Velociraptor

No entries match these filters. Clear filters

1. docs update Oct 5, 2026 · issue 095

   Velociraptor 0.77.3 adds official Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. executables and MSI packages, retiring published 32-bit Windows builds.

   • New supported platformRetired supported platformAdds Windows ARM64 executable and MSI pre-built binaries for the first time.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !32-bit Windows binaries are no longer published; build from source using make windowsx86 if needed.
2. v0.77.3 Oct 5, 2026 · issue 095

   Velociraptor v0.77.3 adds Azure Monitor upload, a VQL LSPLSPLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code. server, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Windows support, and custom .deb/.rpm service user/group options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.77.3 https://github.com/Velocidex/velociraptor.git
   # already have the repo? check out this version:
   $ git checkout v0.77.3

   └──▷ USE IT
   Configure fine-grained client logging — separate log files per component with 24-hour rotation — by setting the new Client.Logging keys.
   /etc/velociraptor/client.config.yaml copy

   Client:
     Logging:
       output_directory: /var/log/velociraptor
       separate_logs_per_component: true
       rotation_time: 86400
       max_age: 604800
       error:
         rotation_time: 86400
         max_age: 2592000
         disabled: false

   • Adds azure_monitor_upload() VQL plugin and Azure.Monitor.Upload server-event artifact to stream completed-flow results to an Azure Log Analytics workspace via the Logs Ingestion API, supporting service principal, AZURE_* environment variables, managed identity, and the Azure SDK default credential chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an Azure Monitor Creds secret type for storing Log Analytics credentials and destination in the secrets service.
   • Adds a VQL Language Server ProtocolLanguage Server ProtocolLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code. (LSP) server (velociraptor lsp) providing diagnostics, syntax highlighting, hover, completions, and document symbols for VQL artifact development.
   • Adds an ARM64 Windows build target, with MSI and offline collectors updated to support ARM64 (and x86 support removed).
   • Adds download_transforms option to the inventory service, currently supporting gunzip to decompress gzip-compressed files before storing them in the inventory.

   +2 more show less

   • Adds Client.Logging, Client.Logging.output_directory, Client.Logging.separate_logs_per_component, Client.Logging.rotation_time, Client.Logging.max_age, Client.Logging.debug, Client.Logging.info, Client.Logging.error, Client.Logging.remote_syslog_server, Client.Logging.remote_syslog_protocol, and Client.Logging.remote_syslog_components configuration keys for granular client-side log management.
   • Server.Utils.BackupDirectory, Server.Utils.BackupGCS, and Server.Utils.BackupS3 now emit only ClientId, FlowId, and fields derived from them rather than all columns.
   • Adds azure_monitor_upload() VQL plugin and Azure.Monitor.Upload server-event artifact to stream completed-flow results to an Azure Log Analytics workspace via the Logs Ingestion API, supporting service principal, AZURE_* environment variables, managed identity, and the Azure SDK default credential chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an Azure Monitor Creds secret type for storing Log Analytics credentials and destination in the secrets service.
   • Adds a VQL Language Server ProtocolLanguage Server ProtocolLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code. (LSP) server (velociraptor lsp) providing diagnostics, syntax highlighting, hover, completions, and document symbols for VQL artifact development.
   • Adds an ARM64 Windows build target, with MSI and offline collectors updated to support ARM64 (and x86 support removed).
   • Adds download_transforms option to the inventory service, currently supporting gunzip to decompress gzip-compressed files before storing them in the inventory.

   +1 more show less

   • Adds Client.Logging, Client.Logging.output_directory, Client.Logging.separate_logs_per_component, Client.Logging.rotation_time, Client.Logging.max_age, Client.Logging.debug, Client.Logging.info, Client.Logging.error, Client.Logging.remote_syslog_server, Client.Logging.remote_syslog_protocol, and Client.Logging.remote_syslog_components configuration keys for granular client-side log management.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Server.Utils.BackupDirectory, Server.Utils.BackupGCS, and Server.Utils.BackupS3 now emit only ClientId, FlowId, and derived fields — downstream consumers reading any other column will break and must be updated.
   • !The ARM64 Windows MSI and offline collectors no longer include x86 support.
3. docs update Oct 4, 2026 · issue 094

