VQL
15 Apr 2025
A Model Context Protocol bridge that connects AI assistants to Velociraptor for DFIR workflows.
20 Nov 2023
DEATHcon2023: Practical DEATH by Velociraptor
A practical Velociraptor and VQL workshop for investigators, covering accessors, query performance, RDP patching, BlackLotus and LNK analysis.
13 Sep 2023
Content Management Like a Boss!
Velociraptor content management and automation techniques for teams maintaining detection and investigation content.
17 Nov 2022
Bulk Velociraptor detection content for incident responders and threat hunters. Collects shared detection artifacts in one repository.
5 Nov 2022
DEATHcon 2022 Velociraptor workshop
An introductory Velociraptor workshop for DFIR practitioners, covering VQL, NTFS, event logs, YARA and memory artifacts. Includes lab material and recordings.
17 Sep 2022
Notebook and VQL - data munging your way to victory!
A practical introduction to VQL data manipulation for Velociraptor users, with examples for building artifacts and analysing investigation data.
9 Nov 2021
Cobalt Strike Payload Discovery And Data Manipulation In VQL
Discover encoded Cobalt Strike payloads in MSBuild task files, collect them with Velociraptor and use VQL to decode payloads and extract indicators.
23 Jul 2020
Windows IPSEC for endpoint quarantine
Build and deploy Windows IPsec policies for endpoint quarantine through Velociraptor, with containment requirements and policy removal considerations.
8 Dec 2019
Local Live Response with Velociraptor ++
A historical walkthrough of bundling Velociraptor with WinPMem and Autoruns for local triage. This approach was superseded by the GUI collector builder.
10 Nov 2019
Live response automation with Velociraptor
A historical walkthrough of automating Velociraptor collections and post-processing through its API. The examples predate the current API.