# Velociraptor - Digging deeper! > Official documentation for Velociraptor, the advanced digital forensics and incident response platform. Covers installation, configuration, VQL, artifacts and more. How to use these docs as an AI agent: - Fetch a single page as raw markdown by appending ".md" to its URL (for example /docs/install.md). - Fetch this index (concise, links + summaries) at /llms.txt. - Fetch the entire corpus in one file at /llms-full.txt (large; may exceed a context window - prefer the .md pages for targeted retrieval). - Prefer the linked page for exact, current details over summaries here. ## Announcements - [2021 Velociraptor Contributor Competition](https://docs.velociraptor.app/announcements/2021-artifact-contest/): The Contest is now closed! Check out the submissions and watch the winning presentation at the SANS … - [The 2022 Velociraptor Conference - Digging together...](https://docs.velociraptor.app/announcements/2022-velocon/): The 2022 Velociraptor Conference - Digging together… Thank you for joining us for the … - [Upcoming Training Events](https://docs.velociraptor.app/announcements/2023-trainings/): Digging Deeper With VelociraptorMike Cohen, Digital Paleontologist, Rapid7 Inc. | August 5-8 We are … ### Security Advisories - [CVE-2026-64955 Velociraptor CSV Formula Injection in Export Pipeline](https://docs.velociraptor.app/announcements/advisories/cve-2026-64955/): Velociraptor CSV Formula Injection in Export Pipeline - Published 2026-07-31 - [CVE-2026-64954 Velociraptor collect_client() Permissions Bypass](https://docs.velociraptor.app/announcements/advisories/cve-2026-64954/): Velociraptor collect_client() Permissions Bypass - Published 2026-07-31 - [CVE-2026-64952 Velociraptor Hunt Deletion With Insufficient Permission Check](https://docs.velociraptor.app/announcements/advisories/cve-2026-64952/): Velociraptor Hunt Deletion With Insufficient Permission Check - Published 2026-07-31 - [CVE-2026-64951 Velociraptor DoS triggered by Divide by Zero panic](https://docs.velociraptor.app/announcements/advisories/cve-2026-64951/): Velociraptor DoS triggered by Divide by Zero panic - Published 2026-07-31 - [CVE-2026-19584 Velociraptor VQL injection during notebook restore from backup.](https://docs.velociraptor.app/announcements/advisories/cve-2026-19584/): Velociraptor VQL injection during notebook restore from backup. - Published 2026-07-31 - [CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries.](https://docs.velociraptor.app/announcements/advisories/cve-2026-19583/): Velociraptor Required Permissions bypass by using client monitoring queries. - Published 2026-08-15 - [CVE-2026-19200 Analyst overwrites live built-in artifacts through verify()](https://docs.velociraptor.app/announcements/advisories/cve-2026-19200/): Analyst overwrites live built-in artifacts through verify() - Published 2026-07-31 - [CVE-2026-18972 Velociraptor authenticated identity-spoofing vulnerability](https://docs.velociraptor.app/announcements/advisories/cve-2026-18972/): Velociraptor authenticated identity-spoofing vulnerability - Published 2026-07-31 - [CVE-2026-18860 Velociraptor incorrect Org deletion permissions check](https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/): Velociraptor incorrect Org deletion permissions check - Published 2026-07-31 - [CVE-2026-18652 Velociraptor STACK Type Download Path Bypasses Denied Prefix Check](https://docs.velociraptor.app/announcements/advisories/cve-2026-18652/): Velociraptor STACK Type Download Path Bypasses Denied Prefix Check - Published 2026-07-31 - [CVE-2026-18640 Velociraptor directory traversal via the NewNotebook API](https://docs.velociraptor.app/announcements/advisories/cve-2026-18640/): Velociraptor directory traversal via the NewNotebook API - Published 2026-07-31 - [CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing](https://docs.velociraptor.app/announcements/advisories/cve-2026-18639/): Velociraptor OIDC Authenticator susceptible to email spoofing - Published 2026-07-31 - [CVE-2026-18638 Velociraptor server crash via the SetPassword API](https://docs.velociraptor.app/announcements/advisories/cve-2026-18638/): Velociraptor server crash via the SetPassword API - Published 2026-07-31 - [CVE-2026-18636 Velociraptor VFSGetBuffer API path deny list bypass](https://docs.velociraptor.app/announcements/advisories/cve-2026-18636/): Velociraptor VFSGetBuffer API path deny list bypass - Published 2026-07-31 - [CVE-2026-18635 Velociraptor query plugin allows impersonation in other orgs](https://docs.velociraptor.app/announcements/advisories/cve-2026-18635/): Velociraptor query plugin allows impersonation in other orgs - Published 2026-07-31 - [CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins](https://docs.velociraptor.app/announcements/advisories/cve-2026-18348/): Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins - Published 2026-07-31 - [CVE-2026-17535 Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes](https://docs.velociraptor.app/announcements/advisories/cve-2026-17535/): Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes - Published 2026-07-31 - [CVE-2026-15371 Velociraptor Stored XSS in URL column types](https://docs.velociraptor.app/announcements/advisories/cve-2026-15371/): Velociraptor Stored XSS in URL column types - Published 2026-07-31 - [CVE-2026-8795 YAML Injection Leading to Potential Analyst Targeting](https://docs.velociraptor.app/announcements/advisories/cve-2026-8795/): A YAML injection vulnerability in the Windows.Collectors.Remapping artifact allows an attacker who … - Published 2026-05-01 - [CVE-2026-7573 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations](https://docs.velociraptor.app/announcements/advisories/cve-2026-7573/): An authorization bypass in the GetUserRoles API endpoint in Velocidex Velociraptor allows any … - Published 2026-05-01 - [CVE-2026-7572 Velociraptor EVTX Parser — Process Crash via Crafted .evtx File](https://docs.velociraptor.app/announcements/advisories/cve-2026-7572/): A parser bug in the EVTX files exists for versions before 0.76.5 allowing a local attacker to cause … - Published 2026-05-01 - [CVE-2026-6948 Unbounded Memory Allocation in VQLResponse Result-Set Writer](https://docs.velociraptor.app/announcements/advisories/cve-2026-6948/): A resource exhaustion vulnerability was identified in the Velociraptor server’s agent control … - Published 2026-04-27 - [CVE-2026-6863 HTTP Filestore Endpoints Misapply Permissions Across Organizations](https://docs.velociraptor.app/announcements/advisories/cve-2026-6863/): A cross organization authorization bypass was identified in Velociraptor’s HTTP API filestore … - Published 2026-04-27 - [Security Advisories fixed in release 0.77.2](https://docs.velociraptor.app/announcements/advisories/v0-77-2/): Velociraptor 0.77.2 release fixed a number of CVEs. - Published 2026-08-09 - [CVE-2023-0242 Insufficient Permission Check In The VQL Copy() Function](https://docs.velociraptor.app/announcements/advisories/cve-2023-0242/): Improper Privilege Management vulnerability in Rapid7 Velociraptor in the copy() function. This … - Published 2023-01-18 #### CVE-2025-14728 Velociraptor directory traversal vulnerability - [](https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/cve-2025-14728/): Published on 2025-12-29 CVSS · MEDIUM · 6.8 ⁄10 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N … #### CVE-2025-6264 Velociraptor priviledge escalation via UpdateConfig artifact - [](https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/cve-2025-6264/): Published on 2025-06-19 CVSS · MEDIUM · 5.5 ⁄10 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L … #### CVE-2025-0914 Velociraptor Shell Plugin prevent_execve bypass - [](https://docs.velociraptor.app/announcements/advisories/cve-2025-0914/cve-2025-0914/): Publishedon 2025-02-25 CVSS · LOW · 3.8⁄10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N Scoring … #### CVE-2024-10526 Local Privilege Escalation In Windows Velociraptor Service - [](https://docs.velociraptor.app/announcements/advisories/cve-2024-10526/cve-2024-10526/): Published on 2024-11-03x_open-source The Velociraptor Windows MSI installer creates the … #### CVE-2023-5950 Rapid7 Velociraptor Reflected XSS - [](https://docs.velociraptor.app/announcements/advisories/cve-2023-5950/cve-2023-5950/): Published on 2023-11-06 CVSS · HIGH · 8.6⁄10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Scoring … #### CVE-2023-2226 Velociraptor crashes while parsing some malformed PE or OLE files - [](https://docs.velociraptor.app/announcements/advisories/cve-2023-2226/cve-2023-2226/): Published on 2023-04-21 CVSS · LOW · 3.3⁄10 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Scoring … #### CVE-2023-0290 Directory Traversal In Client Id Parameter - [](https://docs.velociraptor.app/announcements/advisories/cve-2023-0290/cve-2023-0290/): Published on 2023-01-17 CVSS · HIGH · 8.1⁄10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N Scoring … #### CVE-2026-5329 Velociraptor improper input validation in client message handler - [](https://docs.velociraptor.app/announcements/advisories/cve-2026-5329/cve-2026-5329/): Published on 2026-04-08 CVSS · HIGH · 8.5 ⁄10 · … #### CVE-2026-6290 Velociraptor query() plugin misapplies permissions to orgs - [](https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/cve-2026-6290/): Published on 2026-04-15 CVSS · HIGH · 8.0 ⁄10 · CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H … ## Documentation ### What is Velociraptor? - [History](https://docs.velociraptor.app/docs/overview/history/): Velociraptor draws its inspiration from two major open source projects: Google Rapid Response: … - Published 2021-06-09 - [The Velociraptor Support Policy](https://docs.velociraptor.app/docs/overview/support/): While Velociraptor is an open source project, we do take the security and stability of the project … - [Velociraptor Security](https://docs.velociraptor.app/docs/overview/security/): Velociraptor is a very powerful platform running with very high privilege and access on many … - Published 2025-01-25 ### Deployment Overview - [Quickstart Guide](https://docs.velociraptor.app/docs/deployment/quickstart/): The goal of this guide is to help you get a Velociraptor server deployed with one or more clients, … - Published 2025-02-27 - [Organizations and Multi-tenancy](https://docs.velociraptor.app/docs/deployment/orgs/): Velociraptor supports multiple orgs in a full multi-tenancy configuration. - [Deploying Clients](https://docs.velociraptor.app/docs/deployment/clients/): How to run, and optionally install, clients on the most common platforms. - [Velociraptor Security Configuration](https://docs.velociraptor.app/docs/deployment/security/): Velociraptor is a highly privileged service with elevated access to thousands of endpoints across … - [Backups and Disaster Recovery](https://docs.velociraptor.app/docs/deployment/backups/): Strategies for backing up and restoring a Velociraptor deployment. - Published 2026-08-25 - [Server Performance and Monitoring](https://docs.velociraptor.app/docs/deployment/resources/): In this page we discuss some of the performance limitations of the platform. It is important to … - [Server Logging](https://docs.velociraptor.app/docs/deployment/logging/): Configure Velociraptor server logging to capture operational events to local files, forward them to … - [Configuration File Reference](https://docs.velociraptor.app/docs/deployment/references/): This is an annotated server.config.yaml with complete explanations for all options currently … #### Server Deployment - [Key Concepts](https://docs.velociraptor.app/docs/deployment/server/key_concepts/): Before we dive in to server deployment specifics it will be helpful to familiarize yourself with a … - Published 2025-02-27 - [Key Deployment Decisions](https://docs.velociraptor.app/docs/deployment/server/key_decisions/): Guidance on selecting the right options for your deployment. - Published 2025-04-27 - [Deployment Example](https://docs.velociraptor.app/docs/deployment/server/deployment_example/): In this example we will walk through the process of deploying the server using Let’s Encrypt … - Published 2025-02-27 - [Multi-Frontend Configuration](https://docs.velociraptor.app/docs/deployment/server/multifrontend/): Guidance on scaling your deployment and using Velociraptor’s (experimental) Multi-Frontend … - [Docker deployment](https://docs.velociraptor.app/docs/deployment/server/docker/): Run the Velociraptor server inside a Docker container, using the officially supported image from the … - Published 2026-06-21 - [Server Upgrades](https://docs.velociraptor.app/docs/deployment/server/upgrades/): How to upgrade your server. - Published 2025-02-27 #### Offline Collections - [Building Offline Collectors](https://docs.velociraptor.app/docs/deployment/offline_collections/building/): Offline collectors can be created in the GUI or using the CLI. The GUI is the recommended way to … - Published 2025-11-03 - [Running Offline Collectors](https://docs.velociraptor.app/docs/deployment/offline_collections/running/): Offline collectors can be deployed by automated means, for example via Windows Group Policy - … - Published 2025-11-03 - [Working With Offline Collection Data](https://docs.velociraptor.app/docs/deployment/offline_collections/collection_data/): As described previously, the offline collector writes it’s results into a zip archive and … - Published 2025-11-03 - [Updating Offline Collectors](https://docs.velociraptor.app/docs/deployment/offline_collections/updating/): Because offline collector binaries are usually stored separately from the server, they often get … - Published 2025-11-03 - [Troubleshooting offline collectors](https://docs.velociraptor.app/docs/deployment/offline_collections/troubleshooting/): Troubleshooting offline collectors - Published 2025-11-03 ### The Admin GUI - [User Preferences](https://docs.velociraptor.app/docs/gui/user_preferences/): Personalize your GUI experience - Published 2025-09-26 - [Customizing the GUI](https://docs.velociraptor.app/docs/gui/customizing/): Customize the GUI experience - Published 2025-09-26 - [Local Documentation Search](https://docs.velociraptor.app/docs/gui/local_docs/): Learn how to access and search local documentation in the GUI - Published 2026-03-10 - [Managing Artifacts](https://docs.velociraptor.app/docs/gui/artifacts/): How to find, manage, create and edit artifacts in the GUI - Published 2025-05-03 - [Keyboard Shortcuts](https://docs.velociraptor.app/docs/gui/keyboard_shortcuts/): Learn about keyboard shortcuts in the GUI - Published 2025-05-16 ### Managing Clients - [Searching for clients](https://docs.velociraptor.app/docs/clients/searching/): To work with a specific client, search for it using the search bar at the top of the Admin GUI. … - Published 2024-12-18 - [Client Interrogation](https://docs.velociraptor.app/docs/clients/interrogation/): Interrogation is the term we use to describe the process of querying a host for it’s basic … - Published 2024-12-29 - [Collecting Artifacts](https://docs.velociraptor.app/docs/clients/artifacts/): Velociraptor’s superpower is a powerful query language termed VQL. You might be surprised to … - Published 2021-06-09 - [Client Labels](https://docs.velociraptor.app/docs/clients/labels/): Clients can have one or more labels attached to them. In some software applications the same concept … - Published 2024-12-18 - [Client Metadata](https://docs.velociraptor.app/docs/clients/metadata/): Client metadata is an arbitrary key-value store that holds user-defined information per client. … - Published 2024-12-30 - [Host Quarantine](https://docs.velociraptor.app/docs/clients/quarantine/): For Windows and Linux clients you can quarantine the host using the Quarantine Host () button. … - Published 2024-12-24 - [The Virtual File System](https://docs.velociraptor.app/docs/clients/vfs/): Velociraptor provides an interface to interact with the client’s filesystem which we call the … - Published 2021-06-09 - [Client Shell Commands](https://docs.velociraptor.app/docs/clients/shell/): Velociraptor collects data from endpoints using artifacts which are logical containers for curated … - Published 2024-12-19 - [Client Monitoring](https://docs.velociraptor.app/docs/clients/monitoring/): We have previously seen how VQL Event Queries are simply VQL queries that never terminate, … - Published 2021-06-30 ### VQL - [VQL Fundamentals](https://docs.velociraptor.app/docs/vql/fundamentals/): Velociraptor Query Language (VQL) is the query language used across all of Velociraptor’s … - Published 2025-01-24 - [Event Queries](https://docs.velociraptor.app/docs/vql/events/): Normally a VQL query returns a result set and then terminates. For example, consider the glob() … - Published 2021-06-12 - [JOIN in VQL](https://docs.velociraptor.app/docs/vql/join/): As mentioned previously, VQL does not support the JOIN operator. If you are coming from a background … - Published 2021-06-11 - [Extending VQL](https://docs.velociraptor.app/docs/vql/extending_vql/): VQL is really a glue language - we rely on VQL plugins and functions to do all the heavy lifting. … - Published 2021-06-27 - [VQL Reference](https://docs.velociraptor.app/docs/vql/vql_reference/): This page lists all the plugins, functions and accessors which are available in Velociraptor. … - Published 2025-01-24 #### Velociraptor Artifacts - [Calling artifacts from VQL](https://docs.velociraptor.app/docs/vql/artifacts/calling/): How to call artifacts from VQL - Published 2025-05-13 - [Managing