   Velociraptor deployment docs add certificate pinning, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client auth, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. proxy support, websocket URLs, and 20+ new config keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ USE IT
   Pin clients to a specific server TLS certificate to prevent MITM even from trusted CAs — useful for self-signed or internally issued server certs.
   client.config.yaml copy

   Client:
     Crypto:
       certificate_verification_mode: THUMBPRINT_ONLY
       certificate_thumbprints:
         - E6E28B35CEC5BAC453C5AFBF2B763462405CD06080E1301AA7A5A9DA0C8B11E1

   Require mTLS so that a reverse proxy can reject unauthenticated Velociraptor clients before traffic reaches the frontend.
   copy

   $ # 1. Generate the client key pair signed by the Velociraptor CA:
   velociraptor --config server.config.yaml config api_client --name 'Client' api.config.yaml
   
   # 2. Copy the resulting PEM strings into client.config.yaml:
   # Client:
   #   Crypto:
   #     client_certificate: |
   #       -----BEGIN CERTIFICATE-----
   #       ...
   #       -----END CERTIFICATE-----
   #     client_certificate_private_key: |
   #       -----BEGIN RSA PRIVATE KEY-----
   #       ...
   #       -----END RSA PRIVATE KEY-----

   Route Velociraptor clients through a corporate PAC-file proxy while ignoring environment proxy variables set by other software.
   client.config.yaml copy

   Client:
     proxy_config:
       pac: 'http://proxy.corp.example.com/proxy.pac'
       ignore_environment: true

   • Adds certificate_thumbprints and certificate_verification_mode to Client > Crypto to support TLS certificate pinning (THUMBPRINT_ONLY mode) and hybrid PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.-plus-thumbprint validation (PKI_OR_THUMBPRINT mode).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds client_certificate and client_certificate_private_key to Client > Crypto to enable mTLS mutual authentication between clients and server, with Frontend.require_client_certificates to enforce it on the frontend.
   • Adds root_certs to Client > Crypto to trust additional PEM-encoded root CA certificates, including those without the CA basic constraint, for environments using MITM TLS proxies.
   • Adds allow_weak_tls_server (default false) to Client > Crypto to permit TLS versions below 1.3 for networks with MITM proxies that do not support TLS 1.3.
   • Adds proxy_config block to Client for granular proxy configuration including http, https, proxy_url_regexp, pac (PAC file via file:// or data: URL), and ignore_environment to suppress HTTP_PROXY/HTTPS_PROXY env vars.

   +9 more show less

   • Adds level2_writeback_suffix to Client to create a secondary writeback file as a backup, reducing risk of losing the client ID due to file corruption.
   • Adds prevent_execve (default false) to Client to disable arbitrary code execution on endpoints.
   • Adds max_memory_hard_limit to Client to hard-exit the client process when memory usage (in bytes) exceeds the configured threshold.
   • Adds disable_checkpoints (default false) to Client to suppress crash-detection checkpoint files written at collection start.
   • Adds nanny_max_connection_delay to Client to exit the nanny process if the client fails to send messages to the server within the specified number of seconds.
   • Adds concurrency (default 2) to Client to cap simultaneous VQL queries; URGENT-flagged queries bypass this limit.
   • Adds client_info_update_time (default 86400) to Client to control how often clients send Server.Internal.ClientInfo heartbeat messages.
   • Adds darwin_installer block to Client for macOS service installation settings, alongside the existing windows_installer block.
   • Documents writeback_windows path HKLM\ prefix support to store the writeback in the Windows registry instead of on disk.

