Velociraptor

What Velociraptor Is and Why DFIR Teams Need It

• Velociraptor is an open-source tool (by Rapid7, originally by Mike Cohen and other Google veterans) for endpoint monitoring, forensic collection, and threat hunting. It was designed from the ground up for scale — querying thousands of endpoints simultaneously.
• Unlike its predecessor GRR (Google Rapid Response), Velociraptor uses a unique server-to-agent model where the server pulls results from agents via polling, and agents cache and compress results for efficient retrieval.
• MITRE ATT&CK maps Velociraptor’s collection capabilities to T1057 (Process Discovery), T1012 (Query Registry), and T1005 (Collection from Local System) — Velociraptor automates what a live responder would do manually on each host.
• The key differentiators: VQL (Velociraptor Query Language — SQL-like syntax that runs on endpoints), offline collectors (pre-packaged collections for air-gapped environments), and server-side artifacts that can inspect and collect from remote endpoints without a live agent connection.

Architecture — Client/Server Model

Quick Deploy

# Server — download and extract
wget https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-linux-amd64
chmod +x velociraptor-linux-amd64

# Generate server config
./velociraptor-linux-amd64 config generate > server.config.yaml

# Start the server with GUI
./velociraptor-linux-amd64 --config server.config.yaml frontend

# Generate a client MSI for Windows deployment
./velociraptor-linux-amd64 --config server.config.yaml repack --msi velociraptor_client.msi

VQL — Velociraptor Query Language

VQL is the heart of Velociraptor. It is a SQL-like query language that runs on the endpoint and returns structured results.

Core VQL Patterns

Example — Hunt for Unusual Processes

-- Find processes with suspicious command-line arguments
LET suspicious_args = ".*-enc.*|.*Invoke-Expression.*|.*DownloadString.*|.*/user:.*/sid:.*"

SELECT Name, Pid, Ppid, Cmdline, CreateTime
FROM pslist()
WHERE Cmdline =~ suspicious_args

Artifact Collections — Pre-Built Forensic Packs

Velociraptor ships with hundreds of pre-built artifacts that collect specific forensic data. These are organized by operating system and category.

Essential Artifacts for IR

Hunting — Running Threats at Scale

Hunts are the most powerful Velociraptor feature — deploy a VQL query to every client simultaneously and collect results.

How to Run a Hunt

1. Create a hunt — define a VQL query or pre-built artifact to collect
2. Schedule the hunt — run immediately or set a start time
3. Set client filtering — target a specific operating system, client label, or hostname pattern
4. Monitor results — results stream back to the server as clients respond

Example Hunt — Search All Endpoints for a Known IOC Hash

-- Hunt: Find any file matching a known-bad SHA256 hash
LET ioc_hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

SELECT * FROM file_store(path=glob(globs='C:\\Users\\*\\*'))
WHERE HashSha256(file.path) = ioc_hash

Example Hunt — Lateral Movement Detection (Event Logs)

-- Hunt: Find Event ID 4624 (successful logon) with LogonType 3 (network) 
-- originating from unusual source IPs
SELECT *
FROM parse_evtx(filename='C:\\Windows\\System32\\winevt\\Logs\\Security.evtx')
WHERE EventID = 4624 AND LogonType = 3
AND NOT SourceIp =~ "192\.168\..*"  -- Adjust to match your internal IP ranges

Velociraptor vs Other DFIR Tools

Offline Collectors — Air-Gapped Environments

Velociraptor’s offline collector is a critical feature for environments where agents cannot reach the server (air-gapped networks, incident response where the network is compromised).

# Generate an offline collector from the server
./velociraptor-linux-amd64 --config server.config.yaml \
    collect Windows.KapeFiles.Targets \
    --output collector.zip

# Run the collector on the target endpoint (no server connection needed)
collector.exe --output collected_data.zip

The offline collector bundles the Velociraptor binary, the artifact definition, and all dependencies. It runs without any server communication and produces a compressed results file that can be transferred back for analysis.

Related

• Azure Sentinel — detection and response for T1654 techniques
• BloodHound — detection and response for T1087 techniques
• Burp Suite — detection and response for T1592 techniques

Sources

• Velociraptor Documentation
• Velociraptor GitHub
• MITRE ATT&CK — T1057 (Process Discovery)
• MITRE ATT&CK — T1012 (Query Registry)
• MITRE ATT&CK — T1005 (Collection from Local System)
• Rapid7 — Velociraptor Blog