How can I automate the creation of the offline collector?

The Velociraptor Offline collector is a pre-configured triage and acquisition tool.

Velociraptor features a convenient GUI to allow creating the offline collector’s including building the configuration file and embedding it inside the collector.

But what if we need to automate the creation of the collector? While a GUI is nice it can be made much more efficient to automate the collector.

When building the collector using the GUI you might notice that the GUI simply preconfigured and launches a new server artifact and the server simply collects that.

The Create Offline Collector artifact
The Create Offline Collector artifact

You can actually collect the same artifact using the command line (on the server) or using the API (from anywhere). Here is an example with PowerShell (assuming the server is running on Windows):

velociraptor.exe --config server.config.yaml -v artifacts collect
   --args OS=Windows
   --args artifacts='[\"Generic.System.Pstree\"]'
   --args parameters='{\"Generic.System.Pstree\":{}}'
   --args target=ZIP
   --args opt_admin=N
   --args opt_prompt=N

This command will create a new offline collector binary and store it inside the file

We can now extract the executable from the ZIP file (using powershell)

Expand-Archive .\ .\my_dir\

The collector binary will be found in the unpacked directory.

The above method relies on Velociraptor having access to the server filesystem so it can find the configured tools - so this must be run directly on the server machine. If your server is on linux be sure to change to the velociraptor user first (sudo -u velociraptor bash)