artifacts from VQL](https://docs.velociraptor.app/docs/vql/artifacts/managing/): How to manage artifacts from VQL - Published 2025-05-13 ### Velociraptor Artifacts - [Managing Artifacts](https://docs.velociraptor.app/docs/artifacts/managing/): How to create and manage artifacts - Published 2025-05-03 - [Basic Artifact Fields](https://docs.velociraptor.app/docs/artifacts/basic_fields/): The most commonly used artifact fields and how to use them. - Published 2025-01-25 - [Advanced Artifact Fields](https://docs.velociraptor.app/docs/artifacts/advanced_fields/): Artifact fields that provide more advanced functionality. - Published 2025-05-20 - [Artifact Parameters](https://docs.velociraptor.app/docs/artifacts/parameters/): Artifacts parameters and how they work - Published 2025-01-25 - [Artifact Sources](https://docs.velociraptor.app/docs/artifacts/sources/): Sources define how an artifact produces data - Published 2025-01-25 - [Artifact Preconditions](https://docs.velociraptor.app/docs/artifacts/preconditions/): Preconditions and how they work - Published 2025-01-25 - [Export & Imports](https://docs.velociraptor.app/docs/artifacts/export_imports/): Sharing VQL across sources and artifacts - Published 2025-01-25 - [Calling artifacts from VQL](https://docs.velociraptor.app/docs/artifacts/calling_artifacts/): How to call artifacts from VQL - Published 2025-05-13 - [Event Queues](https://docs.velociraptor.app/docs/artifacts/event_queues/): Artifacts that create event queues - Published 2025-01-25 - [Managing external Tools](https://docs.velociraptor.app/docs/artifacts/tools/): Defining and adding tools in artifacts - Published 2025-01-25 - [Limiting resource usage](https://docs.velociraptor.app/docs/artifacts/resources/): How to limit an artifact’s resource usage - Published 2025-05-13 - [Other use cases for artifacts](https://docs.velociraptor.app/docs/artifacts/use_cases/): Interesting use cases for artifacts - Published 2025-01-25 - [Artifact Writing Tips](https://docs.velociraptor.app/docs/artifacts/tips/): Advice for writing and testing artifacts - Published 2025-01-25 - [Artifact Reference](https://docs.velociraptor.app/docs/artifacts/artifact_reference/): Search our library of built-in artifacts - Published 2025-01-24 - [Artifact Exchange](https://docs.velociraptor.app/docs/artifacts/exchange_reference/): Search our library of community-contributed artifacts - Published 2025-01-24 #### Artifact Security ### Notebooks - [Creating Your First Notebook](https://docs.velociraptor.app/docs/notebooks/creating-your-first-notebook/): Walk through creating a notebook, adding cells, and running VQL queries step by step. - Published 2021-06-11 - [Notebook Templates](https://docs.velociraptor.app/docs/notebooks/templates/): Notebook templates let you create pre-built notebooks with ready-made content, including VQL … - Published 2025-05-13 - [Notebook Sharing and Collaboration](https://docs.velociraptor.app/docs/notebooks/sharing/): How to share and collaborate with other users using notebooks - Published 2026-04-23 ### Hunting ### Forensic Analysis - [Searching Content](https://docs.velociraptor.app/docs/forensic/searching/): A powerful DFIR technique is searching bulk data for patterns. YARA is a powerful keyword scanner … - Published 2021-06-17 - [Binary parsing](https://docs.velociraptor.app/docs/forensic/binary/): Velociraptor uses VQL to provide the flexibility for users to be able to craft a VQL query in order … - [Evidence Of Execution](https://docs.velociraptor.app/docs/forensic/evidence_of_execution/): Windows has a rich set of forensic artifacts that we can use to infer program execution. This page … - Published 2021-06-27 - [Event Logs](https://docs.velociraptor.app/docs/forensic/event_logs/): Windows event logs are a common source of evidence of malicious activity. Velociraptor supports … - Published 2021-06-27 - [Volatile machine state](https://docs.velociraptor.app/docs/forensic/volatile/): Traditional forensic analysis relies on filesystem artifacts. However, one of the best advantages of … - Published 2021-06-27 #### Searching Filesystems - [Velociraptor Paths](https://docs.velociraptor.app/docs/forensic/filesystem/paths/): In DFIR we often talk about paths and filesystems. However, these are usually more complex than they … - Published 2024-04-11 - [Remapping Accessors](https://docs.velociraptor.app/docs/forensic/filesystem/remapping/): VQL queries interact with the world via a well defined sandbox. This page describes how remapping … - Published 2024-04-11 - [NTFS Analysis](https://docs.velociraptor.app/docs/forensic/filesystem/ntfs/): NTFS is the standard Windows filesystem. Velociraptor contains powerful NTFS analysis capabilities. - Published 2021-06-26 #### Dead Disk Analysis - [Creating a remapping config and running a dead disk client](https://docs.velociraptor.app/docs/forensic/deaddisk/creating_running/): Creating a remapping config and running a dead disk client - Published 2025-12-01 ### File Acquisition - [Bulk File Acquisition](https://docs.velociraptor.app/docs/file_collection/bulk/): Being able to quickly and efficiently collect and preserve file-based evidence at scale is an … - Published 2025-11-01 - [VFS Uploads](https://docs.velociraptor.app/docs/file_collection/vfs/): In Velociraptor, the Virtual File System (VFS) browser provides a server-side cached view of an … - Published 2025-11-01 - [Collections and File Acquisition over SSH](https://docs.velociraptor.app/docs/file_collection/ssh/): The ssh accessor can be used to read filesystems on remote hosts over SSH - Published 2025-11-06 - [Exporting Bulk File Collections](https://docs.velociraptor.app/docs/file_collection/exporting/): As described in the accessing file uploads on the server section, file uploads can be individually … - Published 2025-11-06 ### Server Automation - [The Velociraptor API](https://docs.velociraptor.app/docs/server_automation/server_api/): Velociraptor can be fully controlled by external programs using the Velociraptor API. In this page … - Published 2021-06-30 - [Server Monitoring](https://docs.velociraptor.app/docs/server_automation/server_monitoring/): Server Monitoring We have previously seen the VQL Event Queries are simply VQL queries that never … - Published 2021-06-30 ### The Velociraptor CLI - [Global CLI flags](https://docs.velociraptor.app/docs/cli/flags/): CLI flags that are available for all commands. - Published 2025-05-20 - [Autoexec mode](https://docs.velociraptor.app/docs/cli/autoexec/): Autoexec mode lets you embed a default command line and custom artifacts directly into the … - Published 2026-06-16 - [Run mode syntax](https://docs.velociraptor.app/docs/cli/run/): Run mode (-r or –run flag) provides a simpler syntax for running Velociraptor collections on … - Published 2026-06-16 #### Commands - [The "acl" command group](https://docs.velociraptor.app/docs/cli/commands/acl/): Manipulate ACLs (access control lists). - Published 2025-05-20 - [The "artifacts" command group](https://docs.velociraptor.app/docs/cli/commands/artifacts/): Commands for working with artifacts - Published 2025-05-13 - [The "collector" command](https://docs.velociraptor.app/docs/cli/commands/collector/): Build an offline collector - Published 2025-05-20 - [The "config" command group](https://docs.velociraptor.app/docs/cli/commands/config/): Commands for working with the config - Published 2025-05-20 - [The "deaddisk" command](https://docs.velociraptor.app/docs/cli/commands/deaddisk/): Create a deaddisk configuration - Published 2025-05-20 - [The "fs" command group](https://docs.velociraptor.app/docs/cli/commands/fs/): Run filesystem commands. - Published 2025-05-20 - [The "fuse" command](https://docs.velociraptor.app/docs/cli/commands/fuse/): Mount collection containers on folders. - Published 2025-05-20 - [The "pool_client" command](https://docs.velociraptor.app/docs/cli/commands/pool_client/): Run a pool client for load testing - Published 2026-09-08 - [The "query" command](https://docs.velociraptor.app/docs/cli/commands/query/): Run VQL queries on the command line. - Published 2025-07-05 - [The "server_service" command group](https://docs.velociraptor.app/docs/cli/commands/server_service/): Manipulate the Velociraptor server service on Windows. - Published 2025-05-20 - [The "service" command group](https://docs.velociraptor.app/docs/cli/commands/service/): Manipulate the Velociraptor client service on Windows and macOS. - Published 2025-05-20 - [The "tools" command group](https://docs.velociraptor.app/docs/cli/commands/tools/): Commands for working with the tools inventory. - Published 2025-05-20 - [The "user" command group](https://docs.velociraptor.app/docs/cli/commands/user/): Commands for working with users - Published 2025-05-20 - [Miscellaneous commands](https://docs.velociraptor.app/docs/cli/commands/misc/): All other commands not previously covered. - Published 2025-05-20 ### Troubleshooting Guide - [VQL Issues](https://docs.velociraptor.app/docs/troubleshooting/vql/): Advice for basic troubleshooting of VQL queries. - Published 2025-02-20 #### Deployment Issues - [Server Deployment Issues](https://docs.velociraptor.app/docs/troubleshooting/deployment/server/): Troubleshooting problems with getting the server running. - Published 2025-02-17 - [Client Deployment Issues](https://docs.velociraptor.app/docs/troubleshooting/deployment/client/): Troubleshooting problems with getting clients running. - Published 2025-02-17 - [Offline Collector Issues](https://docs.velociraptor.app/docs/troubleshooting/deployment/offline_collector/): Troubleshooting issues when creating or running a Velociraptor offline collector. - Published 2025-02-17 #### Operational Issues - [Troubleshooting Server Operational Issues](https://docs.velociraptor.app/docs/troubleshooting/operations/server_ops/): Troubleshooting issues occurring on an operational server. - Published 2025-02-20 - [Troubleshooting Remote Client Issues](https://docs.velociraptor.app/docs/troubleshooting/operations/remote_clients/): How to troubleshoot client issues when you don’t have local access to the client. - Published 2021-06-30 - [Collection and Hunt Issues](https://docs.velociraptor.app/docs/troubleshooting/operations/collections_hunts/): Troubleshooting Collections and Hunts. - Published 2026-05-18 #### Debugging Velociraptor ##### Internal - [Metrics](https://docs.velociraptor.app/docs/troubleshooting/debugging/internal/metrics/): Metrics are counters in the program that are used to collect high level statistics about program … - [Golang](https://docs.velociraptor.app/docs/troubleshooting/debugging/internal/go_profiles/): These show the built in Golang profiles. These profiles provide detailed instrumentation of the … ##### Client - [Monitoring](https://docs.velociraptor.app/docs/troubleshooting/debugging/client/client_monitoring/): The client monitoring profile shows current information on the client event monitoring subsystem. … - [Flows](https://docs.velociraptor.app/docs/troubleshooting/debugging/client/client_flows/): The Client Flows profile shows information about currently executing collections on the endpoint. It … ##### Global ###### Datastore - [Replication](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/datastore/replication/): Reports current replication connections between master and minion. ###### Services - [ExportContainers](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/export/): The Velociraptor GUI allows exporting collections from Flows or Hunts into a Zip file. If the … - [Throttler](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/throttler/): An important criteria for Velociraptor is to ensure the impact on endpoint performance is limited. … - [User Manager](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/user_manager/): - [Open-close](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/open_close/): Similarly to tempfiles, it is important to know what files we have opened that should be closed. … - [tempfiles](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/tempfiles/): Velociraptor uses temporary files for a variety is purposes. It is important to ensure that whenever … - [worker](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/services/worker/): Notebooks are very useful feature of the server allowing for complex post-processing of collected … ###### VQL ####### Queries - [Active Queries](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/queries/active_queries/): This view shows the queries currently running in this process. For example queries will run as part … - [Plugin Monitor](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/queries/plugin_monitor/): At their core VQL queries process rows emitted from VQL plugins. We have seen previously the Active … - [Recent Queries](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/queries/recent_queries/): The Recent Queries profile similarly shows all recent queries (even after they completed). This … ####### Plugins - [ETW](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/etw/): This profile shows the current state of the ETW subsystem on Windows. We can see what providers … - [Glob](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/glob/): Velociraptor is often used to search for files. This is commonly done using the glob() plugin. This … - [NTFS Cache](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/ntfs/): - [Sigma Tracker](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/sigma/): Velociraptor has a built in Sigma rule evaluator, implemented with the sigma() plugin. Sigma is an … - [Windows Event Log Watcher](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/windows_event/): The Windows Event Logs contain windows events from various sources. Velociraptor implements a parser … - [Zip](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/zip/): - [Process Tracker](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/process/): - [Sqlite](https://docs.velociraptor.app/docs/troubleshooting/debugging/global/vql/plugins/sqlite/): SQLite files are used widely to store data in a structured file. We parse SQLite files using the … ##### Org ###### Services - [Broadcast](https://docs.velociraptor.app/docs/troubleshooting/debugging/org/services/broadcast_service/): Track generators installed via the generator() plugin. - [QueueManager](https://docs.velociraptor.app/docs/troubleshooting/debugging/org/services/queue_manager/): Report the current states of server artifact event queues. - [VFS](https://docs.velociraptor.app/docs/troubleshooting/debugging/org/services/vfs_service/): The VFS service post processes results from VFS operations. - [Notifier](https://docs.velociraptor.app/docs/troubleshooting/debugging/org/services/notifier/): Information about directly connected clients. ## Downloads - [Downloads](https://docs.velociraptor.app/downloads/previous_downloads/): Velociraptor is open source software and is free for anyone to use under the AGPL License. This page … - Published 2021-06-23 - [Release Candidates](https://docs.velociraptor.app/downloads/rc_downloads/): This is the release candidate. It is available for testing. For production use, please check out the … - Published 2021-06-23 ## VQL Reference ### Frequently Used ✨ ### Windows-only ### Linux-only ### Server-only ### Parsers ### Encode/Decode ### Event Plugins ### Experimental ### Developer ### Other ### Accessors ## Velociraptor Blog - [Cobalt Strike payload discovery and data manipulation in VQL](https://docs.velociraptor.app/blog/2021/2021-11-09-vql-data-manipulation/): Velociraptor’s ability for data manipulation is a core platform capability that drives a lot of the … - Published 2021-11-09 - [Velociraptor vs Printnightmare](https://docs.velociraptor.app/blog/2021/2021-07-12-velociraptor-vs-printnightmare/): Hunting a Zero day! Velociraptor is an advanced open source endpoint visibility framework based on a … - Published 2021-07-11 - [Detection Engineering](https://docs.velociraptor.app/blog/2024/2024-05-09-detection-engineering/): Note This post accompanies the presentation Advances in Detection Engineering presented at the … - Published 2024-05-08 - [The Registry Hunter](https://docs.velociraptor.app/blog/2024/2024-04-12-registry-hunter/): As DFIR practitioners, the Windows registry is a treasure trove of information. The Windows registry … - Published 2024-04-11 - [Velociraptor 0.77 Release](https://docs.velociraptor.app/blog/2026/2026-05-31-release-notes-0.77/): I am very excited to announce that the latest Velociraptor release 0.77 RC1 is now available for … - Published 2026-05-31 - [Alerts and e-mail notifications in Velociraptor](https://docs.velociraptor.app/blog/2026/2026-04-19-alerts-and-email/): Velociraptor does a lot in the background. Client and server event queries run continuously. Hunts … - Published 2026-05-10 - [Velociraptor CLI](https://docs.velociraptor.app/blog/2026/2026-03-21-cli/): Digital forensics has always been a fast evolving field with newly researched techniques announced … - Published 2026-03-21 - [Velociraptor 0.76 Release](https://docs.velociraptor.app/blog/2026/2026-03-10-release-notes-0.76/): I am very excited to announce that the latest Velociraptor release 0.76 is now available. In this … - Published 2026-03-10 - [Memory Analysis with Velociraptor - Part 2](https://docs.velociraptor.app/blog/2025/2025-12-22-memory-analysis-pt2/): In Memory Analysis with Velociraptor - Part 1 we looked at how to access the RAM with Velociraptor. … - Published 2025-12-22 - [Memory Analysis with Velociraptor - Part 1](https://docs.velociraptor.app/blog/2025/2025-11-15-memory-analysis-pt1/): This post was spurred by the recent release of the Windows.Memory.Mem2Disk artifact, written by … - Published 2025-11-14 - [Adaptive Collections with Velociraptor](https://docs.velociraptor.app/blog/2025/2025-09-28-adaptive-collections/): I recently joined the great folks at Cyber Triage on a webinar to explore the new CyberTriage … - Published 2025-08-30 - [Velociraptor 0.75 Release](https://docs.velociraptor.app/blog/2025/2025-08-30-release-notes-0.75/): I am very excited to announce that the latest Velociraptor release 0.75 is now available. In this … - Published 2025-08-30 - [Velociraptor 0.74 Release](https://docs.velociraptor.app/blog/2025/2025-02-23-release-notes-0.74/): I am very excited to announce that the latest Velociraptor release 0.74 is now in the release … - Published 2025-02-10 - [Developing Sigma Rules in Velociraptor](https://docs.velociraptor.app/blog/2025/2025-02-02-sigma/): Upcoming release 0.74 This post discusses some features that will be available in the upcoming 0.74 … - Published 2025-02-02 - [Timelines in Velociraptor](https://docs.velociraptor.app/blog/2024/2024-09-12-timelines/): New feature This feature is available in the 0.73 release. You can Download it and provide valuable … - Published 2024-09-12 - [Velociraptor 0.73 Release](https://docs.velociraptor.app/blog/2024/2024-09-10-release-notes-0.73/): I am very excited to announce that the latest Velociraptor release 0.73 is available for download. … - Published 2024-09-10 - [How to use your own certificates to secure your Velociraptor deployment](https://docs.velociraptor.app/blog/2024/2024-07-22-how-to-use-your-own-certificates/): This article was reproduced with permission from reliancecyber.com. It outlines some of the … - Published 2024-07-16 - [Velociraptor 0.72 Release](https://docs.velociraptor.app/blog/2024/2024-03-10-release-notes-0.72/): I am very excited to announce that the latest Velociraptor release 0.72 is now available. You can … - Published 2024-03-10 - [Velociraptor 0.7.1 Release](https://docs.velociraptor.app/blog/2023/2023-11-15-release-notes-0.7.1/): I am very excited to announce that the latest Velociraptor release 0.7.1 is now LIVE! In this post I … - Published 2023-11-15 - [Sigma In Velociraptor](https://docs.velociraptor.app/blog/2023/2023-11-15-sigma_in_velociraptor/): This page discusses how Sigma is implemented and used within Velociraptor. What is Sigma? Detection … - Published 2023-10-15 - [Velociraptor 0.7.0 Release](https://docs.velociraptor.app/blog/2023/2023-07-27-release-notes-0.7.0/): I am very excited to announce the latest Velociraptor release 0.7.0 is now released. In this post I … - Published 2023-07-27 - [Velociraptor 0.6.9 Release](https://docs.velociraptor.app/blog/2023/2023-05-05-release-notes-0.6.9/): I am very excited to announce the latest Velociraptor release 0.6.9 is now LIVE and available for … - Published 2023-05-05 - [Automating Qakbot decode at scale](https://docs.velociraptor.app/blog/2023/2023-04-05-qakbot/): This is a technical post covering practical methodology to extract configuration data from recent … - Published 2023-04-05 - [The Velociraptor annual community survey](https://docs.velociraptor.app/blog/2023/2023-04-03-velociraptor-survey/): Velociraptor is an open source project led and shaped by the community. Over the years, Velociraptor … - Published 2023-04-01 - [Velociraptor 0.6.8 Release](https://docs.velociraptor.app/blog/2023/2023-02-13-release-notes-0.6.8/): I am very excited to announce the latest Velociraptor release 0.6.8 is now live. This release has … - Published 2023-02-13 - [Tracking an adversary in real-time using Velociraptor](https://docs.velociraptor.app/blog/2023/2023-01-13-tracking-an-adversary-in-realtime/): As an incident responder that is fighting an adversary, you typically want to be alerted the moment … - Published 2023-01-09 - [Velociraptor 0.6.7 Release](https://docs.velociraptor.app/blog/2022/2022-11-21-release-notes/): I am very excited to announce the latest Velociraptor release 0.6.7 is now out. This release has … - Published 2022-11-19 - [The Velociraptor process tracker](https://docs.velociraptor.app/blog/2022/2022-08-17-process-tracker/): One of the advantages of running Velociraptor on the endpoint constantly is the ability to monitor … - Published 2022-09-07 - [Velociraptor 0.6.6 Release](https://docs.velociraptor.app/blog/2022/2022-08-15-release-notes/): I am very excited to announce the latest Velociraptor release 0.6.6 is now out. This release has … - Published 2022-09-07 - [Post-processing Collections](https://docs.velociraptor.app/blog/2022/2022-08-04-post-processing/): Traditionally the digital forensic process consists of several distinct phases: The collection or … - Published 2022-08-03 - [Velociraptor 0.6.5 Release](https://docs.velociraptor.app/blog/2022/2022-06-21-release-notes/): I am very excited to announce the latest Velociraptor release 0.6.5. This release has been in the … - Published 2022-06-21 - [Velociraptor 0.6.4 Release](https://docs.velociraptor.app/blog/2022/2022-03-23-release-notes/): I am very excited to announce the latest Velociraptor release 0.6.4. This release has been in the … - Published 2022-04-21 - [Dead disk Forensics](https://docs.velociraptor.app/blog/2022/2022-03-22-deaddisk/): Velociraptor’s killer feature is its VQL language making it possible to write powerful queries … - Published 2022-03-20 - [Paths and filesystem accessors](https://docs.velociraptor.app/blog/2022/2022-03-21-paths/): Note This article discusses a feature available since 0.6.4 release. Path handling is fundamental … - Published 2022-03-20 - [WMI Event Consumers: what are you missing?](https://docs.velociraptor.app/blog/2022/2022-01-12-wmi-eventing/): WMI Eventing is a fairly well known technique in DFIR, however some tools may not provide the … - Published 2022-01-12 - [Searching for files](https://docs.velociraptor.app/blog/2022/2022-01-05-searching-for-files-on-linux/): Tip This article discusses new features appearing in Velociraptor’s 0.6.3 release. Earlier … - Published 2022-01-05 - [Velociraptor 0.6.3 Release](https://docs.velociraptor.app/blog/2022/2022-01-05-release-notes-0.6.3/): I am very excited to announce the latest Velociraptor release 0.6.3. This release has been in the … - Published 2022-01-05 - [SFTP in AWS](https://docs.velociraptor.app/blog/2021/2021-12-11-sftp-in-aws/): Many people use Velociraptor’s offline collector feature to collect any artifacts without … - Published 2021-12-20 - [EQL to VQL - Leverage EQL based detection rules in Velociraptor](https://docs.velociraptor.app/blog/2021/2021-11-09-eql2vql/): Outdated content This article describes a threat detection approach that has since been superseded … - Published 2021-11-09 - [A Closer Look at the Winning Entry in the 2021 Velociraptor Contributor Competition](https://docs.velociraptor.app/blog/2021/2021-10-22-a-closer-look-at-the-winning-entry-in-the-2021-velociraptor-contributor-competition-575c387610af/): On Friday October 9 the Velociraptor team crowned the grand prize winner in our 2021 Contributor … - Published 2021-10-20 - [The 2021 Contributor Contest](https://docs.velociraptor.app/blog/2021/2021-10-08-contributor-contest/): The 2021 Velociraptor Contributor Competition has drawn to a close and this year we have received 6 … - Published 2021-10-12 - [Welcome to Velociraptor, Carlos](https://docs.velociraptor.app/blog/2021/2021-09-17-carlos-intro/): Hello Velociraptor Community! My name is Carlos Canto and I have recently joined Rapid7 as the … - Published 2021-09-17 - [Velociraptor 0.6.1 Release](https://docs.velociraptor.app/blog/2021/2021-09-07-release-notes-0.6.1/): I am very excited to announce the latest Velociraptor release 0.6.1. This release has been in the … - Published 2021-09-06 - [ETW Part 2: Process Parent Spoofing](https://docs.velociraptor.app/blog/2021/2021-09-03-process-spoofing/): Process Parent Spoofing A lot of the current state of the art detection techniques rely on process … - Published 2021-09-03 - [Event Tracing for Windows Part 1](https://docs.velociraptor.app/blog/2021/2021-08-18-velociraptor-and-etw/): Digging into Windows Internals One of the most important aspects of modern operating systems is … - Published 2021-09-02 - [Carving $USN journal entries](https://docs.velociraptor.app/blog/2021/2021-06-16-carving-usn-journal-entries-72d5c66971da/): Digging even deeper! One of the most important tasks in DFIR is reconstructing past filesystem … - Published 2021-06-16 - [Verifying executables on Windows](https://docs.velociraptor.app/blog/2021/2021-06-09-verifying-executables-on-windows-1b3518122d3c/): How do we know if a windows executable is a legitimate program written by the purported developer … - Published 2021-06-09 - [Scaling Velociraptor](https://docs.velociraptor.app/blog/2021/2021-04-29-scaling-velociraptor-57acc4df76ed/): Hunting at scale Velociraptor is an endpoint visibility tool designed to query a large number of … - Published 2021-04-29 - [The Next Phase of Velociraptor](https://docs.velociraptor.app/blog/2021/2021-04-21-the-next-phase-of-velociraptor-bf696c2c3491/): We’ve made great strides on our journey to make the Velociraptor vision come true. We’ve built an … - Published 2021-04-21 - [Digging into process memory](https://docs.velociraptor.app/blog/2021/2021-04-16-digging-into-process-memory-33c60a640cdb/): Unlike traditional dead disk forensic tools, Velociraptor’s main advantage is that it is capable of … - Published 2021-04-16 - [Digging for files with Velociraptor](https://docs.velociraptor.app/blog/2021/2021-02-13-digging-for-files-with-velociraptor-a1c0a21e242b/): One of the most common questions in digital forensics is: Is a file with a specific filename … - Published 2021-02-13 - [Migrating from OSQuery to Velociraptor](https://docs.velociraptor.app/blog/2021/2021-02-03-migrating-from-osquery-to-velociraptor-d4143799953f/): Tips for the journey OSQuery has been around for a while now, and was actually the initial … - Published 2021-02-03 - [Detecting DLL Hijacking With VQL](https://docs.velociraptor.app/blog/2021/2021-02-02-detecting-dll-hijacking-with-vql-e9a735354257/): One of my favorite pastime is reading Twitter and following other security researchers. I love being … - Published 2021-02-02 - [Disabled Event Log files](https://docs.velociraptor.app/blog/2021/2021-01-29-disabled-event-log-files-a3529a08adbe/): Detecting malicious activity with Velociraptor Windows information security techniques are heavily … - Published 2021-01-29 - [Concurrent VQL](https://docs.velociraptor.app/blog/2021/2021-01-22-concurrent-vql-6d381fdb0b1f/): Velociraptor’s special source is really the Velociraptor Query Language (VQL). Using VQL allows … - Published 2021-01-22 - [Parsing binary files](https://docs.velociraptor.app/blog/2021/2021-01-19-parsing-binary-files-d31114a41f14/): During the course of our DFIR work, we typically need to extract some information from endpoints … - Published 2021-01-19 - [Slack and Velociraptor](https://docs.velociraptor.app/blog/2020/2020-12-26-slack-and-velociraptor-b63803ba4b16/): Photo by Joan Gamell on Unsplash Photo by Joan Gamell on Unsplash You might have heard of Slack — a … - Published 2020-12-26 - [Velociraptor and OSQuery](https://docs.velociraptor.app/blog/2020/2020-12-13-velociraptor-and-osquery-2a4306dd23c/): One of our favorite tools for endpoint visibility is OSQuery. OSQuery has really transformed the … - Published 2020-12-13 - [The Windows USN Journal](https://docs.velociraptor.app/blog/2020/2020-11-13-the-windows-usn-journal-f0c55c9010e/): Thanks to Matt Green for discussions, ideas and code…. NTFS is the default filesystem on Windows … - Published 2020-11-12 - [Velociraptor Communications](https://docs.velociraptor.app/blog/2020/2020-09-28-velociraptor-network-communications-30568624043a/): You might have heard that Velociraptor allows you to quickly query endpoint state for rapid … - Published 2020-09-27 - [Velociraptor SSO Authentication](https://docs.velociraptor.app/blog/2020/2020-08-17-velociraptor-sso-authentication-6dd68d46dccf/): The Velociraptor GUI allows administrators and DFIR team members to rapidly respond and hunt across … - Published 2020-08-16 - [Profiling the beast](https://docs.velociraptor.app/blog/2020/2020-08-16-profiling-the-beast-58913437fd16/): Photo by Daniel Cheung on Unsplash Photo by Daniel Cheung on Unsplash You might have previously … - Published 2020-08-16 - [Triage with Velociraptor — Pt 4](https://docs.velociraptor.app/blog/2020/2020-07-14-triage-with-velociraptor-pt-4-cf0e60810d1e/): Velociraptor is a great tool for collecting Artifacts such as files and other state information from … - Published 2020-07-14 - [Velociraptor in the tool age](https://docs.velociraptor.app/blog/2020/2020-07-13-velociraptor-in-the-tool-age-d896dfe71b9/): Velociraptor is a powerful endpoint visibility tool. It has plugins and parsers for many file … - Published 2020-07-13 - [The Velociraptor Query Language Pt 2](https://docs.velociraptor.app/blog/2020/2020-06-19-the-velociraptor-query-language-pt-2-fe92bb7aa150/): In our previous article I introduced the basics of the Velociraptor Query Language (VQL). We have … - Published 2020-06-19 - [The Velociraptor Query Language Pt 1](https://docs.velociraptor.app/blog/2020/2020-06-14-the-velociraptor-query-language-pt-1-d721bff100bf/): Velociraptor’s query language is central to the operation of Velociraptor. We find it being used in … - Published 2020-06-14 - [Velociraptor](https://docs.velociraptor.app/blog/2020/2020-04-16-velociraptor-e48a47e0317d/): This is an introductory article explaining the rationale behind Velociraptor’s design and … - Published 2020-04-16 - [Velociraptor’s ACL model](https://docs.velociraptor.app/blog/2020/2020-03-29-velociraptors-acl-model-7f497575daee/): Velociraptor is a very powerful tool with a great deal of privileged access to many endpoints. … - Published 2020-03-29 - [Velociraptor notebooks](https://docs.velociraptor.app/blog/2020/2020-03-28-velociraptor-notebooks-d02e0bd11230/): Velociraptor is a great tool for collecting endpoint state easily and efficiently. It is so … - Published 2020-03-28 - [Extending VQL plugins](https://docs.velociraptor.app/blog/2020/2020-03-07-extending-vql-plugins-7fb004cb6ec4/): Velociraptor is a unique endpoint visibility tool because it provides the ability for users to … - Published 2020-03-07 - [Velociraptor Post-processing with Jupyter Notebook and Pandas](https://docs.velociraptor.app/blog/2020/2020-03-06-velociraptor-post-processing-with-jupyter-notebook-and-pandas-8a344d05ee8c/): Velociraptor is a powerful endpoint visibility tool. The unique strength of the tool is being able … - Published 2020-03-06 - [Hunting Malware using Mutants](https://docs.velociraptor.app/blog/2020/2020-01-12_hunting-malware-using-mutants-ea08e86dfc19/): By Mike Cohen Recently Velociraptor has gained some interesting process analysis features. This is … - Published 2020-01-12 - [Digging into the System Resource Usage Monitor (SRUM)](https://docs.velociraptor.app/blog/2019/2019-12-31_digging-into-the-system-resource-usage-monitor-srum-afbadb1a375/): Uncovering history with Velociraptor By Mike Cohen Commonly in many incident response scenarios we … - Published 2019-12-31 - [Velociraptor to Elasticsearch](https://docs.velociraptor.app/blog/2019/2019-12-08-velociraptor-to-elasticsearch-3a9fc02c6568/): Taking your data elsewhere… Since release 0.3.5 Velociraptor includes an Elastic VQL plugin plus two … - Published 2019-12-08 - [Recovering deleted NTFS Files with Velociraptor](https://docs.velociraptor.app/blog/2019/2019-11-15_recovering-deleted-ntfs-files-with-velociraptor-1fcf09855311/): By Mike Cohen On a recent engagement we responded to an intrusion where the attacker has added a new … - Published 2019-11-15 - [Windows Event Logs](https://docs.velociraptor.app/blog/2019/2019-11-12_windows-event-logs-d8d8e615c9ca/): By Mike Cohen One of the most critical sources of data when responding to an incident on windows … - Published 2019-11-12 - [Triage with Velociraptor — Pt 3](https://docs.velociraptor.app/blog/2019/2019-10-08_triage-with-velociraptor-pt-3-d6f63215f579/): By Mike Cohen This is the final part of this three part series of articles describing how to use … - Published 2019-10-08 - [Triage with Velociraptor — Pt 2](https://docs.velociraptor.app/blog/2019/2019-10-04_triage-with-velociraptor-pt-2-d0f79066ca0e/): By Mike Cohen In the previous part of this series of articles we saw how Velociraptor can be used to … - Published 2019-10-04 - [Triage with Velociraptor — Pt 1](https://docs.velociraptor.app/blog/2019/2019-10-02_triage-with-velociraptor-pt-1-253f57ce96c0/): By Mike Cohen This is part 1 of the 3 part series focused around triaging and file collection. … - Published 2019-10-02 - [Velociraptor’s client side buffer](https://docs.velociraptor.app/blog/2019/2019-09-11_velociraptor-s-client-side-buffer-3ce03697a4e6/): By Mike Cohen The recent Velociraptor release (0.3.3) features a client side buffer. What does this … - Published 2019-09-11 - [Agentless hunting with Velociraptor](https://docs.velociraptor.app/blog/2019/2019-03-02/): There has been a lot of interest lately in Agentless hunting especially using PowerShell. There are … - Published 2019-03-02 ## Artifact Exchange - [Alert.Windows.EVTX.PowerPickHostVersion](https://docs.velociraptor.app/exchange/artifacts/pages/powerpickhostversion/): This artifact by itself only