Modern cyber attacks move quickly. Attackers use legitimate tools, trusted processes, and built-in operating system features to avoid detection. Automated security tools identify many threats, but they cannot detect every attack. Security teams must actively search for suspicious activity that does not generate an alert.
Threat hunting provides this capability.
Threat hunting is a proactive security activity. Analysts develop a hypothesis, collect evidence, and determine whether malicious activity exists. Success depends on having detailed visibility into endpoint systems.
Velociraptor provides that visibility.
What Is Velociraptor?
Velociraptor is an open-source digital forensics and incident response (DFIR) platform. It allows security teams to collect forensic artifacts, perform endpoint investigations, and execute threat hunting activities across thousands of systems from a central server.
Unlike traditional endpoint monitoring tools, Velociraptor collects information on demand. Analysts can request specific artifacts when they need them instead of collecting every event continuously.
This approach reduces unnecessary data collection while providing deep visibility during investigations.
Why Velociraptor Matters
Every investigation begins with questions.
– Did PowerShell execute on this device?
– Does this system contain evidence of persistence?
– Has malware created scheduled tasks?
– Are suspicious processes running?
– Which users logged on recently?
– Does the system contain indicators of compromise?
Velociraptor can answer these questions quickly.
It collects data directly from the endpoint. Analysts do not need to rely only on SIEM data or endpoint alerts.
This capability makes Velociraptor valuable for proactive threat hunting and incident response.
How Velociraptor Works
Velociraptor uses a client-server architecture.
The Velociraptor client runs on each managed endpoint. The server coordinates collections, distributes artifacts, and stores the results.
Instead of continuously transmitting large amounts of telemetry, the client performs collections only when requested or when a scheduled hunt runs.
This design reduces network traffic and storage requirements while providing flexibility during investigations.
The Power of Artifacts
Artifacts are one of Velociraptor’s most important features.
An artifact defines what information to collect from an endpoint. It can collect files, registry keys, event logs, memory information, process details, browser data, and many other forensic objects.
Artifacts use the Velociraptor Query Language (VQL) to retrieve information.
Security teams can use built-in artifacts or create custom artifacts that match their environment.
This flexibility allows organizations to automate common investigations and standardize data collection.
Threat Hunting with Velociraptor
Threat hunting begins with a hypothesis.
For example, an analyst may suspect that an attacker established persistence through a scheduled task.
Using Velociraptor, the analyst can collect scheduled task information from every endpoint in the environment.
The analyst reviews the results for:
– Unknown task names.
– Suspicious executable paths.
– Unexpected PowerShell commands.
– Tasks created outside normal maintenance windows.
If suspicious activity exists, the investigation expands to additional artifacts, such as process execution, registry modifications, or network configuration.
This workflow allows analysts to investigate thousands of systems without manually connecting to each endpoint.
Common Hunting Scenarios
Velociraptor supports many threat hunting activities.
Common examples include:
Persistence
Collect information about:
– Scheduled tasks.
– Windows services.
– Startup folders.
– Registry Run keys.
– WMI event subscriptions.
These locations often contain persistence mechanisms.
Process Analysis
Review running processes and historical execution artifacts.
Look for:
– Unusual parent-child relationships.
– Unsigned executables.
– PowerShell activity.
– LOLBins.
– Processes running from temporary directories.
File System Analysis
Search endpoints for:
– Recently created executable files.
– Suspicious scripts.
– Archive files.
– Password dumping tools.
– Remote administration utilities.
Collect file hashes when additional analysis is required.
Registry Analysis
Review registry data for:
– Persistence.
– Security configuration changes.
– Disabled security controls.
– Recently executed programs.
Registry analysis often provides valuable historical evidence.
User Activity
Collect artifacts that identify:
– Interactive logons.
– Recently opened files.
– USB device history.
– Browser history.
– Remote Desktop activity.
These artifacts help establish a timeline during an investigation.
Hunt at Scale
One of Velociraptor’s greatest strengths is scalability.
A hunt can target:
– Every endpoint.
– A specific department.
– Servers only.
– Workstations only.
– Systems with a specific operating system.
– Devices that match custom labels.
This capability allows analysts to validate hypotheses across an entire organization in minutes instead of days.
Collect Only What You Need
Large investigations often generate unnecessary data.
Velociraptor allows analysts to collect only the artifacts required for the investigation.
This approach provides several benefits.
It reduces:
– Storage requirements.
– Network traffic.
– Collection time.
– Investigation complexity.
Focused collections also reduce analyst workload.
Support Incident Response
Threat hunting and incident response work together.
A successful hunt often identifies systems that require additional investigation.
Velociraptor provides tools to:
– Collect forensic evidence.
– Retrieve files.
– Execute trusted response actions.
– Acquire memory.
– Gather event logs.
– Build investigation timelines.
Analysts can move from threat hunting to incident response without changing platforms.
Best Practices
Use these practices when threat hunting with Velociraptor:
– Develop a clear hunting hypothesis before collecting data.
– Use built-in artifacts whenever possible.
– Create custom artifacts for organization-specific requirements.
– Validate findings with multiple forensic artifacts.
– Collect only the data required for the investigation.
– Document every hunt.
– Convert successful investigations into repeatable hunts.
– Test new artifacts before deploying them across production systems.
Conclusion
Velociraptor is one of the most powerful platforms available for endpoint threat hunting and digital forensics. It combines scalable endpoint collection with flexible forensic artifacts, allowing analysts to investigate suspicious activity quickly and efficiently.
Unlike tools that rely only on continuous telemetry, Velociraptor gives investigators direct access to endpoint evidence when they need it. This capability reduces investigation time, improves visibility, and supports both proactive threat hunting and incident response.
Organizations that incorporate Velociraptor into their security program gain a flexible platform for investigating attacker behavior, validating security hypotheses, and improving their overall detection capability.
Killian Sherer 