Velociraptor
Was ist Velociraptor?
VelociraptorAn open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts.
Velociraptor is an open-source DFIR and endpoint-visibility platform built around a custom query language called VQL (Velociraptor Query Language). A Velociraptor server orchestrates lightweight agents on Windows, Linux, and macOS endpoints; analysts write or pick VQL artifacts that collect specific evidence (registry hives, MFT, $UsnJrnl, browser history, Sysmon events, persistence locations, memory captures, YARA hits) or perform live response actions (kill process, isolate host, dump memory). Velociraptor is unusually flexible compared to traditional EDR: artifacts are version-controlled YAML+VQL, so a community library of hunts and forensic collectors is published and reused widely (Rapid7's velociraptor-artifacts repo, the SANS community list). Use cases include large-scale hunting across thousands of hosts, bulk artifact collection during IR, evidence preservation, and continuous endpoint monitoring. Originally written by Mike Cohen (also behind GRR), Velociraptor was acquired by Rapid7 in 2021 but remains AGPL-licensed open source with active community development.
● Beispiele
- 01
An IR team deploys Velociraptor across 5,000 endpoints to hunt for a specific YARA-detected backdoor and collect MFT + Prefetch + Amcache wherever it matches.
- 02
An incident playbook fires a Velociraptor 'Acquire Triage' hunt that pulls a Kape-equivalent artifact set from every endpoint into the server within an hour.
● Häufige Fragen
Was ist Velociraptor?
An open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts. Es gehört zur Kategorie Forensik und Incident Response der Cybersicherheit.
Was bedeutet Velociraptor?
An open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts.
Wie funktioniert Velociraptor?
Velociraptor is an open-source DFIR and endpoint-visibility platform built around a custom query language called VQL (Velociraptor Query Language). A Velociraptor server orchestrates lightweight agents on Windows, Linux, and macOS endpoints; analysts write or pick VQL artifacts that collect specific evidence (registry hives, MFT, $UsnJrnl, browser history, Sysmon events, persistence locations, memory captures, YARA hits) or perform live response actions (kill process, isolate host, dump memory). Velociraptor is unusually flexible compared to traditional EDR: artifacts are version-controlled YAML+VQL, so a community library of hunts and forensic collectors is published and reused widely (Rapid7's velociraptor-artifacts repo, the SANS community list). Use cases include large-scale hunting across thousands of hosts, bulk artifact collection during IR, evidence preservation, and continuous endpoint monitoring. Originally written by Mike Cohen (also behind GRR), Velociraptor was acquired by Rapid7 in 2021 but remains AGPL-licensed open source with active community development.
Wie schützt man sich gegen Velociraptor?
Schutzmaßnahmen gegen Velociraptor kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Velociraptor?
Übliche alternative Bezeichnungen: Velociraptor DFIR.
● Verwandte Begriffe
- forensics-ir№ 343
DFIR (Digitale Forensik und Incident Response)
Kombinierte Disziplin, die digitale forensische Ermittlung und Incident Response zusammenführt, um Vorfälle zu erkennen, einzudämmen, zu bereinigen und auszuwerten.
- forensics-ir№ 582
Incident Response
Strukturierter Prozess zur Vorbereitung, Erkennung, Analyse, Eindämmung, Bereinigung und Wiederherstellung nach Cyber-Sicherheitsvorfällen mit anschließender Auswertung.
- defense-ops№ 1267
Threat Hunting
Proaktive, hypothesengetriebene Suche in der Telemetrie nach Bedrohungen, die bestehenden Detektionen entgangen sind.
- forensics-ir№ 742
Memory-Forensik
Disziplin zur Sicherung und Analyse des flüchtigen Arbeitsspeichers, um Prozesse, Netzwerkverbindungen, injizierten Code und In-Memory-Artefakte aufzudecken.
- forensics-ir№ 646
KAPE (Kroll Artifact Parser and Extractor)
Ein Windows-Triage-Tool von Kroll, das forensische Artefakte von Live-Systemen oder Images einsammelt und mit Parser-Modulen direkt auswertbare Ergebnisse erzeugt.
- defense-ops№ 1393
YARA-Regel
Eine textuelle Signatur in der YARA-Sprache, die Byte-, String- oder Verhaltensmuster beschreibt, um Malware-Samples und Dateien zu klassifizieren und zu erkennen.