indicates that the PowerPick tool may have been invoked on the client. … - [Custom.MacOS.Detection.DylibHijacking](https://docs.velociraptor.app/exchange/artifacts/pages/custom.macos.detection.dylibhijacking/): This artifact is intended to alert on executables susceptible to dylib injection and highjacking. … - [CyberTriage.Collector](https://docs.velociraptor.app/exchange/artifacts/pages/cybertriagecollector/): Runs the Cyber Triage (https://cybertriage.com) Collector to copy forensic artifacts for automated … - [Detection.Application.CursedChrome](https://docs.velociraptor.app/exchange/artifacts/pages/detection.application.cursedchrome/): Detects the Cursed Chrome extension. Starts by searching for permissive extensions configured within … - [Docker.Image.Export](https://docs.velociraptor.app/exchange/artifacts/pages/docker.image.export/): Uses the Docker UNIX socket to export a Docker image to a tempfile and upload to Velociraptor. … - [Exchange.Label.User](https://docs.velociraptor.app/exchange/artifacts/pages/exchange.label.user/): This artifact watches for new client enrollments and automatically label the client with the … - [Exchange.Linux.Kunai](https://docs.velociraptor.app/exchange/artifacts/pages/linux.kunai/): Kunai is a Linux-based security monitoring and threat hunting tool written in Rust. This artifact … - [Exchange.Server.Enrichment.Gimphash](https://docs.velociraptor.app/exchange/artifacts/pages/exchange.server.enrichment.gimphash/): Calculate the Gimphash for a Golang binary. See: https://github.com/NextronSystems/gimphash This … - [Exchange.Windows.EventLogs.Hayabusa.Takajo](https://docs.velociraptor.app/exchange/artifacts/pages/exchange.windows.eventlogs.hayabusa.takajo/): [Takajo] (https://github.com/Yamato-Security/takajo) is a fast forensics analyzer for Hayabusa … - [Exchange.Windows.System.PowerShell.DetectResponder](https://docs.velociraptor.app/exchange/artifacts/pages/exchange.windows.system.powershell.detectresponder/): This artifact allows to detect responder in the environment … - [FreeBSD.Sys.Utx](https://docs.velociraptor.app/exchange/artifacts/pages/freebsd.sys.utx/): Parse the utx file of the system (similar to wtmp on Linux). This covers user sessions, boots, … - [Generic.Applications.ZeroTier](https://docs.velociraptor.app/exchange/artifacts/pages/generic.applications.zerotier/): Collects ZeroTier installation artefacts from the client file system without requiring the ZeroTier … - [Generic.Client.ADStatus](https://docs.velociraptor.app/exchange/artifacts/pages/generic.client.adstatus/): Get Active Directory join status from a computer. DomainJoined (boolean) and Domain (uppercase) are … - [Generic.Client.Defender.Health](https://docs.velociraptor.app/exchange/artifacts/pages/generic.client.defender.health/): Get Microsoft Defender for Endpoint (MDATP) health and configuration. MDATP is Microsoft’s EDR … - [Generic.Client.HW.Identification](https://docs.velociraptor.app/exchange/artifacts/pages/generic.client.hw.identification/): Extract product serial and other identification strings from the system. One column SystemInfo is … - [Generic.Collection.UAC](https://docs.velociraptor.app/exchange/artifacts/pages/generic.collection.uac/): This artifact leverages UAC (Unix-like Artifacts Collector) to collect artifacts from Unix-like … - [Generic.CommonLogFormat.AccessLogs](https://docs.velociraptor.app/exchange/artifacts/pages/generic.commonlogformat.accesslogs/): Parses Apache access logs to extract detailed request information. name: … - [Generic.Detection.Confluence_CVE_2023_22527](https://docs.velociraptor.app/exchange/artifacts/pages/confluence_cve_2023_22527/): This artifact detects evidence of exploitation of Confluence RCE CVE-2023-22527. The artifact checks … - [Generic.Detection.EffluenceWebshell](https://docs.velociraptor.app/exchange/artifacts/pages/effluencewebshell/): This artifact detects Effluence Webshell observed deployed during exploitation of Atlassian … - [Generic.Detection.log4jRCE](https://docs.velociraptor.app/exchange/artifacts/pages/log4jrce/): Detection for exploitation attempts against log4j RCE vulnerability CVE-2021-44228. By default this … - [Generic.Detection.LunasecLog4shell](https://docs.velociraptor.app/exchange/artifacts/pages/generic.detection.lunaseclog4shell/): Uses the Log4Shell scanner of Lunasec to scan the file systems of all drives of the host for any … - [Generic.Detection.ManageEngineLog](https://docs.velociraptor.app/exchange/artifacts/pages/manageenginelog/): This artifact will enable discovery of logs associated with observed exploitation of critical … - [Generic.Detection.WebShells](https://docs.velociraptor.app/exchange/artifacts/pages/generic.detection.webshells/): This artifact looks for evidence of a web shell being present on the system. It targets Windows and … - [Generic.Detection.Yara.SSH](https://docs.velociraptor.app/exchange/artifacts/pages/sshyara/): This is a server artifact that enables running Generic.Detection.Yara.Glob over ssh. This artifact … - [Generic.Events.TrackNetworkConnections](https://docs.velociraptor.app/exchange/artifacts/pages/generic.events.tracknetworkconnections/): This artifact is meant for monitoring network connections on clients. It periodically queries the … - [Generic.File.LineScan.RegexHunter](https://docs.velociraptor.app/exchange/artifacts/pages/generic.file.linescan.regexhunter/): A versatile artifact that scans the contents of text files line by line and reports any line that … - [Generic.Forensics.CyLR](https://docs.velociraptor.app/exchange/artifacts/pages/generic.forensics.cylr/): Uses CyLR tool to do live forensic on the host. Note this requires syncing the CyLR binary from the … - [Generic.Forensics.VMWareInventory](https://docs.velociraptor.app/exchange/artifacts/pages/generic.forensics.vmwareinventory/): Finds and parses VMware VM configuration files (.vmx) on Mac and Windows. It turns text into an … - [Generic.VSCode.Extensions](https://docs.velociraptor.app/exchange/artifacts/pages/generic.vscode.extensions/): List all installed Visual Studio code extensions This artifact lists all installed VS Code … - [HashRunKeys](https://docs.velociraptor.app/exchange/artifacts/pages/hash_run_keys/): Iterate over all the run keys and locate their binary then hash it. Tags: #windows #registry … - [IPCheck.Virustotal](https://docs.velociraptor.app/exchange/artifacts/pages/ipcheck.virustotal/): Submit a IP to Virustotal. Default Public API restriction is 4 requests/min (Inspired on Virustotal … - [IRIS.Sync.Asset](https://docs.velociraptor.app/exchange/artifacts/pages/iris.sync.asset/): Synchronizes client information from Velociraptor to DFIR-IRIS. Parses available information from … - [IRIS.Timeline.Add](https://docs.velociraptor.app/exchange/artifacts/pages/iris.timeline.add/): Adds Velociraptor rows as timeline entries to DFIR-IRIS. Links the assets and IOCs as specified in … - [Label.DomainController](https://docs.velociraptor.app/exchange/artifacts/pages/label.domaincontroller/): This artifact watches for completion of the watchArtifact and assigns the given setLabel if the … - [Linux.Applications.Docker.Ps](https://docs.velociraptor.app/exchange/artifacts/pages/linux.applications.docker.ps/): Get Docker containers by connecting to the docker.socket. Same as running docker ps name: … - [Linux.Applications.WgetHSTS](https://docs.velociraptor.app/exchange/artifacts/pages/linux.applications.wgethsts/): Wget creates a HSTS log file in a user’s home directory. This can contain forensically … - [Linux.Carving.SSHLogs](https://docs.velociraptor.app/exchange/artifacts/pages/linux.carving.sshlogs/): Linux systems typically store audit events in syslog. In particular successful ssh logins are … - [Linux.Collection.Autoruns](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.autoruns/): This artifact collects various autorun files for upload. Based on TriagePersistence from … - [Linux.Collection.BrowserExtensions](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.browserextensions/): Collect Browser Extensions and upload them. Based on TriageWebBrowserExtensions from … - [Linux.Collection.BrowserHistory](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.browserhistory/): Collect Browser History and upload them. Based on TriageWebBrowserHistory from forensicartifacts.com … - [Linux.Collection.CatScale](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.catscale/): This is a simple artifact that leverages Cat-Scale to collect many different artifacts from a Linux … - [Linux.Collection.DBConfig](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.dbconfig/): Collect database configurations and upload them. Based on TriageDatabaseConfigsAndLogs from … - [Linux.Collection.History](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.historyfiles/): Collect history files from unix/linux utilities and upload them. Based on TriageHistory from … - [Linux.Collection.NetworkConfig](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.networkconfig/): Collect network config files and upload them. Based on TriageNetwork from forensicartifacts.com … - [Linux.Collection.SysConfig](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.sysconfig/): Collect system configurations and upload them. Based on TriageSystemConfiguration from … - [Linux.Collection.SysLogs](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.syslogs/): Collect system logs and upload them. Based on TriageSystemLogs from forensicartifacts.com name: … - [Linux.Collection.UserConfig](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.userconfig/): Collect user configurations and upload them. Based on TriageUserConfiguration from … - [Linux.Debian.GPGKeys](https://docs.velociraptor.app/exchange/artifacts/pages/linux.debian.gpgkeys/): Extract keys, fingerprints and identities from GPG keys. This artifact runs the tool … - [Linux.Detection.BruteForce](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.bruteforce/): Linux detection brute force module. This code is based on … - [Linux.Detection.ConfluenceLogs](https://docs.velociraptor.app/exchange/artifacts/pages/confluencelogs/): This artifact enables grep of Linux logs and targets strings observed in exploitation of … - [Linux.Detection.CopyFail.Exploitation](https://docs.velociraptor.app/exchange/artifacts/pages/detection.copyfail.cve-2026-31431.exploitation/): Hunts for signs of successful Copy Fail (CVE-2026-31431) exploitation. Targets kernel log messages … - [Linux.Detection.CVE20214034](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.cve20214034/): This artifact lists processes running as root that were spawns by processes that are not running as … - [Linux.Detection.CVE202514847.MongoBleed](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.cve202514847.mongobleed/): Hunts for evidence of CVE-2025-14847 (MongoBleed) exploitation on MongoDB servers. MongoBleed is a … - [Linux.Detection.CVE202685706.GitLabFileRead](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.cve202685706.gitlabfileread/): Hunts self-managed GitLab hosts for exploitation of CVE-2026-85706, an unauthenticated arbitrary … - [Linux.Detection.Honeyfiles](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.honeyfiles/): This artifact deploys honeyfiles according to the Honeyfiles CSV parameter. It then monitors access … - [Linux.Detection.IncorrectPermissions](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.incorrectpermissions/): NOTE: Requires velociraptor 0.7.1 or higher. – Alternatively, import the artifact dependency … - [Linux.Detection.MemFD](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.memfd/): This artifact will parse /proc/*/exe files and look for processes that have been executed from … - [Linux.Detection.SSHKeyFileCmd](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.sshkeyfilecmd/): This artifact will parse ~/.ssh/authorized_keys and ~/.ssh/id_*.pub looking for the command option … - [Linux.Detection.vRealizeLogInsightExploitation](https://docs.velociraptor.app/exchange/artifacts/pages/linux.detection.vrealizeloginsightexploitation/): Checks for exploitation of vRealize Log Insight VMSA-2023-0001 exploitation artifacts. The presence … - [Linux.Event.Network.Nethogs](https://docs.velociraptor.app/exchange/artifacts/pages/linux.event.network.nethogs/): Monitor network use per process using the tool “nethogs”. This artifact will list all … - [Linux.Events.EBPFEnriched](https://docs.velociraptor.app/exchange/artifacts/pages/linux.events.ebpfenriched/): This artifact forwards EBPF events generated on the endpoint and enriches events with: Process … - [Linux.ExtractKthread](https://docs.velociraptor.app/exchange/artifacts/pages/linux.collection.kthread/): This artifact parses /proc/[0-9]*/status files and extracts the ProcessName and Kthread values. … - [Linux.Forensics.EnvironmentVariables](https://docs.velociraptor.app/exchange/artifacts/pages/linux.forensics.environmentvariables/): This artifact detects potential persistence mechanisms on Linux systems by analyzing environment … - [Linux.Forensics.ProcFD](https://docs.velociraptor.app/exchange/artifacts/pages/linux.forensics.procfd/): This artifact collects metadata about open file descriptors from active processes on a Linux system. … - [Linux.Forensics.RecentlyUsed](https://docs.velociraptor.app/exchange/artifacts/pages/linux.forensics.recentlyused/): Parses the ‘recently-used.xbel’ XML file for all standard Linux users. This file notably … - [Linux.Forensics.Targets](https://docs.velociraptor.app/exchange/artifacts/pages/linux.forensics.targets/): This artifact collects all necessary artifacts files and directories from Linux operating system. … - [Linux.LogAnalysis.ChopChopGo](https://docs.velociraptor.app/exchange/artifacts/pages/linux.loganalysis.chopchopgo/): This artifact leverages ChopChopGo to enable usage of Sigma rules to facilitate detection within … - [Linux.Memory.AVML](https://docs.velociraptor.app/exchange/artifacts/pages/linux.memory.avml/): Acquires a full memory image in LiME output format. We download avml and use it to acquire a full … - [Linux.Network.Nethogs](https://docs.velociraptor.app/exchange/artifacts/pages/linux.network.nethogs/): Monitor network use per process using the tool “nethogs”. This artifact will list all … - [Linux.Network.Netstat.Watcher](https://docs.velociraptor.app/exchange/artifacts/pages/linux.network.netstat.watcher/): Collects a one-time snapshot of current non-LISTEN remote connections and a continuous diff stream … - [Linux.Network.NM.Connections](https://docs.velociraptor.app/exchange/artifacts/pages/linux.network.nm.connections/): NetworkManager is a popular high-level interface for configuring networks in Linux systems, in … - [Linux.Persistence.LdPreload](https://docs.velociraptor.app/exchange/artifacts/pages/ldpreload/): Parses the GNU glibc LD_PRELOAD mechanism. Any path listed in /etc/ld.so.preload or assigned to … - [Linux.Remediation.Quarantine.IPTables](https://docs.velociraptor.app/exchange/artifacts/pages/linux.remediation.quarantine/): Quarantine a Linux host using iptables rules. NOTE: This is still a work in progress and may not … - [Linux.Sys.APTHistory](https://docs.velociraptor.app/exchange/artifacts/pages/linux.sys.apthistory/): APT (Advanced Package Tool) maintains a log of software installation/removal/upgrades, as well as … - [Linux.Sys.Getcap](https://docs.velociraptor.app/exchange/artifacts/pages/getcap/): Inspects extended file capabilities with getcap. Since Linux 2.6.24, setcap can attach fine-grained … - [Linux.Sys.JournalCtl](https://docs.velociraptor.app/exchange/artifacts/pages/linux.sys.journalctl/): Parse the output of the journalctl command. Journalctl is an interface to the systemd journal, which … - [Linux.Sys.Modinfo](https://docs.velociraptor.app/exchange/artifacts/pages/modinfo/): Collects detailed metadata about Linux kernel modules using modinfo. Useful for malicious kernel … - [Linux.Sys.SystemdTimer](https://docs.velociraptor.app/exchange/artifacts/pages/linux.sys.systemdtimer/): List and parse content of Systemd timers. name: Linux.Sys.SystemdTimer author: Wes Lambert - … - [Linux.Sysinternals.Sysmon](https://docs.velociraptor.app/exchange/artifacts/pages/linux.sysinternals.sysmon/): Parses syslog for Sysmon events on Linux Reference: https://github.com/Sysinternals/SysmonForLinux … - [Linux.Sysinternals.SysmonEvent](https://docs.velociraptor.app/exchange/artifacts/pages/linux.sysinternals.sysmonevent/): Parses syslog for Sysmon events on Linux using a unix domain socket. NOTE: This is an experimental … - [Linux.System.BashLogout](https://docs.velociraptor.app/exchange/artifacts/pages/linux.system.bashlogout/): Capture Bash logout files for examination of abnormal activity. Bash logout files are used to run … - [Linux.System.PAM](https://docs.velociraptor.app/exchange/artifacts/pages/linux.system.pam/): This artifact enumerates applicable lines from the files that reside in /etc/PAM.d/. This … - [Linux.Volatility.Create.Profile](https://docs.velociraptor.app/exchange/artifacts/pages/volatility_profile/): This artifact is used to create the profile to the environments Debian / Ubuntu. name: … - [MacOS.Applications.Cache](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.cache/): Applications can use the NSURL cache to store specific data that is useful to the operation of the … - [MacOS.Applications.Firefox.History](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.firefox.history/): Read all Users Firefox history. name: MacOS.Applications.Firefox.History description: | Read all … - [MacOS.Applications.KnowledgeC](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.knowledgec/): On macOS, the KnowledgeC DB can provide various details around application activities and usage, as … - [MacOS.Applications.NetworkUsage](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.networkusage/): On macOS, the NetUsage DB can provide various details around application network utilization. With … - [MacOS.Applications.Notes](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.notes/): This artifact provides details about notes taken using the default Notes application on macOS. These … - [MacOS.Applications.Safari.Downloads](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.safari.downloads/): Parses Safari downloads for all standard macOS users NOTE: By default Safari download history is … - [MacOS.Applications.Safari.History](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.safari.history/): Parses Safari history database name: MacOS.Applications.Safari.History description: | Parses Safari … - [MacOS.Applications.SavedState](https://docs.velociraptor.app/exchange/artifacts/pages/macos.applications.savedstate/): On macOS, certain application state is saved in /Users/*/Library/Saved Application State/. We can … - [MacOS.Collection.Aftermath](https://docs.velociraptor.app/exchange/artifacts/pages/macos.collection.aftermath/): This is a simple artifact that leverages Aftermath to collect many different forensic artifacts from … - [MacOS.Files.FileMonitor](https://docs.velociraptor.app/exchange/artifacts/pages/macos.files.filemonitor/): This artifact parses Objective-See’s FileMonitor log. More information about Objective-See and … - [MacOS.Forensics.ASL](https://docs.velociraptor.app/exchange/artifacts/pages/macos.forensics.asl/): This artifact parses the ASL (Apple System Log) v2 files located at /private/var/log/asl/*.asl name: … - [MacOS.Forensics.KnockKnock](https://docs.velociraptor.app/exchange/artifacts/pages/knockknock/): This artifact will run Knocknock to collect autorun output. name: MacOS.Forensics.KnockKnock author: … - [MacOS.Logs.MacMonitor](https://docs.velociraptor.app/exchange/artifacts/pages/macos.logs.macmonitor/): This artifact parses JSONL-formatted logs generated by MacMonitor. name: MacOS.Logs.MacMonitor … - [MacOS.Network.ApplicationLayerFirewall](https://docs.velociraptor.app/exchange/artifacts/pages/macos.network.applicationlayerfirewall/): This artifact provides information around the configuration of the application firewall for a macOS … - [MacOS.Network.Bluetooth](https://docs.velociraptor.app/exchange/artifacts/pages/macos.network.bluetooth/): Collect information about connected or paired Bluetooth-enabled devices. name: … - [MacOS.Network.DHCP](https://docs.velociraptor.app/exchange/artifacts/pages/macos.network.dhcp/): It can be useful to view DHCP lease information on an endpoint. If the LeaseLength, RouterIPAddress, … - [MacOS.Network.LittleSnitch](https://docs.velociraptor.app/exchange/artifacts/pages/macos.network.littlesnitch/): This is artifact parses Little Snitch’s network traffic log. More information about Little … - [MacOS.Network.RecentWifiNetworks](https://docs.velociraptor.app/exchange/artifacts/pages/macos.network.recentwifinetworks/): This artifact looks for recent Wifi networks to which a host has joined. This can be useful in … - [MacOS.ParallelsVM.SuspendedMemory](https://docs.velociraptor.app/exchange/artifacts/pages/macos.parallelsvm.suspendedmemory/): Looks for suspended Parallels VM owned by any user on a MacOS system. Can automatically upload the … - [MacOS.Sys.Automator](https://docs.velociraptor.app/exchange/artifacts/pages/macos.sys.automator/): This artifact collects information about Automator actions and workflows. It can be used to identify … - [MacOS.Sys.BashHistory](https://docs.velociraptor.app/exchange/artifacts/pages/macos.sys.bashhistory/): This artifact is a modified version of the Linux.Sys.BashHistory artifact that enables grep of Bash … - [MacOS.System.LocationServices](https://docs.velociraptor.app/exchange/artifacts/pages/macos.system.locationservices/): This artifact looks for applications that are registered and allowed for use of location services by … - [MacOS.System.Man](https://docs.velociraptor.app/exchange/artifacts/pages/macos.system.man/): man is typically used to provide information about how to use various commands. It’s … - [MacOS.System.MountedDiskImages](https://docs.velociraptor.app/exchange/artifacts/pages/macos.system.mounteddiskimages/): This artifact checks for mounted disk images using the hdiutil command. name: … - [MacOS.UnifiedLogHunter](https://docs.velociraptor.app/exchange/artifacts/pages/macos.unifiedloghunter/): This artifact allows for live hunting through Apple’s Unified Logs using the native log … - [MacOS.UnifiedLogParser](https://docs.velociraptor.app/exchange/artifacts/pages/macos.unifiedlogparser/): This is a simple, un-optimized artifact that leverages Mandiant’s … - [Notebooks.Admin.Flows](https://docs.velociraptor.app/exchange/artifacts/pages/notebooks.admin.flows/): This notebooks lists all recent flows/collections across all orgs on the platform. It may be used … - [PSList.VTLookup](https://docs.velociraptor.app/exchange/artifacts/pages/pslist.vtlookup/): Combination of PSList with Virus Total reputation lookup using the Virus Total Server Enrichment … - [Server.Alerts.GenericMonitor](https://docs.velociraptor.app/exchange/artifacts/pages/genericmonitor/): This is a template artifact to allow alerting on a monitoring artifact. Simply enter ArtifactName … - [Server.Alerts.IRIS.Case.Create](https://docs.velociraptor.app/exchange/artifacts/pages/server.alerts.iris.case.create/): Create an IRIS case when monitored artifacts complete with results. Adds the ClientId, FlowId as … - [Server.Alerts.Mattermost](https://docs.velociraptor.app/exchange/artifacts/pages/server.alerts.mattermost/): Create a Slack/Mattermost notification when a client Flow (with artifacts of interest) has finished. … - [Server.Alerts.Monitor.IRIS](https://docs.velociraptor.app/exchange/artifacts/pages/server.alerts.monitor.iris/): Create an IRIS alert when monitored artifacts complete with results. Alerts are available starting … - [Server.Alerts.TrackNetworkConnections](https://docs.velociraptor.app/exchange/artifacts/pages/server.alerts.tracknetworkconnections/): This artifact alerts on network connections tracked by Velociraptor on clients. Requires the … - [Server.Analysis.CyberChefServer](https://docs.velociraptor.app/exchange/artifacts/pages/cyberchefserver/): Analyze/transform data with CyberChef-server. Note that this requires an accessible Cyberchef-server … - [Server.Analysis.Windows.EventLogs.Hayabusa](https://docs.velociraptor.app/exchange/artifacts/pages/server.analysis.windows.eventlogs.hayabusa/): Runs the curated Hayabusa Sigma ruleset against Windows event logs that were already uploaded to the … - [Server.Enrichment.AI.Anthropic](https://docs.velociraptor.app/exchange/artifacts/pages/anthropic/): Query Anthropic AI for analysis of data. Parameters: PrePrompt - Added as preprompt. Default is: … - [Server.Enrichment.AI.Gemini](https://docs.velociraptor.app/exchange/artifacts/pages/gemini/): Query Gemini AI for analysis of data. Parameters: PrePrompt - Added as preprompt. Default is: … - [Server.Enrichment.AI.Ollama](https://docs.velociraptor.app/exchange/artifacts/pages/ollama/): This artifact allows enrichment using Ollama AI. Parameters: PrePrompt - Is initial prompt default … - [Server.Enrichment.AI.OpenAI](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.openai/): Query OpenAI for analysis of data. Parameters: PrePrompt - Is System prompt default is: “You … - [Server.Enrichment.EchoTrail](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.echotrail/): This is a process execution enrichment artifact that can be called from within another artifact … - [Server.Enrichment.IRIS.IOCLookup](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.iris.ioclookup/): Query an IRIS instance for an indicator. To learn more about IRIS, see: https://dfir-iris.org/ This … - [Server.Enrichment.MalwareBazaar](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.malwarebazaar/): Query MalwareBazaar for a hash. To learn more about MalwareBazaar, see: https://bazaar.abuse.ch/ … - [Server.Enrichment.SecureAnnex](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.secureannex/): Submit an extension to the Secure Annex API. https://app.secureannex.com/settings/api This artifact … - [Server.Enrichment.Strelka.FileScan](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.strelka.filescan/): Submit a file to Strelka for analysis using strelka-oneshot. For more information about Strelka and … - [Server.Enrichment.Sublime.EmailAnalysis](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.sublime.emailanalysis/): Submit an email to Sublime for analysis. https://sublime.security/ By default, this artifact returns … - [Server.Enrichment.ThreatFox](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.threatfox/): Query ThreatFox for an indicator. To learn more about ThreatFox, see: https://threatfox.abuse.ch … - [Server.Enrichment.Virustotal.FileScan](https://docs.velociraptor.app/exchange/artifacts/pages/server.enrichment.virustotal.filescan/): Submit a file to Virustotal for analysis. This artifact is based on the multipart/form-data example … - [Server.Findflows](https://docs.velociraptor.app/exchange/artifacts/pages/findflows/): This artifact enables searching over client flow results with regex and returns a link to the Flow … - [Server.Hunt.Comparison](https://docs.velociraptor.app/exchange/artifacts/pages/server.hunt.comparison/): This artifact is used to compare other artifacts from two different hunts. The basic idea is that a … - [Server.Import.DetectRaptor](https://docs.velociraptor.app/exchange/artifacts/pages/detectraptor/): DetectRaptor is a collection of publicly available Velociraptor detection content. Most content is … - [Server.Import.WatchLocalDirectory](https://docs.velociraptor.app/exchange/artifacts/pages/server.import.watchlocaldirectory/): This is an artifact that will monitor a local path for collections, which it will then ingest. name: … - [Server.Import.WatchS3Directory](https://docs.velociraptor.app/exchange/artifacts/pages/server.import.watchs3directory/): This is an artifact that will monitor an S3 path for collections, which it will then ingest. name: … - [Server.Monitor.Alerts](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.alerts/): Send an e-mail when an alert is created. This artifact watches Server.Internal.Alerts and forwards … - [Server.Monitor.Alerts.UserMessage](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.alerts.usermessage/): Send an in-app user notification when an alert is created. This artifact watches … - [Server.Monitor.Autolabeling.Clients](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.autolabeling.clients/): This server side event monitoring artifact watches for new client enrollments and automatically … - [Server.Monitor.Client.Errors.Alert](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.client.errors.alert/): Create alerts from errors logged by client event queries. Client event queries are often used for … - [Server.Monitor.Errors.Alert](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.errors.alert/): Create alerts from errors logged by server event queries. Server event queries are often used for … - [Server.Monitor.FlowCompletion](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.flowcompletion/): Send an e-mail when a client flow completes (success or failure), with optional HTML formatting, … - [Server.Monitor.StoreClientHWInfo](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.storeclienthwinfo/): Save hardware identification data from client interrogation as client metadata. The primary use case … - [Server.Monitor.StoreClientInfo](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.storeclientinfo/): Save data from client interrogation as client metadata. This artifact listens for completions of an … - [Server.Monitor.Windows.EventLogs.Hayabusa](https://docs.velociraptor.app/exchange/artifacts/pages/server.monitor.windows.eventlogs.hayabusa/): Watches for completed client collections whose artifacts match ArtifactRegex and automatically runs … - [Server.Notification.Mastodon](https://docs.velociraptor.app/exchange/artifacts/pages/server.notification.mastodon/): Create a post on a Mastodon server. This could be used for automated alerting purposes, sharing … - [Server.Notification.Mattermost](https://docs.velociraptor.app/exchange/artifacts/pages/server.notification.mattermost/): Send notification via Mattermost webhook as described in … - [Server.PostProcess.FluentBit](https://docs.velociraptor.app/exchange/artifacts/pages/fluentbit/): Post-process collection results using Fluent Bit. Warning Since v0.75 this artifact will no longer … - [Server.Slack.Clients.Enrolled](https://docs.velociraptor.app/exchange/artifacts/pages/server.slack.clients.enrolled/): Send a message to slack when clients become enrolled. This artifact triggers when a client is … - [Server.Telegram.Clients.Enrolled](https://docs.velociraptor.app/exchange/artifacts/pages/server.telegram.clients.enrolled/): Send a message to telegram when clients become enrolled. This artifact triggers when a client is … - [Server.Utils.BackupAzure](https://docs.velociraptor.app/exchange/artifacts/pages/server.utils.backupazure/): This server monitoring artifact will automatically zip and backup any collected artifacts to Azure … - [Server.Utils.DeleteClientLabel](https://docs.velociraptor.app/exchange/artifacts/pages/deleteclientlabel/): This artifact completely removes a client from the data store if a configured label is set. We … - [Server.Utils.OrphanedFlows](https://docs.velociraptor.app/exchange/artifacts/pages/server.utils.orphanedflows/): Sometimes flows are deleted but there is still outstanding data for them in flight. The server will … - [Server.Utils.QuerySummary](https://docs.velociraptor.app/exchange/artifacts/pages/server.utils.querysummary/): Takes a query and outputs number of unique items per column, as well as the top 10 most frequently … - [Server.Utils.ScheduledDeletion](https://docs.velociraptor.app/exchange/artifacts/pages/server.utils.scheduleddeletion/): Schedules Server.Utils.DeleteMonitoringData to cleanup server monitoring data. name: … - [Splunk.Events.Clients](https://docs.velociraptor.app/exchange/artifacts/pages/splunk.events.clients/): This server monitoring artifact will watch a selection of client monitoring artifacts for new events … - [Windows.ActiveDirectory.PrivilegedUsers](https://docs.velociraptor.app/exchange/artifacts/pages/activedirectoryprivilegedusers/): If on a Domain Controller (ProductType = 2), recursively enumerate membership of privileged groups, … - [Windows.ADCS.CertificateAuthority.EDB](https://docs.velociraptor.app/exchange/artifacts/pages/windows.adcs.certificateauthority.edb/): Parses the Active Directory Certificate Services (ADCS) ESE database directly from disk. Reads the … - [Windows.Analysis.Capa](https://docs.velociraptor.app/exchange/artifacts/pages/windows.analysis.capa/): Analyze PE, ELF, or shellcode files with capa. “capa detects capabilities in executable files. … - [Windows.Analysis.SuspiciousWMIConsumers](https://docs.velociraptor.app/exchange/artifacts/pages/suspiciouswmiconsumers/): This artifact reports suspicious WMI Event Consumers and their associated Filters that may indicate … - [Windows.Applications.AnyDesk](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.anydesk/): This parses AnyDesk logs to retrieve information about AnyDesk usage. It includes source IP … - [Windows.Applications.AnyDesk.LogParser](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.anydesk.logparser/): Parses the AnyDesk ad.trace log file. Info such as connection times, clipboard activity, and remote … - [Windows.Applications.Cylance](https://docs.velociraptor.app/exchange/artifacts/pages/cylance/): Parse Cylance logs. name: Windows.Applications.Cylance author: "Matt Green - @mgreen27" … - [Windows.Applications.DefenderDHParser](https://docs.velociraptor.app/exchange/artifacts/pages/defenderdhparser/): This artifact leverages Windows Defender DetectionHistory tool to parse and return the parameters of … - [Windows.Applications.DefenderHistory](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.defenderhistory/): This artifact parses the Windows Defender files generated on threat detection and returns the … - [Windows.Applications.DefenderQuarantineExtract](https://docs.velociraptor.app/exchange/artifacts/pages/defenderquarantineextract/): Extracts Quarantine Files from Windows Defender. This artifact decrypts the RC4 encrypted Windows … - [Windows.Applications.DIEC](https://docs.velociraptor.app/exchange/artifacts/pages/diec/): Execute DetectItEasy (console version) on specified paths and return rows of results to hunt/filter … - [Windows.Applications.FreeFileSync](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.freefilesync/): This artifact can be used to retrieve and parse some FreeFileSync file in order to: Identify the … - [Windows.Applications.FTKImager](https://docs.velociraptor.app/exchange/artifacts/pages/ftkimager/): Create an E01 Image of the C drive using FTK Imager (Command Line Version) SourceDriveToImage … - [Windows.Applications.GoodSync](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.goodsync/): This artifact can be used to