bypass)"type:regexsources:-query:|
SELECT Pid, Ppid, Name, CommandLine, Username, Exe, CreateTime
FROM pslist()
WHERE Name =~ ProcessNameRegex
AND CommandLine =~ CommandLineRegex
Save artifacts in YAML format and import via Velociraptor UI or command line.
Sensitive Data Handling: VQL queries can collect credentials, PII, and sensitive files. Implement data minimization - only collect necessary evidence. Use encryption for evidence transport and storage.
Access Control: Velociraptor server access provides significant endpoint control. Implement RBAC, audit all queries, and restrict administrative access. Use client certificates for authentication.
Audit Logging: All VQL queries, hunts, and collections are logged. Enable audit trail for compliance. Document investigation scope and approvals.
Compliance: Ensure evidence collection follows organizational policies and legal requirements. Document chain of custody for forensic investigations. Consider data sovereignty for multi-region deployments.
Operational Security: Velociraptor generates significant endpoint activity. Plan for network bandwidth, endpoint performance impact, and detection by adversaries during covert investigations.
Common Investigation Patterns
Pattern: Ransomware Investigation
Identify patient zero endpoint
Collect: Windows.Forensics.Timeline for file modification patterns
Collect: Windows.EventLogs.Evtx for authentication events
Hunt for: Lateral movement artifacts across network
Hunt for: Scheduled tasks or services for persistence
Extract: Ransomware binary samples for malware analysis
Build: Timeline of infection spread and data encryption
