Velociraptor
Qu'est-ce que Velociraptor ?
VelociraptorAn open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts.
Velociraptor is an open-source DFIR and endpoint-visibility platform built around a custom query language called VQL (Velociraptor Query Language). A Velociraptor server orchestrates lightweight agents on Windows, Linux, and macOS endpoints; analysts write or pick VQL artifacts that collect specific evidence (registry hives, MFT, $UsnJrnl, browser history, Sysmon events, persistence locations, memory captures, YARA hits) or perform live response actions (kill process, isolate host, dump memory). Velociraptor is unusually flexible compared to traditional EDR: artifacts are version-controlled YAML+VQL, so a community library of hunts and forensic collectors is published and reused widely (Rapid7's velociraptor-artifacts repo, the SANS community list). Use cases include large-scale hunting across thousands of hosts, bulk artifact collection during IR, evidence preservation, and continuous endpoint monitoring. Originally written by Mike Cohen (also behind GRR), Velociraptor was acquired by Rapid7 in 2021 but remains AGPL-licensed open source with active community development.
● Exemples
- 01
An IR team deploys Velociraptor across 5,000 endpoints to hunt for a specific YARA-detected backdoor and collect MFT + Prefetch + Amcache wherever it matches.
- 02
An incident playbook fires a Velociraptor 'Acquire Triage' hunt that pulls a Kape-equivalent artifact set from every endpoint into the server within an hour.
● Questions fréquentes
Qu'est-ce que Velociraptor ?
An open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts. Cette notion relève de la catégorie Forensique et réponse en cybersécurité.
Que signifie Velociraptor ?
An open-source endpoint-visibility and DFIR platform — originally by Mike Cohen, now Rapid7-stewarded — that uses the VQL query language to hunt, collect artifacts, and respond live across fleets of Windows, Linux, and macOS hosts.
Comment fonctionne Velociraptor ?
Velociraptor is an open-source DFIR and endpoint-visibility platform built around a custom query language called VQL (Velociraptor Query Language). A Velociraptor server orchestrates lightweight agents on Windows, Linux, and macOS endpoints; analysts write or pick VQL artifacts that collect specific evidence (registry hives, MFT, $UsnJrnl, browser history, Sysmon events, persistence locations, memory captures, YARA hits) or perform live response actions (kill process, isolate host, dump memory). Velociraptor is unusually flexible compared to traditional EDR: artifacts are version-controlled YAML+VQL, so a community library of hunts and forensic collectors is published and reused widely (Rapid7's velociraptor-artifacts repo, the SANS community list). Use cases include large-scale hunting across thousands of hosts, bulk artifact collection during IR, evidence preservation, and continuous endpoint monitoring. Originally written by Mike Cohen (also behind GRR), Velociraptor was acquired by Rapid7 in 2021 but remains AGPL-licensed open source with active community development.
Comment se défendre contre Velociraptor ?
Les défenses contre Velociraptor combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de Velociraptor ?
Noms alternatifs courants : Velociraptor DFIR.
● Termes liés
- forensics-ir№ 343
DFIR (Investigation numérique et réponse à incident)
Discipline combinée qui fusionne l'investigation forensique numérique et la réponse à incident pour détecter, contenir, éradiquer et tirer les leçons des incidents de cybersécurité.
- forensics-ir№ 582
Réponse à incident
Processus organisé permettant de préparer, détecter, analyser, contenir, éradiquer puis récupérer suite à un incident de cybersécurité, en capitalisant sur les leçons apprises.
- defense-ops№ 1267
Threat Hunting
Recherche proactive et fondée sur des hypothèses dans la télémétrie pour identifier des menaces ayant échappé aux détections existantes.
- forensics-ir№ 742
Forensique mémoire
Discipline d'acquisition et d'analyse de la RAM volatile d'un système pour révéler processus, connexions réseau, code injecté et artefacts en mémoire.
- forensics-ir№ 646
KAPE (Kroll Artifact Parser and Extractor)
Outil de triage Windows edite par Kroll qui collecte des artefacts forensiques sur des systemes vivants ou des images, puis execute des modules de parsing pour livrer une sortie exploitable.
- defense-ops№ 1393
Regle YARA
Signature textuelle ecrite en langage YARA qui decrit des motifs d'octets, de chaines ou de comportements pour classer et detecter des echantillons de malware et des fichiers.