DFIR
28 Sep 2026
Introducing velociraptor-skills, reusable AI skills for case setup, collection, hunting and evidence analysis with Velociraptor.
Published at InfoGuard Labs (opens in a new tab)
28 Sep 2026
Reusable AI skills and tooling for investigators using Velociraptor. Covers setup, artifact selection, collection, hunting and host analysis, with the vraptor command-line runtime.
1 Dec 2025
CLRaptor: Hunting reflected assemblies with Velociraptor
Hunt reflected .NET assemblies at scale with Velociraptor, detect CLR visibility gaps, and dump suspicious in-memory assemblies for analysis.
Published at InfoGuard Labs (opens in a new tab)
15 Apr 2025
A Model Context Protocol bridge that connects AI assistants to Velociraptor for DFIR workflows.
1 Nov 2024
Finding the LNK: Techniques and methodology for advanced analysis
Advanced LNK analysis with Velociraptor, covering shortcut structures, suspicious fields, and useful clustering points for DFIR and CTI workflows.
Published at Rapid7 (opens in a new tab)
29 Feb 2024
UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.
Published at Rapid7 (opens in a new tab)
20 Nov 2023
DEATHcon2023: Practical DEATH by Velociraptor
A practical Velociraptor and VQL workshop for investigators, covering accessors, query performance, RDP patching, BlackLotus and LNK analysis.
13 Sep 2023
Content Management Like a Boss!
Velociraptor content management and automation techniques for teams maintaining detection and investigation content.
5 Apr 2023
Automating Qakbot decode at scale
Extract Qakbot configuration data and automate decoding at scale with Velociraptor. Covers payload unpacking, decryption and campaign indicators.
17 Nov 2022
Bulk Velociraptor detection content for incident responders and threat hunters. Collects shared detection artifacts in one repository.
5 Nov 2022
DEATHcon 2022 Velociraptor workshop
An introductory Velociraptor workshop for DFIR practitioners, covering VQL, NTFS, event logs, YARA and memory artifacts. Includes lab material and recordings.
17 Sep 2022
Notebook and VQL - data munging your way to victory!
A practical introduction to VQL data manipulation for Velociraptor users, with examples for building artifacts and analysing investigation data.
12 Jan 2022
WMI Event Consumers: what are you missing?
Find WMI event consumers that common collection methods miss, including persistence in custom namespaces. Covers collection and detection with Velociraptor.
9 Nov 2021
Cobalt Strike Payload Discovery And Data Manipulation In VQL
Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.
23 Jul 2020
Windows IPSEC for endpoint quarantine
Build and deploy Windows IPsec policies for endpoint quarantine through Velociraptor, with containment requirements and policy removal considerations.
8 Dec 2019
Local Live Response with Velociraptor ++
A historical walkthrough of bundling Velociraptor with WinPMem and Autoruns for local triage. This approach was superseded by the GUI collector builder.
10 Nov 2019
Live response automation with Velociraptor
A historical walkthrough of automating Velociraptor collections and post-processing through its API. The examples predate the current API.
26 Jun 2019
Endpoint Hunting in an AntiEDR World
Endpoint hunting techniques for defenders investigating activity that bypasses EDR. Includes presentation slides and examples of detection evasion.
9 Jun 2019
Examine how Office 365 inbox rules can be hidden, how rule properties are modified, and methods for detecting the changes.
29 May 2019
Compare YARA and PowerShell approaches to finding renamed executables on disk, with code examples and detection limitations.
12 May 2019
Blue Team Hacks - Binary Rename
Detect renamed Windows binaries by comparing executable metadata with process names and paths. Includes a proof of concept and its limitations.
7 Apr 2019
Build modular live response scripts with Invoke-LiveResponse, including custom collection logic and support for legacy PowerShell.
2 Apr 2018
Compare PowerShell download cradles and their network and endpoint traces, with test scripts to help assess detection coverage.
18 Feb 2018
Investigate Microsoft BITS job artefacts, collection methods and event logs to identify suspicious transfers and persistence.
14 Jan 2018
Collect live response data and raw files over WinRM with Invoke-LiveResponse and PowerForensics. Covers setup, collection modes and forensic footprint.
1/2