Projects
28 Sep 2026
Reusable AI skills and tooling for investigators using Velociraptor. Covers setup, artifact selection, collection, hunting and host analysis, with the vraptor command-line runtime.
15 Apr 2025
A Model Context Protocol bridge that connects AI assistants to Velociraptor for DFIR workflows.
20 Nov 2023
DEATHcon2023: Practical DEATH by Velociraptor
A practical Velociraptor and VQL workshop for investigators, covering accessors, query performance, RDP patching, BlackLotus and LNK analysis.
13 Sep 2023
Content Management Like a Boss!
Velociraptor content management and automation techniques for teams maintaining detection and investigation content.
17 Nov 2022
Bulk Velociraptor detection content for incident responders and threat hunters. Collects shared detection artifacts in one repository.
5 Nov 2022
DEATHcon 2022 Velociraptor workshop
An introductory Velociraptor workshop for DFIR practitioners, covering VQL, NTFS, event logs, YARA and memory artifacts. Includes lab material and recordings.
17 Sep 2022
Notebook and VQL - data munging your way to victory!
A practical introduction to VQL data manipulation for Velociraptor users, with examples for building artifacts and analysing investigation data.
26 Jun 2019
Endpoint Hunting in an AntiEDR World
Endpoint hunting techniques for defenders investigating activity that bypasses EDR. Includes presentation slides and examples of detection evasion.
14 Jan 2018
A PowerShell module for responders collecting forensic artifacts from Windows systems over WinRM or through local script execution.