   14 details in Everything

4. docs update Sep 22, 2026 · issue 082

   Velociraptor 0.76 adds an offline-capable local documentation search and preview directly in the Admin GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Pre-populate a Velociraptor server with the docs index before taking it into an air-gapped or restricted-network environment so local doc search works without internet access.
   📍Steps: 1. Download the index from https://github.com/Velocidex/velociraptor-docs/raw/refs/heads/gh-pages/docs_index/docs_index_v1.zip 2. In the Velociraptor GUI, navigate to the root org tools inventory and upload the downloaded zip as a tool. 3. Alternatively, run the Server.Utils.UploadTools artifact to have it bundle the docs index automatically.
   Run a precise local doc search targeting only pages tagged and titled for offline use that also mention export in the body — useful when you need to quickly find specific docs during an incident response.
   📍+tags:Docs +title:offline +text:export
   • Adds in-GUI local documentation search and preview (accessible via an icon in the app footer) powered by the Bleve query engine, available from version 0.76.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Bleve query syntax with field-scoped searches across title, text, tags, and crumbs fields, including required (+), excluded (-), and phrase ("...") operators.
   • The documentation index is managed as a tool in the root org and is automatically downloaded on first search; non-root orgs have their search redirected to the root org so all orgs share one copy.
   • The Server.Utils.UploadTools artifact includes the docs index when pre-populating an offline server's tools inventory.
   • Supports manual offline installation by downloading the index from https://github.com/Velocidex/velociraptor-docs/raw/refs/heads/gh-pages/docs_index/docs_index_v1.zip and uploading it to the tools inventory.
   • Adds in-GUI local documentation search and preview (accessible via an icon in the app footer) powered by the Bleve query engine, available from version 0.76.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Bleve query syntax with field-scoped searches across title, text, tags, and crumbs fields, including required (+), excluded (-), and phrase ("...") operators.
   • The documentation index is managed as a tool in the root org and is automatically downloaded on first search; non-root orgs have their search redirected to the root org so all orgs share one copy.
   • Supports manual offline installation by downloading the index from https://github.com/Velocidex/velociraptor-docs/raw/refs/heads/gh-pages/docs_index/docs_index_v1.zip and uploading it to the tools inventory.

   1 more in Everything

5. docs update Sep 22, 2026 · issue 082

   Velociraptor GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. gains customizable pages, sidebar links, context menus, themes, and static file serving via GUI.reverse_proxy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ USE IT
   Serve a local directory of images as GUI assets so custom artifact templates can reference them with a standard <img> tag.
   /etc/velociraptor/server.config.yaml copy

   GUI:
     reverse_proxy:
       - route: /images/
         url: file:///opt/www/
         require_auth: true

   Add a global sidebar link to an external threat-intel portal and a context menu link to send selected cell values to a search engine, for all users.
   /etc/velociraptor/server.config.yaml copy

   GUI:
     links:
       - text: Threat Intel Portal
         url: https://intel.example.com/
         icon_url: data:image/png;base64,[...]
         type: sidebar
         new_tab: true
         disabled: false
       - text: Brave Search
         url: https://search.brave.com/search
         type: context
         parameter: q
         disabled: false
         icon_url: data:image/png;base64,[...]

   • Adds GUI.links config section to define custom sidebar links and context menu items globally for all users, with fields including text, url, icon_url, type (sidebar or context), parameter, new_tab, and disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds GUI.reverse_proxy.url config setting to serve static files (e.g. images) from a disk path, making them available as GUI assets without recompiling the binary.
   • Adds user_options VQL function to set per-user sidebar and context menu links, merged with global and default links.
   • Supports full customization of three GUI pages via their corresponding artifacts: Server.Internal.Welcome (Welcome page), Server.Monitor.Health (Server Dashboard), and Generic.Client.Info (VQL Drilldown).
   • Supports adding custom CSS themes by providing a new stylesheet alongside existing theme files.

   +1 more show less

   • Supports additional GUI language translations in a modular way; currently includes English, German, Spanish, Portuguese, French, Japanese, and Vietnamese.

   6 details in Everything

6. docs update Sep 22, 2026 · issue 082

   Velociraptor gains a structured Logging config block for file-based and remote syslog log forwarding with per-component and per-level control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ USE IT
   Forward only audit events to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. via TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. syslog while also writing all logs to disk — the recommended production setup for tamper-resistant audit trails.
   /etc/velociraptor/server.config.yaml copy

   Logging:
     output_directory: /var/log/velociraptor
     separate_logs_per_component: true
     remote_syslog_server: syslog.example.com:514
     remote_syslog_protocol: tcp
     remote_syslog_components:
       - VelociraptorAudit

   Keep debug logs only for one day and retain error logs for two years to reduce disk pressure while preserving long-term error history.
   /etc/velociraptor/server.config.yaml copy

   Logging:
     output_directory: /var/log/velociraptor
     separate_logs_per_component: true
     debug:
       rotation_time: 86400
       max_age: 2592000
     error:
       rotation_time: 604800
       max_age: 63072000