retrieve and parse some GoodSync file in order to identify configured … - [Windows.Applications.KACE_SW_Process](https://docs.velociraptor.app/exchange/artifacts/pages/kace_sw_process/): This artifact parses the KACE software monitoring sqlite database - ksw_process.db which provides … - [Windows.Applications.LECmd](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.lecmd/): Execute Eric Zimmerman’s LECmd and return output for analysis. Created using @eduardfir SBECmd … - [Windows.Applications.MouseWithoutBorders](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.mousewithoutborders/): This artifact parses Microsoft Mouse Without Borders (MWB) runtime logs, module interface logs and … - [Windows.Applications.OfficeMacros.MacroRaptor](https://docs.velociraptor.app/exchange/artifacts/pages/macroraptor/): This artifact implements OleTools MacroRaptor capability in VQL. Use as a Hunt or triage capability. … - [Windows.Applications.OfficeServerCache](https://docs.velociraptor.app/exchange/artifacts/pages/officeservercache/): Return Office Internet Server Cache Registry keys and values in order to identify possible C2 URLs … - [Windows.Applications.Tailscale](https://docs.velociraptor.app/exchange/artifacts/pages/windows.applications.tailscale/): Decodes the configuration file, pulls log files, and uploads any partial file transfers for … - [Windows.Audit.CISCat_Lite](https://docs.velociraptor.app/exchange/artifacts/pages/windows.audit.ciscat_lite/): This artifact runs the CISCat-Lite tool on the target machine and uploads the html output on the … - [Windows.Binary.Exports](https://docs.velociraptor.app/exchange/artifacts/pages/exports/): This artifact can be used to extract all binary exports to research potential lolbins. Selecting the … - [Windows.Bulk.File](https://docs.velociraptor.app/exchange/artifacts/pages/bulkfile/): Search for some simple bulk File IOCs and upload if desired. Typical upload workflow may be to … - [Windows.Carving.BRc4](https://docs.velociraptor.app/exchange/artifacts/pages/brc4/): This artifact extracts Brute Ratel C4 (BRc4) configuration from a byte stream, process or file on … - [Windows.Carving.BumbleBee](https://docs.velociraptor.app/exchange/artifacts/pages/bumblebee/): This artifact will detect running BumbleBee processes and subsequently extract the command and … - [Windows.Carving.Qakbot](https://docs.velociraptor.app/exchange/artifacts/pages/qakbot/): This artifact enables Qakbot payload detection and configuration extraction from a byte stream, … - [Windows.Carving.SquirrelWaffle](https://docs.velociraptor.app/exchange/artifacts/pages/squirrelwaffle/): This artifact yara-scans memory or process dumps for unpacked SquirrelWaffle Dlls, decodes the … - [Windows.Carving.SystemBC](https://docs.velociraptor.app/exchange/artifacts/pages/systembc/): This artifact extracts SystemBC RAT configuration from a byte stream, process or file on disk. The … - [Windows.Detection.BruteRatel](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.bruteratel/): This hunt runts the Immersive Labs yara rule across select files to identify the known Brute Ratel … - [Windows.Detection.Honeyfiles](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.honeyfile/): This artifact deploys honeyfiles according to the Honeyfiles CSV parameter. It then monitors access … - [Windows.Detection.HyperV](https://docs.velociraptor.app/exchange/artifacts/pages/hyperv/): Scope suspicious Hyper-V worker process and activity on Windows workstations. Checks for Hyper-V … - [Windows.Detection.IdatLoader](https://docs.velociraptor.app/exchange/artifacts/pages/idatloader/): This artifact enables running Yara over processes in memory. Targeting detection of IDAT Loader and … - [Windows.Detection.ISOMount](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.isomount/): Following Microsoft’s decision to block macros by default on MS Office applications, threat … - [Windows.Detection.Keylogger](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.keylogger/): This artifact is my attempt at implementing keylogger detection based on research presented by Asuka … - [Windows.Detection.LotusBlossom.Chrysalis](https://docs.velociraptor.app/exchange/artifacts/pages/chrysalis/): Assists scoping IOCs related to the recent publicly disclosed Notepad++ supply chain attack. Find … - [Windows.Detection.MagicWeb](https://docs.velociraptor.app/exchange/artifacts/pages/magicweb/): This artifact will find evidence of NOBELIUM’s MagicWeb. The artifact consists of two checks: Search … - [Windows.Detection.Malfind](https://docs.velociraptor.app/exchange/artifacts/pages/malfind/): This artifact checks the VAD for executable sections that are not mapped to disk and has suspicious … - [Windows.Detection.MoveIt](https://docs.velociraptor.app/exchange/artifacts/pages/moveit/): This is an artifact to detect exploitation of a MoveIt critical vulnerability observed in the wild. … - [Windows.Detection.MsdtFollina](https://docs.velociraptor.app/exchange/artifacts/pages/msdtfollina/): This artifact will search Microsoft Support Diagnostic Tool logs for evidence of ms-msdt Follina … - [Windows.Detection.Network.Changed](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.network.changed/): Detects when a new network is added or removed from the system via the NetworkList registry keys. … - [Windows.Detection.Ntdsutil](https://docs.velociraptor.app/exchange/artifacts/pages/ntdsutil/): This artifact will extract evidence of Ntdsutil abuse from the application eventlog. The artifact … - [Windows.Detection.Onenote](https://docs.velociraptor.app/exchange/artifacts/pages/onenote/): This artifact enables detection of malicious .one files and can also be used as an embedded file and … - [Windows.Detection.PipeHunter](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.pipehunter/): Takes a pipe name and returns the owning process and access rights. The primary motivation for this … - [Windows.Detection.PrefetchHunter](https://docs.velociraptor.app/exchange/artifacts/pages/prefetchhunter/): This artifact enables hunting prefetch entries for accessed files of interest. Returned results … - [Windows.Detection.PrintNightmare](https://docs.velociraptor.app/exchange/artifacts/pages/printnightmare/): This artifact returns any binaries in the Windows/spool/drivers/** folders with an untrusted … - [Windows.Detection.ProxyHunter](https://docs.velociraptor.app/exchange/artifacts/pages/proxyhunter/): This artifact detects evidence of several common proxy tools. Hunt through Event Logs for potential … - [Windows.Detection.ProxyLogon.ProxyShell](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.proxylogon.proxyshell/): This artifact hunts for CVE-2021-27065 (Microsoft Exchange ProxyLogon RCE) and CVE-2021-31207 … - [Windows.Detection.PublicIP](https://docs.velociraptor.app/exchange/artifacts/pages/publicip/): This artifact queries for RDP and Authentication events with a Public IP source. The artifact uses … - [Windows.Detection.ReflectedAssemblies](https://docs.velociraptor.app/exchange/artifacts/pages/reflectedassemblies/): Collects current running .NET assemblies and replicates ProcessHacker’s .NET Assemblies view. … - [Windows.Detection.RemoteIconForcedAuth](https://docs.velociraptor.app/exchange/artifacts/pages/remoteiconforcedauth/): Attackers plant SCF, URL, and LNK files with malicious icon file paths on file shares to escalate … - [Windows.Detection.ScmanagerBackdoor](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.scmanagerbackdoor/): Checks for overly permissive DACLs on scmanager. Low priv Users with KA - SDDL_KEY_ALL could launch … - [Windows.Detection.SmoothOperator](https://docs.velociraptor.app/exchange/artifacts/pages/smoothoperator/): This artifact searches for evidence of trojanized 3CXDesktopApp. Currently Windows specific, Yara … - [Windows.Detection.SysAid](https://docs.velociraptor.app/exchange/artifacts/pages/sysaid/): Detects artifacts associated with post exploitation activity of LaceTempest related to the SysAid … - [Windows.Detection.TeamViewerLanguage](https://docs.velociraptor.app/exchange/artifacts/pages/teamviewerlanguage/): This artifact enables collection of TeamViewer log entries for keyboard layout changes. The artifact … - [Windows.Detection.Termsrv](https://docs.velociraptor.app/exchange/artifacts/pages/termsrv/): This artifact detects patched TerminalService / Remote Desktop (RDP) dynamic link library or … - [Windows.Detection.UnattendXML](https://docs.velociraptor.app/exchange/artifacts/pages/unattendxml/): This artifact will find unscrubbed passwords in unattend.xml answer files. This file is used for non … - [Windows.Detection.USBYara](https://docs.velociraptor.app/exchange/artifacts/pages/usbyara/): Run yara over usb when USB is plugged into machine. Return context and hit details. This artifact … - [Windows.Detection.WonkaVision](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.wonkavision/): This artifact analyzes Kerberos tickets and attempts to determine if they are forged, using … - [Windows.Detection.WS_FTP](https://docs.velociraptor.app/exchange/artifacts/pages/ws_ftp/): This is an artifact to detect exploitation of a Progress Software’s WS_FTP critical … - [Windows.ESET.Logs](https://docs.velociraptor.app/exchange/artifacts/pages/esetlogs/): Parse logs from ESET antivirus products. This log contains information about detections made by the … - [Windows.ETW.AMSI](https://docs.velociraptor.app/exchange/artifacts/pages/amsi/): This artifact uses the ETW provider: (Microsoft-Antimalware-Scan-Interface - … - [Windows.ETW.DetectProcessSpoofing](https://docs.velociraptor.app/exchange/artifacts/pages/windows.etw.detectprocessspoofing/): Detects Process parent spoofing such as SelectMyParent.exe or Cobalt Strike select PPID. NOTE: for … - [Windows.ETW.DNSOfflineCollector](https://docs.velociraptor.app/exchange/artifacts/pages/windows.etw.dnsofflinecollector/): This artifact collects DNS queries for a specified duration. It can be used with an Offline … - [Windows.ETW.Powershell](https://docs.velociraptor.app/exchange/artifacts/pages/powershellmonitoring/): This artifact enables Powershell scriptblock and commandlet load monitoring. It uses the ETW … - [Windows.ETW.ScreenshotTaken](https://docs.velociraptor.app/exchange/artifacts/pages/windows.etw.screenshottaken/): This artifact detects screen captures by correlating events from the Microsoft-Windows-Win32k ETW … - [Windows.ETW.WMIEventing](https://docs.velociraptor.app/exchange/artifacts/pages/wmieventing/): This artifact collects events associated with creation and deletion of WMI Event Consumers. All … - [Windows.EventLogs.Aurora](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.aurora/): This artifact is a wrapper around the Windows.EventLogs.EvtxHunter artifact. It searches the Windows … - [Windows.EventLogs.Bitsadmin](https://docs.velociraptor.app/exchange/artifacts/pages/bitsadmin/): This content will extract BITS Transfer events and enable filtering by URL and TLD. name: … - [Windows.EventLogs.Chainsaw](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.chainsaw/): This artifact leverages Chainsaw to enable usage of Sigma rules (in addition to built-in rules) to … - [Windows.EventLogs.CondensedAccountUsage](https://docs.velociraptor.app/exchange/artifacts/pages/condensedaccountusage/): This artifact will extract condensed information on logon / logoff events. Security channel - … - [Windows.EventLogs.DeepBlueCLI](https://docs.velociraptor.app/exchange/artifacts/pages/windows.deepbluecli/): DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs name: … - [Windows.EventLogs.EvtxHussar](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.evtxhussar/): Grab important events from Windows logs (.evtx) using EvtxHussar. Also upload PowerShell … - [Windows.EventLogs.Hayabusa](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.hayabusa/): Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool. WARNING: … - [Windows.EventLogs.LogonSessions](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.logonsessions/): This artifact searches for logon and logoff events within Security event logs identified by Event ID … - [Windows.EventLogs.MoveIt](https://docs.velociraptor.app/exchange/artifacts/pages/moveitevtx/): This Artifact enables scoping EventLogs from Progress Software’s MoveIT File Transfer. It is … - [Windows.EventLogs.RDPClientActivity](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.rdpclientactivity/): This artifact retrieves outgoing RDP session activity from the … - [Windows.EventLogs.RecordIDCheck](https://docs.velociraptor.app/exchange/artifacts/pages/recordidcheck/): This artifact will compare EventLog records and report on abnormalities in RecordID sequence and … - [Windows.EventLogs.RemoteAccessVPN](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.remoteaccessvpn/): This Artifact enables scoping EventLogs from Microsoft VPN, served by Remote Access Service server … - [Windows.EventLogs.RPCFirewall](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.rpcfirewall/): Collect RPC Firewall logs from Windows hosts name: Windows.EventLogs.RPCFirewall description: | … - [Windows.EventLogs.SysmonProcessEnriched.yaml](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.sysmonprocessenriched/): Collects sysmon process creation events and enriches with authenticode signature, tlsh hash, and … - [Windows.EventLogs.WonkaVision](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.wonkavision/): Collect WonkaVision logs from Windows hosts. WonkaVision is a utility developed by @4ndr3w6S and … - [Windows.EventLogs.Zircolite](https://docs.velociraptor.app/exchange/artifacts/pages/windows.eventlogs.zircolite/): Zircolite is a standalone tool that can be used to apply Sigma rules to EVTX files on endpoints in … - [Windows.Events.SysmonArchiveMonitor](https://docs.velociraptor.app/exchange/artifacts/pages/sysmonarchivemonitor/): This artifact enables automatic management of the Sysmon archive folder. FileDelete is a … - [Windows.Events.SysmonRegistry](https://docs.velociraptor.app/exchange/artifacts/pages/sysmonregistry/): This artifact enables monitoring for registry events of interest via the Sysmon ETW provider. The … - [Windows.Events.TrackProcesses.UseExistingSysmonOnly](https://docs.velociraptor.app/exchange/artifacts/pages/windows.events.trackprocesses.useexistingsysmononly/): This is a modified version of Windows.Events.TrackProcesses for servers that do not use the … - [Windows.Forensics.AdvancedPortScanner](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.advancedportscanner/): This Velociraptor artifact is tailored for forensics analysis of Angry IP Scanner usage on Windows … - [Windows.Forensics.AngryIPScanner](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.angryipscanner/): This Velociraptor artifact is tailored for forensic analysis of Angry IP Scanner usage on Windows … - [Windows.Forensics.Clipboard](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.clipboard/): This artifact will show the Clipboard activity. The artifact ActivitiesCache.db has started to log … - [Windows.Forensics.FileZilla](https://docs.velociraptor.app/exchange/artifacts/pages/filezilla/): This artifact enumerates all user directories on a system and will parse three files within a users … - [Windows.Forensics.Jumplists_JLECmd](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.jumplists_jlecmd/): Execute Eric Zimmerman’s JLECmd to parse AUTOMATICDESTINATIONS-MS and CUSTOMDESTINATIONS-MS … - [Windows.Forensics.NotificationsDatabase](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.notificationsdatabase/): Parses the Win10/11 notifications database, which contains events for badges, tiles, and toasts … - [Windows.Forensics.OneNoteHunt](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.onenotehunt/): Hunt OneNote files, search ASCII and UTF-16LE content, detect embedded image signatures, report … - [Windows.Forensics.PersistenceSniper](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.persistencesniper/): PersistenceSniper is a Powershell module that can be used by Blue Teams, Incident Responders and … - [Windows.Forensics.RecentFileCache](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.recentfilecache/): Parses the RecentFileCache as evidence of execution artifact existing on older Windows systems … - [Windows.Forensics.SoftPerfectNetworkScanner](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.softperfectnetworkscanner/): This Velociraptor artifact is tailored for forensic analysis of SoftPerfect Network Scanner … - [Windows.Forensics.TabState](https://docs.velociraptor.app/exchange/artifacts/pages/tabstate/): This artifact parses notepad TabState files in available in Windows 11. In Windows 11, notepad has … - [Windows.Forensics.ThumbCache](https://docs.velociraptor.app/exchange/artifacts/pages/thumbcache/): ThumbCache_xx.db parser. Windows 8 and above is supported. This does NOT parse Win7/Vista caches. By … - [Windows.Forensics.Trawler](https://docs.velociraptor.app/exchange/artifacts/pages/trawler/): Trawler [https://github.com/joeavanzato/Trawler] is a PowerShell script designed to help Incident … - [Windows.Forensics.UEFI.BootApplication](https://docs.velociraptor.app/exchange/artifacts/pages/bootapplication/): This artifact parses Windows MeasuredBoot TCGLogs to extract PathName of … - [Windows.Forensics.WindowsNotepadParser](https://docs.velociraptor.app/exchange/artifacts/pages/windows.forensics.windowsnotepadparser/): Runs the WindowsNotepadParser (https://github.com/ogmini/Notepad-State-Library) tool