Chapter 42

Velociraptor for Forensics

Velociraptor is an open-source digital forensics and incident response platform that enables rapid endpoint collection at fleet scale. Its query language (VQL) lets you write custom artifact collection queries that run simultaneously across hundreds of endpoints in minutes — impossible with traditional KAPE/manual collection approaches.

Scenario

You've confirmed Cobalt Strike on FINANCE-SRV01. The question: is the same beacon running on any other host in the 2,000-endpoint environment? A KAPE scan of 2,000 machines would take days to orchestrate manually. A Velociraptor hunt deploys in minutes, queries all endpoints simultaneously, and returns results within 30–60 minutes. The hunt scans process memory for Cobalt Strike named pipe patterns and finds the same beacon on 3 additional hosts — all in the finance subnet, all presumably accessed via the same stolen credential.

VQL Fundamentals

VQL (Velociraptor Query Language) is a SQL-like language for forensic queries. It runs on the server for analysis or on endpoints for collection:

VQLvql-examples.sql

-- List running processes with parent chain
SELECT Pid, Name, CommandLine, Ppid, Username,
       Exe, CreateTime
FROM pslist()
ORDER BY CreateTime DESC
LIMIT 100

-- Find processes with network connections
SELECT Pid, Name, Laddr, Raddr, Status, Type
FROM netstat()
WHERE Raddr.IP != "0.0.0.0"
  AND Raddr.IP != "::"

-- Find executables running from suspicious paths
SELECT Pid, Name, Exe, CommandLine, CreateTime
FROM pslist()
WHERE Exe =~ "(\\\\Temp\\\\|\\\\AppData\\\\|\\\\PerfLogs\\\\)"
  AND Name !~ "MicrosoftEdge|Teams"

-- Search registry for common persistence keys
SELECT Key, Value, Data, Mtime
FROM read_reg_key(
    globs="HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
)

-- Collect prefetch files
SELECT Name, Size, Mtime
FROM glob(globs="C:/Windows/Prefetch/*.pf")
ORDER BY Mtime DESC
LIMIT 50

Fleet-Wide Threat Hunting with Velociraptor

VQLcobalt-strike-hunt.vql

-- Hunt for Cobalt Strike named pipe patterns across the fleet
-- Cobalt Strike uses named pipes for inter-process communication

SELECT Pid, Name, PipeName, CreateTime, Fqdn AS Hostname
FROM handles()
WHERE Type = "File"
  AND Name =~ "\\\\pipe\\\\(MSSE-[a-f0-9]+-server|postex_[a-f0-9]+|msagent_[a-z0-9]+)"

-- Also hunt for beacon config in memory by scanning for CS magic bytes
-- (This requires Windows.Memory.ScanProcesses artifact)

-- Hunt for suspicious services (PSExec/lateral movement installation)
SELECT Name, DisplayName, State, StartMode,
       BinaryPath, CreationTime
FROM Artifact.Windows.System.Services()
WHERE BinaryPath =~ "(%TEMP%|%APPDATA%|C:\\\\Users\\\\)"
  OR Name =~ "^(PSEXECSVC|[0-9a-f]{8})"

-- Hunt for scheduled tasks pointing to suspicious locations
SELECT Name, Action, Trigger, Principal, Path
FROM Artifact.Windows.System.ScheduledTasks()
WHERE Action =~ "(\\\\Temp\\\\|\\\\AppData\\\\Roaming\\\\)"
   OR Action =~ "powershell.+(-enc|-e |IEX|bypass)"

Bashvelociraptor-hunt.sh

# Velociraptor server CLI — create a hunt, collect, download results

# Start a hunt against all Windows endpoints
velociraptor \
    --config /etc/velociraptor/server.config.yaml \
    query --format jsonl << 'EOF'
LET hunt_id = hunt(
    description="CS Named Pipe Hunt - CASE-2026-009",
    artifacts=["Windows.Memory.Handles"],
    parameters=dict(
        HandleFilter="\\\\pipe\\\\MSSE-[a-f0-9]+-server",
        ProcessRegex="."
    ),
    include_labels=["Windows"]
)
SELECT hunt_id
EOF

# Monitor hunt progress
velociraptor --config /etc/velociraptor/server.config.yaml \
    query "SELECT * FROM hunts() WHERE HuntId = 'H.1234'"

# Download hunt results
velociraptor \
    --config /etc/velociraptor/server.config.yaml \
    hunt_results -h H.1234 \
    --artifact Windows.Memory.Handles \
    --format csv \
    > /cases/CASE-2026-009/hunt-results-CS-pipes.csv

# Check results
cat /cases/CASE-2026-009/hunt-results-CS-pipes.csv | \
    awk -F, 'NR>1 {print $1, $3}' | sort | uniq

Key Built-In Artifacts

Artifact	What it collects	Use case
Windows.KapeFiles.Targets	KAPE-equivalent artifact collection	Full triage collection from remote endpoint
Windows.Memory.ProcessDump	Dump specific process to file	Remote memory acquisition of suspicious process
Windows.System.Pslist	Running process list with details	Process survey across fleet
Windows.Network.Netstat	Network connections with process info	Active C2 connection identification
Windows.EventLogs.EvtxHunter	Search event logs by EventID/regex	Fleet-wide event ID hunting without collecting all logs
Windows.Persistence.PermanentWMIEvents	WMI event subscriptions (persistence)	Hunt for WMI-based persistence across all endpoints

Q & A

Q: Velociraptor requires deploying an agent on every endpoint. How do you handle endpoints you can't deploy the agent on (legacy systems, OT/ICS, offline hosts)?

Velociraptor has offline collection mode: package a standalone executable with embedded artifact configuration (velociraptor-v0.7.0-windows-amd64.exe config repack --exe velociraptor.exe collector.yaml). The resulting binary runs without a server connection, collects the configured artifacts, and writes results to a zip file on the local disk or a network share — no agent installation required, no persistent process. The analyst then imports the zip file into the server for analysis. For OT/ICS environments: (1) use KAPE instead, which is also portable-binary-based with no installation; (2) collect artifacts via read-only mounted images rather than live agent collection; (3) for truly isolated systems, use FTK Imager portable + manual artifact collection. The key is that the choice of tool depends on what the endpoint can support — Velociraptor is preferred when it can be deployed, but offline collection mode and KAPE cover cases where it can't.