Articles
28 Sep 2026
Introducing velociraptor-skills, reusable AI skills for case setup, collection, hunting and evidence analysis with Velociraptor.
Published at InfoGuard Labs (opens in a new tab)
1 Dec 2025
CLRaptor: Hunting reflected assemblies with Velociraptor
Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.
Published at InfoGuard Labs (opens in a new tab)
1 Nov 2024
Finding the LNK: Techniques and methodology for advanced analysis
Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.
Published at Rapid7 (opens in a new tab)
16 Jul 2024
Kimsuky's Phishing and Payload Tactics
My 2024 Rapid7 research with Natalie Zargarov and Anna Širokova on Kimsuky’s social engineering, delivery methods and payloads.
Report at Rapid7 (PDF) (opens in a new tab) · Read illustrated overview
29 Feb 2024
UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.
Published at Rapid7 (opens in a new tab)
5 Apr 2023
Automating Qakbot decode at scale
Extract Qakbot configuration data and automate decoding at scale with Velociraptor. Covers payload unpacking, decryption and campaign indicators.
12 Jan 2022
WMI Event Consumers: what are you missing?
Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.
9 Nov 2021
Cobalt Strike Payload Discovery And Data Manipulation In VQL
Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.
23 Jul 2020
Windows IPSEC for endpoint quarantine
Build and deploy Windows IPsec policies for endpoint quarantine through Velociraptor, with containment requirements and policy removal considerations.
8 Dec 2019
Local Live Response with Velociraptor ++
A historical walkthrough of bundling Velociraptor with WinPMem and Autoruns for local triage. This approach was superseded by the GUI collector builder.
10 Nov 2019
Live response automation with Velociraptor
A historical walkthrough of automating Velociraptor collections and post-processing through its API. The examples predate the current API.
9 Jun 2019
Examine how Office 365 inbox rules can be hidden, how rule properties are modified, and methods for detecting the changes.
29 May 2019
Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.
12 May 2019
Blue Team Hacks - Binary Rename
Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.
7 Apr 2019
Build modular live response scripts with Invoke-LiveResponse, including custom collection logic and support for legacy PowerShell.
2 Apr 2018
Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.
18 Feb 2018
Investigate Microsoft BITS job artefacts, collection methods and event logs to identify suspicious transfers and persistence.
14 Jan 2018
Collect live response data and raw files over WinRM with Invoke-LiveResponse and PowerForensics. Covers setup, collection modes and forensic footprint.
3 Apr 2017
Blue Team Hacks - WMI Eventing
Use WMI event subscriptions to monitor processes and trigger file collection on older Windows systems with visibility gaps.
12 Jan 2017
PowerShell Remoting and Incident Response
Use PowerShell remoting and WinRM for incident response, with setup examples, collection options and operational considerations.