to collect and … - [Windows.Generic.Internet.BlockAccess](https://docs.velociraptor.app/exchange/artifacts/pages/windows.generic.internet.blockaccess/): Simply adds a new inbound or outbound firewall rule that filters traffic by allowing or blocking … - [Windows.Hunter.Yara.LOLDrivers](https://docs.velociraptor.app/exchange/artifacts/pages/windows.hunter.yara.loldrivers/): This artifact scans system driver directories using two user-supplied YARA rules: One for malware … - [Windows.Install.Wazuh.Agent](https://docs.velociraptor.app/exchange/artifacts/pages/windows.install.wazuh.agent/): Installs the Wazuh Windows agent and configures it to use the supplied Wazuh manager IP address or … - [Windows.Kerberos.GoldenTicketTriage](https://docs.velociraptor.app/exchange/artifacts/pages/windows.kerberos.goldentickettriage/): It analyzes klist output to identify Kerberos tickets with unusually long lifetimes as well as … - [Windows.LastDomainUsers](https://docs.velociraptor.app/exchange/artifacts/pages/windows.lastdomainusers/): Enumerate Domain Users by creation date. This artifact can be used to quickly detect new domain … - [Windows.Memory.DotnetDumper](https://docs.velociraptor.app/exchange/artifacts/pages/dotnetdumper/): Response artifact to triage Windows .NET processes and collect .NET assemblies from memory using … - [Windows.Memory.HollowsHunter](https://docs.velociraptor.app/exchange/artifacts/pages/hollowshunter/): Use hollows_hunter to detect suspicious process injections. Upload any findings to the server, … - [Windows.Memory.InjectedThreadEx](https://docs.velociraptor.app/exchange/artifacts/pages/injectedthreadex/): This artifact runs Get-InjetedThreadEx to detect process injection and hooking. The artifact uses … - [Windows.Memory.Mem2Disk](https://docs.velociraptor.app/exchange/artifacts/pages/windows.memory.mem2disk/): This artifact compares executables in memory (RAM) with those on hard disk. This way, RAM injections … - [Windows.MobaXterm.Passwords](https://docs.velociraptor.app/exchange/artifacts/pages/custom.windows.mobaxterm.passwords/): Extract MobaXterm encrypted saved Master Passwords, Passwords and Credentials from registry. Further … - [Windows.Monitor.USBPlugIn](https://docs.velociraptor.app/exchange/artifacts/pages/usbplugin/): Monitor for plug in of USB volume. Output drive letter for additional enrichment artifacts name: … - [Windows.Monitoring.PrintNightmare](https://docs.velociraptor.app/exchange/artifacts/pages/printnightmaremonitor/): This artifact returns ETW PrintService events for potential PrintNightmare activity. CVE-2021-1675 … - [Windows.Mounted.Mass.Storage](https://docs.velociraptor.app/exchange/artifacts/pages/windows.mounted.mass.storage/): Find drives/usb mass storage that were mounted name: Windows.Mounted.Mass.Storage author: "Yaniv … - [Windows.Nirsoft.LastActivityView](https://docs.velociraptor.app/exchange/artifacts/pages/windows.nirsoft.lastactivityview/): LastActivityView is a tool for Windows operating system that collects information from various … - [Windows.NTFS.MFT.HiveNightmare](https://docs.velociraptor.app/exchange/artifacts/pages/windows.ntfs.mft.hivenightmare/): This artifact uses Windows.NTFS.MFT (By Matt Green - @mgreen27) to find several files created as … - [Windows.NTFS.Timestomp](https://docs.velociraptor.app/exchange/artifacts/pages/timestomp/): This artifact enables triage to detect potential time stomped files. Checks: $STANDARD_INFORMATION … - [Windows.Office.MRU](https://docs.velociraptor.app/exchange/artifacts/pages/windows.office.mru/): This artifact enables hunting for recently used Office Documents. The artifact takes a Registry … - [Windows.Persistence.VscodeTasks](https://docs.velociraptor.app/exchange/artifacts/pages/vscodetasks/): This artifact parses VSCode configuration files to find potential persistence. Terminal Profiles via … - [Windows.Registry.AteraNetworks](https://docs.velociraptor.app/exchange/artifacts/pages/ateranetworks/): Find AteraNetworks configuration details in the registry. This artifact is best combined with … - [Windows.Registry.Bulk.ComputerName](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.bulk.computername/): This looks through registry on all disks to determine the hostname for cases where multiple disks … - [Windows.Registry.CapabilityAccessManager](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.capabilityaccessmanager/): The ConsentStore in CapabilityAccessManager can provide insight to what resources binaries have had … - [Windows.Registry.COMAutoApprovalList](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.comautoapprovallist/): This artifact will return COM objects that auto-elevate and bypass UAC (these could potentially be … - [Windows.Registry.CortexEDRDisabled](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.disabledcortexxdr/): This artifact will attempt to identify Cortex EDR that has been disabled via regkey name: … - [Windows.Registry.CVE_2021_40444](https://docs.velociraptor.app/exchange/artifacts/pages/cve_2021_40444/): This artifact will enable both application and removal of the recommended mitigation for … - [Windows.Registry.DefenderConfig](https://docs.velociraptor.app/exchange/artifacts/pages/defenderconfig/): This artifact enables extracting Windows Defender configuration from SOFTWARE registry hive. … - [Windows.Registry.Domain](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.domainname/): Checks the configured domain name on each endpoint name: Windows.Registry.Domain description: Checks … - [Windows.Registry.HiddenUsers](https://docs.velociraptor.app/exchange/artifacts/pages/hiddenusers/): Find hidden user accounts through registry values on the filesystem. In Windows, adversaries may … - [Windows.Registry.HVCI](https://docs.velociraptor.app/exchange/artifacts/pages/hvci/): This artifact will return the Enabled KeyValue in the Hypervisor-protected Code Integrity (HVCI) … - [Windows.Registry.NetshHelperDLLs](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.netshhelperdlls/): Enumerate all NetSh Helper DLLsInspired by this tweet, this artifact enumerates all NetSh Helper … - [Windows.Registry.PrintNightmare](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.printnightmare/): CVE-2021-34527 or Windows Print Spooler Remote Code Execution Vulnerability A remote code execution … - [Windows.Registry.ScheduledTasks](https://docs.velociraptor.app/exchange/artifacts/pages/scheduledtasks/): This artifact will collect Scheduled task information from the registry without relying on the … - [Windows.Registry.TaskCache.HiddenTasks](https://docs.velociraptor.app/exchange/artifacts/pages/windows.registry.taskcache.hiddentasks/): This artifact will highlight any scheduled tasks missing the Security Descriptor (SD) value in the … - [Windows.Remediation.Glob](https://docs.velociraptor.app/exchange/artifacts/pages/globremediation/): This artifact uses glob to remove a file or folder. To recursively target a folder: … - [Windows.Remediation.KillProcess](https://docs.velociraptor.app/exchange/artifacts/pages/killprocess/): Quick and dirty monitoring artifact to kill a process by Image Name. We monitor the … - [Windows.Remediation.PrintSpooler](https://docs.velociraptor.app/exchange/artifacts/pages/printspoolerremediation/): This artifact will enable mitigation of PrintSpooler exploitation used by PrintNightmare - … - [Windows.Remediation.Process](https://docs.velociraptor.app/exchange/artifacts/pages/processremediation/): This artifact enables killing a process by Name, Path or PID. WARNING: This is dangerous content as … - [Windows.Remediation.Registry](https://docs.velociraptor.app/exchange/artifacts/pages/registryremediation/): This artifact uses glob to remove a registry key. TypeRegex allows targeting of key or value. For … - [Windows.Scanner.Yara.Parsed](https://docs.velociraptor.app/exchange/artifacts/pages/windows.detection.yara.yara64/): Instructions: Upload a yara signature file (signature file must be named yara.yas) and yara64.exe in … - [Windows.Services.Hijacking](https://docs.velociraptor.app/exchange/artifacts/pages/windows.services.hijacking/): Service Executable Hijacking is a misconfiguration flaw, where a service runs an executable which … - [Windows.Ssh.AuthorizedKeys](https://docs.velociraptor.app/exchange/artifacts/pages/windows.ssh.authorizedkeys/): Find and parse ssh authorized keys files on Windows running OpenSSH service. name: … - [Windows.Sys.BitLocker](https://docs.velociraptor.app/exchange/artifacts/pages/windows.sys.bitlocker/): This artifact gets all Bitlocker volumes using PowerShell, including the recovery password. name: … - [Windows.Sys.LoggedInUsers](https://docs.velociraptor.app/exchange/artifacts/pages/windows.sys.loggedinusers/): Get all currently logged in users via wmi. name: Windows.Sys.LoggedInUsers author: Zane Gittins … - [Windows.Sysinternals.PSShutdown](https://docs.velociraptor.app/exchange/artifacts/pages/windows.sysinternals.psshutdown/): PsShutdown is a command-line utility similar to the shutdown utility from the Windows 2000 Resource … - [Windows.Sysinternals.SysmonArchive](https://docs.velociraptor.app/exchange/artifacts/pages/sysmonarchive/): If configured, Sysmon EID 23: FileDelete enables archiving file deletes on disk. The challenges of … - [Windows.System.AccessControlList](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.accesscontrollist/): This artifact displays the access control lists of files. Note: This artifact uses Powershell to … - [Windows.System.AppCompatPCA](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.appcompatpca/): Parse the Program Compatibility Assistant launch dictionary for executable launch times. name: … - [Windows.System.AppCompatPCAExtend](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.appcompatpca.extended/): Parse the Program Compatibility Assistant (PCA) databases for executable launch history and abnormal … - [Windows.System.AutoLoggerDiagtrackListener](https://docs.velociraptor.app/exchange/artifacts/pages/autologgerdiagtracklistener/): AutoLogger-Diagtrack-Listener.etl is a potential source of evidence of execution and other system … - [Windows.System.BinaryVersion](https://docs.velociraptor.app/exchange/artifacts/pages/binaryversion/): This artifact will search the MFT for any matching filenames and return binary details. This … - [Windows.System.IsClrProcess](https://docs.velociraptor.app/exchange/artifacts/pages/isclrprocess/): Identify running processes that host the .NET Common Language Runtime (CLR) and highlight suspicious … - [Windows.System.PowerEfficiencyDiagnostics](https://docs.velociraptor.app/exchange/artifacts/pages/powerefficiencydiagnostics/): This artifact parses the XML Energy Reports from the Power Efficiency Diagnostics feature of … - [Windows.System.Powershell.ISEAutoSave](https://docs.velociraptor.app/exchange/artifacts/pages/iseautosave/): This artifact hunts for Powershell ISE autosave files and extracts ISE user config. Powershell ISE … - [Windows.System.PrinterDriver](https://docs.velociraptor.app/exchange/artifacts/pages/printerdriver/): This artifact will enumerate installed PrintDrivers using the Win32_PrinterDriver wmi class and … - [Windows.System.Recall.AllWindowEvents](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.recall.allwindowevents/): This artifact will read and correlate several tables to do with Microsoft Recall. The main database … - [Windows.System.Recall.WindowCaptureEvent](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.recall.windowcaptureevent/): This artifact will read and correlate several tables to do with Microsoft Recall. The main database … - [Windows.System.Services.SliverPsexec](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.services.sliverpsexec/): This pack detects various artifacts left behind by default configurations of the C2 framework Sliver … - [Windows.System.WindowsErrorReporting](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.windowserrorreporting/): Parses several Windows Error Reporting (WER) files that contain information about crashed programs. … - [Windows.System.WMIProviders](https://docs.velociraptor.app/exchange/artifacts/pages/windows.system.wmiproviders/): List the WMI providers in the system. It is possible to laterally move by installing a fake provider … - [Windows.Timeline.Prefetch.Improved](https://docs.velociraptor.app/exchange/artifacts/pages/windows.timeline.prefetch.improved/): NOTE: This is a fixed version of Windows.Timeline.Prefetch which is available in the release binary … - [Windows.Triage.HighValueMemory](https://docs.velociraptor.app/exchange/artifacts/pages/windows.triage.highvaluememory/): Dump process memory and upload to the server Common Archive Utilities: Winrar, Winzip, 7-zip, … - [Windows.Triage.ScreenConnect](https://docs.velociraptor.app/exchange/artifacts/pages/screenconnect/): This artifact extracts useful data for triage of ConnectWise ScreenConnect CVE-2024-1709 and … - [Windows.Triage.Sysmon](https://docs.velociraptor.app/exchange/artifacts/pages/sysmontriage/): This artifact allows collecting Sysmon Events for Triage around a timestamp. By default collection … - [Windows.Utils.DefenderExclusion](https://docs.velociraptor.app/exchange/artifacts/pages/defenderexclusion/): Adds a Microsoft Defender real-time scanning process exclusion for Velociraptor. Generally you … - [Windows.Veeam.RestorePoints.BackupFiles](https://docs.velociraptor.app/exchange/artifacts/pages/windows.veeam.restorepoints.backupfiles/): Parses the metadata found in Veeam full backup files (.vbk), Veeam incremental backup files (.vib) … - [Windows.Veeam.RestorePoints.MetadataFiles](https://docs.velociraptor.app/exchange/artifacts/pages/windows.veeam.restorepoints.metadatafiles/): Parses the metadata found in Veeam backup chain metadata files (.vbm) to extract relevant fields for … - [Windows.Vhdx.RemapConfigBuilder](https://docs.velociraptor.app/exchange/artifacts/pages/windows.vhdx.remapconfigbuilder/): Create remapping configuration YAML file(s) to virtually mount VHDX profiles into virtual … - [Windows.Vhdx.Sys.Users](https://docs.velociraptor.app/exchange/artifacts/pages/windows.vhdx.sys.users/): List User accounts by inspecting registry keys. This method is a reliable indicator for users who … - [Windows.Vhdx.VirtualClientRemover](https://docs.velociraptor.app/exchange/artifacts/pages/windows.vhdx.virtualclientremover/): Kill the Velociraptor agent used for the VHDX profiles virtual host. This artifact is part of the … - [Windows.Vhdx.VirtualClientRunner](https://docs.velociraptor.app/exchange/artifacts/pages/windows.vhdx.virtualclientrunner/): Run the Velociraptor agent using the remapping configuration created. This agent allow to virtually … - [Windows.WinSCP.Passwords](https://docs.velociraptor.app/exchange/artifacts/pages/custom.windows.winscp.passwords/): Extract WinSCP obfuscated saved passwords from registry. Further information regarding deobfuscation … ## Artifact Reference ## Knowledge Base - [GRPC error, received message larger than max](https://docs.velociraptor.app/knowledge_base/tips/grpc_errors/): GRPC error, received message larger than maxThis error occurs when an API call attempts to transfer … - Published 2026-06-03 - [How to monitor event artifact errors](https://docs.velociraptor.app/knowledge_base/tips/monitoring_artifact_errors/): How to monitor event artifact errorsClient and server event artifacts run continuously in the … - Published 2026-05-12 - [How to send e-mails from Velociraptor](https://docs.velociraptor.app/knowledge_base/tips/sending_email/): How to send e-mails from VelociraptorVelociraptor can send e-mails for a range of purposes: … - Published 2026-05-12 - [How to set up e-mail notifications for flow completions](https://docs.velociraptor.app/knowledge_base/tips/email_alerts/): How to set up e-mail notifications for flow completionsServer.Monitor.FlowCompletion sends an e-mail … - Published 2026-05-12 - [Reference list of known VQL DEFAULT-level errors](https://docs.velociraptor.app/knowledge_base/tips/vql_error_catalogue/): Reference list of known VQL DEFAULT-level errorsMany native VQL functions and plugins log errors at … - Published 2026-05-12 - [Using alerts in Velociraptor](https://docs.velociraptor.app/knowledge_base/tips/vql_alerts/): Using alerts in VelociraptorThe alert() function routes a message into the Server.Internal.Alerts … - Published 2026-05-12 - [How to create and use an offline collector as a tool](https://docs.velociraptor.app/knowledge_base/tips/offline_collector_tool/): How to create and use an offline collector as a toolThis article demonstrates how to create a … - Published 2026-03-26 - [Encrypt and decrypt an offline collector using PGP public and private keys](https://docs.velociraptor.app/knowledge_base/tips/encrypt_offline_collector_pgp/): Encrypt and decrypt an offline collector using PGP public and private keysVelociraptor supports … - Published 2026-03-07 - [How to set up OIDC authentication using ADFS](https://docs.velociraptor.app/knowledge_base/tips/setup_adfs/): How to set up OIDC authentication using ADFSThis guide walks you through the configuration of … - Published 2026-01-26 - [How to create an "online collector" binary](https://docs.velociraptor.app/knowledge_base/tips/online_collector/): How to create an “online collector” binaryVelociraptor offline collectors are immensely … - Published 2025-11-14 - [How to set up a GCS Bucket for file uploads](https://docs.velociraptor.app/knowledge_base/tips/setup_gcs_storage/): How