   • Adds Logging.output_directory to server.config.yaml to write rotating log files to disk; when empty or omitted, no files are written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Logging.separate_logs_per_component (default false) to split log output into per-component files such as VelociraptorFrontend_info.log, VelociraptorAudit_info.log, and VelociraptorAPI_info.log.
   • Adds Logging.remote_syslog_server (host:port), Logging.remote_syslog_protocol (udp, tcp, or tls), and Logging.remote_syslog_components to forward log events to a remote syslog server or SIEM.
   • Adds per-level rotation_time, max_age, and disabled keys under Logging.debug, Logging.info, and Logging.error to control log rotation and retention independently per log level.
   • Syslog forwarding sends log messages as RFC 3164RFC 3164The 2001 IETF specification that standardised the BSD syslog protocol, defining message format and UDP transport for system log data. Cyber tools use it to parse or emit legacy syslog reliably across heterogeneous infrastructure.-style syslog with a JSON body containing level, time, and msg fields, enabling structured parsing in a SIEM.

   +3 more show less

   • The VelociraptorAudit log component captures security-relevant events — logins, artifact changes, hunt operations, and access control changes — and is the default value of remote_syslog_components when syslog forwarding is enabled.
   • Audit events are also available via the Server.Audit.Logs event-monitoring artifact, queryable from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., and on Windows servers are additionally written to the Windows Event Log.
   • Rotated log files receive a timestamp suffix (e.g. VelociraptorAudit_info.log.202608311200) and a symlink points to the current active file.

   8 details in Everything

7. docs update Sep 22, 2026 · issue 082

   Velociraptor 0.77 adds an officially supported Docker container image published to ghcr.io/velocidex/velociraptor-server⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Stand up a fresh Velociraptor server with a custom hostname and admin password, skipping client package builds to speed up first start in lab environments.
   .env copy

   VELOCIRAPTOR_HOSTNAME=velociraptor.example.com
   VELOCIRAPTOR_INITIAL_ADMIN_PASSWORD=S3cur3Pass!
   VELOCIRAPTOR_NO_INITIALIZE=TRUE

   • Adds VELOCIRAPTOR_NO_INITIALIZE environment variable (set to TRUE in .env) to skip building MSI/DEB/RPM client packages on first container start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds VELOCIRAPTOR_LITERAL_CONFIG environment variable to pass a literal server config string to the container instead of reading from a file path.
   • Adds VELOCIRAPTOR_HOSTNAME, VELOCIRAPTOR_FRONTEND_PORT, VELOCIRAPTOR_GUI_PORT, VELOCIRAPTOR_DATASTORE_PATH, VELOCIRAPTOR_CONFIG_PATH, and VELOCIRAPTOR_INITIAL_ADMIN_PASSWORD environment variables (set via .env) to control Docker container behavior.
   • Supports loading custom server artifacts from the /custom_artifacts/ directory inside the container, allowing override of InitializeServer.yaml and other initialization VQL.
   • Supports fresh deployments that auto-generate config with self-signed certificates, create an initial admin user, start the frontend, and build MSI/DEB/RPM client packages on first startup.

   +1 more show less

   • Supports existing Velociraptor deployments by placing server.config.yaml in the etc/ directory — the container detects it and skips config generation.

   6 details in Everything

8. docs update Sep 22, 2026 · issue 082

   Velociraptor gains experimental multi-frontend scaling via master/minion architecture with MemcacheFileDataStore and RemoteFileDataStore.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ TRY IT
   Generate a multi-frontend config and build separate master and minion .deb packages ready to deploy on distinct VMs sharing an EFS mount at /opt/velociraptor.
   copy

   $ velociraptor --config server.config.yaml config frontend > multifrontend.config.yaml
   velociraptor --config multifrontend.config.yaml debian server

   Configure a minion node to use the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication.-backed remote datastore and the master to use the in-memory cache datastore, pointing both at a shared EFS mount.
   server.config.yaml copy

   Datastore:
     location: /opt/velociraptor
     filestore_directory: /opt/velociraptor
     minion_implementation: RemoteFileDataStore
     master_implementation: MemcacheFileDataStore
   
