Chapter 31

Velociraptor for IR

Using Velociraptor for large-scale artifact collection, live response, and hunting across hundreds of endpoints simultaneously during an incident — the capabilities EDR doesn't provide.

Scenario

You need to hunt for a specific WMI persistence mechanism across 800 endpoints simultaneously, collect the last 48 hours of PowerShell script block logs from all servers in the finance VLAN, and pull prefetch data from 30 specific machines that don't have EDR deployed. Your EDR can do the first two tasks on covered endpoints, but the third group has no EDR. Velociraptor is an open-source DFIR framework that can deploy an agent to uncovered endpoints during an incident and run structured queries (VQL — Velociraptor Query Language) against thousands of endpoints simultaneously. This chapter covers the IR-specific use cases where Velociraptor excels.

Velociraptor vs EDR: When to Use Each

Task	EDR	Velociraptor
Real-time behavioral detection	Primary tool — continuous monitoring	Not designed for real-time detection; best for point-in-time collection
Host isolation / containment	Yes — native feature, instant	Not designed for isolation; use EDR
Fleet-wide artifact collection (KAPE-style)	Varies by EDR — many don't do comprehensive KAPE-equivalent collection	Excellent — artifacts/kape.org/Targets integration is native
Hosts without EDR agent	No coverage	Velociraptor agent deploys via Group Policy or push, covers unmanaged hosts immediately
Custom forensic queries	Limited to EDR's query language	VQL is extremely flexible — query anything accessible on the host
Memory forensics	Varies by EDR — some have built-in, some don't	Native memory collection via built-in WinPmem integration

VQL Queries for IR

VQL (Velociraptor Query Language) is a SQL-like language for querying endpoint state. These are the most useful queries during an incident.

SQLpersistence-hunt.vql

-- VQL: Hunt for suspicious scheduled tasks across all endpoints
-- Run this from the Velociraptor Hunt Manager

SELECT
    Fqdn,
    TaskName,
    TaskPath,
    Actions,
    Principal.UserId AS RunAs,
    Triggers
FROM
    Artifact.Windows.System.TaskScheduler()
WHERE
    -- Focus on non-Microsoft tasks with suspicious action types
    NOT TaskPath =~ "^\\\\Microsoft\\\\"
    AND (
        Actions =~ "powershell" OR
        Actions =~ "cmd.exe" OR
        Actions =~ "wscript" OR
        Actions =~ "mshta" OR
        Actions =~ "rundll32"
    )

SQLwmi-hunt.vql

-- VQL: Hunt for WMI event subscriptions across all endpoints
-- This catches the WMI persistence that most IR teams miss

SELECT Fqdn, Name, Query, QueryLanguage
FROM Artifact.Windows.Persistence.PermanentWMIEvents()

-- Combined: filter to EventFilters, EventConsumers, and Bindings all at once
SELECT
    Fqdn,
    Type,     -- "Filter", "Consumer", "Binding"
    Name,
    Detail    -- The actual query or command text
FROM Artifact.Windows.Persistence.PermanentWMIEvents()

SQLcollect-pslog.vql

-- VQL: Collect PowerShell Script Block logs from all servers in a hunt
-- Useful for post-incident reconstruction of attacker PowerShell activity

SELECT
    Fqdn,
    EventTime,
    EventID,
    ScriptBlockText
FROM
    Artifact.Windows.EventLogs.PowerShellScriptBlock()
WHERE
    EventTime > "2026-08-01T00:00:00Z"
    AND ScriptBlockText =~ "(?i)(invoke-expression|iex|downloadstring|encodedcommand|frombase64)"
ORDER BY EventTime

Fleet-Wide Collection With KAPE Targets

Velociraptor has native integration with KAPE artifact collection targets. This lets you collect a comprehensive forensic artifact set from hundreds of endpoints simultaneously.

SQLkape-collection.vql

-- VQL: Collect KAPE triage artifacts from all hosts in the IR scope
-- This equivalent of running KAPE on each host, but done remotely at scale

SELECT * FROM Artifact.Windows.KapeFiles.Targets(
    -- Specify which KAPE targets to collect
    _MFT = TRUE,           -- Master File Table
    Prefetch = TRUE,       -- Prefetch execution artifacts
    EventLogs = TRUE,      -- Windows Event Logs
    RegistryHives = TRUE,  -- NTUSER.DAT, SAM, SYSTEM, SOFTWARE hives
    LNKFiles = TRUE,       -- Recent files / shortcuts
    JumpLists = TRUE,      -- User activity artifacts
    BrowserHistory = TRUE, -- Browser artifacts
    SRUM = TRUE            -- System Resource Usage Monitor
)

Emergency Deployment During IR

For hosts without Velociraptor pre-deployed, you can push the agent during an incident using Group Policy or remote admin tools.

PowerShellvelociraptor-deploy.ps1

# Emergency Velociraptor agent deployment to uncovered hosts
# Requires: Velociraptor server already running; agent MSI generated from server

$velociServer = "https://velociraptor.corp.local:8000"
$agentMsi     = "\\fileserver\tools\velociraptor-agent.msi"
$targetHosts  = @("LEGACY-HOST-01", "LEGACY-HOST-02", "SERVER-NOEDR")

foreach ($host in $targetHosts) {
    Invoke-Command -ComputerName $host -ScriptBlock {
        param($msi)
        # Install the Velociraptor agent silently
        Start-Process msiexec.exe -ArgumentList "/i `"$msi`" /quiet /norestart" -Wait
        # Verify the service started
        Get-Service "Velociraptor" | Select-Object Name, Status
    } -ArgumentList $agentMsi

    Write-Host "Deployed to: $host"
}
Write-Host "Agents should appear in Velociraptor console within 60 seconds"

Q & A

Q: Velociraptor returns results from 800 endpoints but the data volume is enormous — gigabytes of raw artifacts. How do you manage analysis at this scale?

Three strategies: (1) Hunt for specific conditions rather than collecting everything and analyzing post-hoc. A VQL query that returns only hosts matching suspicious patterns is vastly more manageable than a full artifact collection from 800 endpoints. Hunt first, collect targeted artifacts from the confirmed subset. (2) Use Velociraptor's built-in notebook feature to run analytical queries directly on the collected data within the platform — summarize, count, filter, and deduplicate before exporting anything. (3) For the artifact collection cases where you genuinely need the raw data: push artifacts to Elasticsearch or Timesketch (a timeline analysis platform that has native Velociraptor integration) for indexed searching rather than trying to process raw files. The pattern is: VQL hunt to identify scope → targeted collection from confirmed hosts → analysis platform for deep dive.