to set up a GCS Bucket for file uploadsGoogle Cloud Storage buckets can be a useful upload … - Published 2025-11-14 - [How to set up a SMB share for file uploads](https://docs.velociraptor.app/knowledge_base/tips/setup_smb_share/): How to set up a SMB share for file uploadsSMB is the Microsoft file-sharing protocol which is a … - Published 2025-11-14 - [How to set up Azure Blob Storage for file uploads](https://docs.velociraptor.app/knowledge_base/tips/setup_azure_storage/): How to set up Azure Blob Storage for file uploadsMicrosoft Azure’s Blob Storage service can be … - Published 2025-11-14 - [Pre-populating a server with clients, hunts and flows](https://docs.velociraptor.app/knowledge_base/tips/prepopulate_server/): Pre-populating a server with clients, hunts and flowsWhen setting up a Velociraptor server for … - Published 2025-10-14 - [Manipulating VQL columns and rows](https://docs.velociraptor.app/knowledge_base/tips/operating_on_columns/): Manipulating VQL columns and rowsVQL has a very simple syntax inspired by SQL. At the heart of the … - Published 2025-09-26 - [Detecting Velociraptor misuse](https://docs.velociraptor.app/knowledge_base/tips/velocirator_misuse/): Detecting Velociraptor misuseVelociraptor is widely used by defenders for legitimate forensic and … - Published 2025-08-28 - [How to set up a MinIO (S3-compatible) dropbox server for file uploads](https://docs.velociraptor.app/knowledge_base/tips/dropbox_server/): How to set up a MinIO (S3-compatible) dropbox server for file uploadsAWS S3 buckets can be a useful … - Published 2025-07-05 - [How to automatically post process flows with an external program.](https://docs.velociraptor.app/knowledge_base/tips/post_process_with_external_program/): How to automatically post process flows with an external program.Sometimes we want to automatically … - Published 2025-06-29 - [How do I configure Cloudflare Dynamic DNS?](https://docs.velociraptor.app/knowledge_base/tips/cloudflare_checkip/): How do I configure Cloudflare Dynamic DNS?Setting up Cloudflare as your preferred dynamic DNS … - Published 2025-06-18 - [How do I setup Velociraptor with a CloudFlare Tunnel?](https://docs.velociraptor.app/knowledge_base/tips/cloudflare_tunnel/): How do I setup Velociraptor with a CloudFlare Tunnel?For this tutorial I have built Velociraptor on … - Published 2025-05-19 - [How to set up authentication using Google OAuth SSO](https://docs.velociraptor.app/knowledge_base/tips/setup_google_oauth/): How to set up authentication using Google OAuth SSOThis guide walks you through the configuration of … - Published 2025-04-28 - [How to set up a SFTP server for file uploads](https://docs.velociraptor.app/knowledge_base/tips/setting_up_sftp/): How to set up a SFTP server for file uploadsThere are many options for receiving file uploads from … - Published 2025-02-25 - [How to set up OIDC authentication using Keycloak](https://docs.velociraptor.app/knowledge_base/tips/setup_keycloak/): How to set up OIDC authentication using KeycloakThis guide walks you through the configuration of … - Published 2024-12-28 - [Set operations in VQL](https://docs.velociraptor.app/knowledge_base/tips/set_operations/): Set operations in VQLSet operations are useful in a number of useful scenarios. What are sets? Sets … - Published 2024-12-16 - [How do I get a list of hunts across multiple organizations?](https://docs.velociraptor.app/knowledge_base/tips/multi_org/): How do I get a list of hunts across multiple organizations?Are you looking for a way to generate … - Published 2024-12-06 - [Error "Parameter refers to an unknown artifact" when collecting a CLIENT artifact](https://docs.velociraptor.app/knowledge_base/tips/collect_artifact_unknown/): Error “Parameter refers to an unknown artifact” when collecting a CLIENT artifactBefore … - Published 2024-08-31 - [How to manage storage space on the server](https://docs.velociraptor.app/knowledge_base/tips/deleting_old_data/): How to manage storage space on the serverVelociraptor can collect a lot of data quickly but usually … - Published 2024-07-19 - [How do I enable password protected VFS downloads?](https://docs.velociraptor.app/knowledge_base/tips/download_password/): How do I enable password protected VFS downloads?You can just export them from the GUI! Set the … - Published 2024-03-18 - [How do you generate random characters?](https://docs.velociraptor.app/knowledge_base/tips/random/): How do you generate random characters?Using the rand() function we can manipulate the results to … - Published 2023-08-09 - [How can I clone an organization with all its hunts and artifacts to another instance?](https://docs.velociraptor.app/knowledge_base/tips/clone_organization_to_other_server/): How can I clone an organization with all its hunts and artifacts to another instance?There are a few … - Published 2023-07-24 - [What to do about error "Plugin info not found"](https://docs.velociraptor.app/knowledge_base/tips/plugin_not_found/): What to do about error “Plugin info not found”Velociraptor VQL queries can run on the … - Published 2023-05-05 - [Custom quarantine exclusions](https://docs.velociraptor.app/knowledge_base/tips/quarantine/): Custom quarantine exclusionsWe may want to add custom exclusions to Velociraptor quarantine and … - Published 2023-03-04 - [How can I convert decimal?](https://docs.velociraptor.app/knowledge_base/tips/decimaldecode/): How can I convert decimal?During investigation you may find logs or other data with decimal-encoded … - Published 2022-11-02 - [How do I re-collect a failed artifact in a hunt?](https://docs.velociraptor.app/knowledge_base/tips/retry_hunt/): How do I re-collect a failed artifact in a hunt?Sometimes collecting an artifact in a hunt does not … - Published 2022-09-10 - [How to control hunting by label groups?](https://docs.velociraptor.app/knowledge_base/tips/hunt_by_label/): How to control hunting by label groups?In Velociraptor, Hunts are sets of the same collections … - Published 2022-09-10 - [How do I get the latest release binary?](https://docs.velociraptor.app/knowledge_base/tips/getting_latest_release/): How do I get the latest release binary?The Velociraptor release process uses a release branch to … - Published 2022-09-03 - [How can I url/percent decode a string?](https://docs.velociraptor.app/knowledge_base/tips/urldecode/): How can I url/percent decode a string?During investigation you may find logs or other data with … - Published 2022-06-06 - [How can I make a multipart/form-data POST request in VQL](https://docs.velociraptor.app/knowledge_base/tips/multiparts_uploads/): How can I make a multipart/form-data POST request in VQLNOTE: The technique described in this … - Published 2022-05-21 - [Applying labels to hunt results](https://docs.velociraptor.app/knowledge_base/tips/huntlabel/): Applying labels to hunt resultsSometimes it is useful to label clients from a hunt. For the … - Published 2022-05-20 - [How can I quickly reconfigure an offline collector?](https://docs.velociraptor.app/knowledge_base/tips/reconfigure_offline_collector/): How can I quickly reconfigure an offline collector?The offline collector is a pre-configured version … - Published 2022-05-06 - [How can I override the configuration file?](https://docs.velociraptor.app/knowledge_base/tips/merging_config/): How can I override the configuration file?Velociraptor relies on the configuration file to control … - Published 2022-04-26 - [How can I save my favorite collections for the future?](https://docs.velociraptor.app/knowledge_base/tips/favorites/): How can I save my favorite collections for the future?Sometimes we tend to collect the same set of … - Published 2022-04-26 - [How to fix "certificate has expired or not yet valid error"?](https://docs.velociraptor.app/knowledge_base/tips/rolling_certificates/): How to fix “certificate has expired or not yet valid error”?When Velociraptor generates … - Published 2022-04-26 - [How to initialize a Velociraptor server with custom artifacts?](https://docs.velociraptor.app/knowledge_base/tips/startup_artifacts/): How to initialize a Velociraptor server with custom artifacts?Velociraptor frontend process has a … - Published 2022-04-26 - [What do I do about "version GLIBC_2.xx not found" errors?](https://docs.velociraptor.app/knowledge_base/tips/glibc_errors/): What do I do about “version GLIBC_2.xx not found” errors? TLDR - use the musl build Use … - Published 2022-04-26 - [How do I search for registry keys](https://docs.velociraptor.app/knowledge_base/tips/registry_finder/): How do I search for registry keysTo search the registry simply use the “registry” … - Published 2022-04-25 - [How do I use my own SSL certificates?](https://docs.velociraptor.app/knowledge_base/tips/ssl/): How do I use my own SSL certificates?Use case: For an on-premises deployment, Let’s Encrypt … - Published 2022-04-18 - [How do I set a proxy for client communications?](https://docs.velociraptor.app/knowledge_base/tips/proxy/): How do I set a proxy for client communications?Many enterprise environments require a proxy to be … - Published 2022-04-15 - [How to increase notebook timeout](https://docs.velociraptor.app/knowledge_base/tips/notebook_timeout/): How to increase notebook timeoutIn the notebook, VQL queries are limited to 10 minutes. Once the … - Published 2022-03-29 - [How do I upgrade my server and clients?](https://docs.velociraptor.app/knowledge_base/tips/upgrading/): How do I upgrade my server and clients?To upgrade the Velociraptor server to a new version, simply … - Published 2022-03-27 - [In VQL, can I SELECT a column with special characters in its name?](https://docs.velociraptor.app/knowledge_base/tips/identifier_with_space/): In VQL, can I SELECT a column with special characters in its name?Sometimes a VQL query will emit a … - Published 2022-03-27 - [How can I configure Velociraptor for multiple SSO providers](https://docs.velociraptor.app/knowledge_base/tips/multiple_oauth/): How can I configure Velociraptor for multiple SSO providersVelociraptor can be configured to use a … - Published 2022-03-26 - [How do I debug the client while it is running?](https://docs.velociraptor.app/knowledge_base/tips/debugging_clients/): How do I debug the client while it is running?Sometimes we collect artifacts from clients but for … - Published 2022-03-21 - [How do I deploy the client as agentless (without install)?](https://docs.velociraptor.app/knowledge_base/tips/deploying_in_agentless_mode/): How do I deploy the client as agentless (without install)?Sometimes we need to deploy Velociraptor … - Published 2022-03-21 - [](https://docs.velociraptor.app/knowledge_base/tips/automating_labels/): How can I automatically apply labels to clients?Labels are used to target clients in Velociraptor. … - [](https://docs.velociraptor.app/knowledge_base/tips/automating_metadata/): How can I automatically add & update client metadata?Client metadata is used to store custom … - [](https://docs.velociraptor.app/knowledge_base/tips/basic_auth_in_http_client/): Adding basic authentication to the HTTP secretThe http_client() plugin can use a server secret to … ## Training Resources ### Playbooks - [Finding Files](https://docs.velociraptor.app/training/playbooks/finding_files/): One of the most common operations in DFIR is searching for files efficiently. When searching for a … - Published 2025-03-29 - [Preserving Forensic Evidence](https://docs.velociraptor.app/training/playbooks/preservation/): As a system administrator you have a high level of confidence a certain endpoint is compromised. You … - Published 2024-08-08 - [Triaging Logs](https://docs.velociraptor.app/training/playbooks/triage-logs/): An endpoint is suspected of being compromised but you don’t know exactly what happened. You … - Published 2024-08-08 ### Comparisons - [EZ Tools](https://docs.velociraptor.app/training/comparisons/eztools/): AmCacheParser This program is different from other Amcache parsers in that it does not dump … - [RawCopy](https://docs.velociraptor.app/training/comparisons/raw_copy/): RawCopy This a console application that copy files off NTFS volumes by using low level disk reading … ## Presentations - [Auscert Workshop 2021](https://docs.velociraptor.app/presentations/2021_auscert/): This talk was given at the Annual Auscert conference as a long form (4h) workshop … - [DFRWS US 2021 Workshop](https://docs.velociraptor.app/presentations/2021_dfrws_us/): This workshop will be hosted on Thursday, July 15 2021. It will be delivered remotely so you can … - [Open Source Digital Forensic Conference 2021](https://docs.velociraptor.app/presentations/2021_osdfc/): This talk was given at the Open Source Digital Forensic conference 2021 … - [Blue Team Village 2021](https://docs.velociraptor.app/presentations/2021_blueteam_village/): This talk was given at the Blue Team Village at DefCon 2021 Video Slides > - [Linux Conf Au 2022](https://docs.velociraptor.app/presentations/2022_linuxconf_au/): This talk was given at the Linux Conference 2022 remotely … - [Auscert Workshop 2022](https://docs.velociraptor.app/presentations/2022_auscert/): At Auscert 2022, The Velociraptor team gave a 4 hour workshop and a Presentation. Below you will … - [DFRWS US 2022](https://docs.velociraptor.app/presentations/2022_dfrws_us/): At DFRWS US 2022, Mike gave a 4 hour workshop. Below you will find the slides. Workshop: … - [Tech Users Group 2022](https://docs.velociraptor.app/presentations/2022_tech_user_group_cbr/): Digging Deeper with Velociraptor Join us for a Live Workshop on Digging Deeper with Velociraptor | … - [SANS Threat Hunting Summit 2022](https://docs.velociraptor.app/presentations/2022_sans_summit/): How to unlock achievements in Threat Hunting using Velociraptor Velociraptor is the open source DFIR … - [Velocon 2022](https://docs.velociraptor.app/presentations/2022_velocon/): On Sept 15, 2022 We held our first VeloCon - a day-long virtual summit as we DIG DEEPER TOGETHER! … - [DFRWS APAC 2022](https://docs.velociraptor.app/presentations/2022_dfrws_apac/): At DFRWS APAC 2022, Mike gave a 4 hour workshop. Below you will find the slides. Workshop: … - [Everything Open Conference 2023](https://docs.velociraptor.app/presentations/2023_everything_open/): Full agenda Incident Response with VelociraptorWith the increased prevalence of CyberCrime in recent … - [Auscert Workshop 2023](https://docs.velociraptor.app/presentations/2023_auscert/): This workshop took place on the 10th May 2023. Incident Response with Velociraptor With the … - [VeloCON 2023](https://docs.velociraptor.app/presentations/2023_velocon/): On September 13th 2023, we held the 2nd annual VeloCON virtual summit. VeloCON is a 1 day event … - [Auscert Workshop 2024](https://docs.velociraptor.app/presentations/2024_auscert/): This workshop took place on the 22nd May 2024. This is an introductory workshop to Velociraptor … - [Advances in Detection Engineering](https://docs.velociraptor.app/presentations/2024_auscert-detection-engineering/): Abstract As defenders, we rely on having an efficient and effective detection capabilities so we can … - [Detection Engineering in Incident Response](https://docs.velociraptor.app/presentations/2025_auscert-detection-engineering/): This workshop was held at the Auscert 2025 Conference, May 20th 2025. Abstract Detection engineering … ## Documentation Development Guidelines - [Setting up a Hugo development server](https://docs.velociraptor.app/dev/dev-server/): This guide will help you get your local development environment up and running with Hugo, which is … - [Guidelines for prose (written content)](https://docs.velociraptor.app/dev/prose-guidelines/): This document provides guidance for the writing style in the Velociraptor documentation. It … - [Guidelines for creating image content](https://docs.velociraptor.app/dev/image-guidelines/): This document provides guidance for creating image content for the Velociraptor documentation. It … - [Test Content](https://docs.velociraptor.app/dev/test/): A page for testing and previewing the presentation of common content components - [Linting with Vale](https://docs.velociraptor.app/dev/vale_linting/): What is Vale? Vale documentation Vale is a command-line tool that brings code-like linting to prose. … - Published 2026-05-01 ## Other Velocidex Projects - [Binparsergen](https://docs.velociraptor.app/golang/binparsergen/): - [EVTX](https://docs.velociraptor.app/golang/evtx/): - [Go ESE Parser](https://docs.velociraptor.app/golang/go-ese/): - [Go YARA](https://docs.velociraptor.app/golang/go-yara/): - [Go-NTFS](https://docs.velociraptor.app/golang/go-ntfs/): - [Go-PE](https://docs.velociraptor.app/golang/go-pe/): - [Go-Prefetch](https://docs.velociraptor.app/golang/go-prefetch/): - [OleParser](https://docs.velociraptor.app/golang/oleparse/): - [Regparser](https://docs.velociraptor.app/golang/regparser/): - [Timetracker](https://docs.velociraptor.app/golang/timetracker/): - [Velociraptor](https://docs.velociraptor.app/golang/velociraptor/): - [Vfilter](https://docs.velociraptor.app/golang/vfilter/): - [Vtypes](https://docs.velociraptor.app/golang/vtypes/): ## Root Pages - [RSS Feeds](https://docs.velociraptor.app/rss/): This site has a the following RSS feeds that you can follow. Blog Posts … - [Search](https://docs.velociraptor.app/search/): Tags acquisition  4 activedirectory  1 admin  1 alerts  8 amazon  1 … - Published 2021-06-12 - [Discord](https://docs.velociraptor.app/discord/): - [YouTube](https://docs.velociraptor.app/youtube/): --- Generated on 2026-09-20 12:32:19 UTC Site: https://docs.velociraptor.app/