   ExtraFrontends:
     - hostname: minion.velocidex-training.com
       bind_address: ""
       bind_port: 8100
       dyn_dns:
         ddns_username: ZWLfJ7InGAB1PcoC
         ddns_password: ufNrxN95HKhRjutM

   • Adds Datastore.master_implementation: MemcacheFileDataStore config key enabling the master node to cache datastore files in memory and flush to EFS asynchronously, reducing perceived write latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Datastore.minion_implementation: RemoteFileDataStore config key enabling minion nodes to access the master datastore over gRPC instead of reading/writing the shared filesystem directly.
   • Adds ExtraFrontends configuration block to define additional minion frontend hostnames, bind addresses, ports, and dynamic DNS credentials.
   • Adds Client.server_urls multi-entry support so clients randomly select from master and minion URLs, distributing connection load across frontends.
   • Adds multi-frontend Debian packaging via velociraptor debian server — when given a multi-frontend config, the command now produces separate _master_ and _minion_ .deb packages for independent VM deployment.

   +1 more show less

   • Supports scaling Velociraptor beyond a single server to serve endpoint counts exceeding the single-node 10k–15k limit by distributing client connections across multiple frontend nodes backed by a shared NFS/EFS volume at Datastore.location.
   • Adds Datastore.master_implementation: MemcacheFileDataStore config key enabling the master node to cache datastore files in memory and flush to EFS asynchronously, reducing perceived write latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Datastore.minion_implementation: RemoteFileDataStore config key enabling minion nodes to access the master datastore over gRPC instead of reading/writing the shared filesystem directly.
   • Adds ExtraFrontends configuration block to define additional minion frontend hostnames, bind addresses, ports, and dynamic DNS credentials.
   • Supports scaling Velociraptor beyond a single server to serve endpoint counts exceeding the single-node 10k–15k limit by distributing client connections across multiple frontend nodes backed by a shared NFS/EFS volume at Datastore.location.

   2 more in Everything

9. docs update Sep 12, 2026 · issue 072

   Hayabusa updated to v4.0.0 with the new dfir-timeline subcommand for Windows event log analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Updates the bundled Hayabusa binary to v4.0.0 (hayabusa-4.0.0-win-x64-live-response.zip), replacing the previous version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Invokes the new dfir-timeline subcommand in Hayabusa 4.0.0, with --output-type controlling the output format.

   2 details in Everything

10. docs update Sep 12, 2026 · issue 072

    Velociraptor exchange gains a forensic ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESEESEExtensible Storage Engine, a Microsoft-developed embedded database engine used in Windows components like Active Directory and Exchange; cyber tools use it to read those stores without needing a running service. database artifact and bumps its HayabusaHayabusaAn open-source Windows event log fast forensics and threat hunting tool maintained by the Yamato Security community, used to parse EVTX files and surface detections via Sigma-compatible rules. integration to v4.0.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Hunt for all revoked certificates issued from a specific template on a live CA server — useful during a PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. compromise investigation.
    copy

    $ Windows.ADCS.CertificateAuthority.EDB with EDBGlob='C:/Windows/System32/CertLog/*.edb', DispositionFilter=15, TemplateRegex='SubCA|DomainController'

    Scope in on certificates requested by a suspect account in a post-compromise ADCS audit, filtering by requester identity and submission window.
    copy

    $ Windows.ADCS.CertificateAuthority.EDB with RequesterRegex='CONTOSO\\jsmith', DateAfter='2025-01-01', DateBefore='2025-06-30'

    • Adds Windows.ADCS.CertificateAuthority.EDB artifact that parses the Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services ESE database directly from disk at C:\Windows\System32\CertLog\*.edb via the ntfs accessor, returning all certificate requests with disposition, requester/caller identity, subject DN, template, timestamps, and serial number.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports EDBGlob parameter (default C:/Windows/System32/CertLog/*.edb) to locate the CA database file.
    • Supports DispositionFilter parameter to filter results by disposition value (9=Issued, 11=Pending, 15=Revoked, 16=Error, 20=Failed, 21=Denied).
    • Supports RequesterRegex parameter to filter results on RequesterName or CallerName.
    • Supports SubjectRegex parameter to filter results on DistinguishedName or CommonName.

    +4 more show less

    • Supports TemplateRegex parameter to filter results on CertificateTemplate display name or OID.
    • Supports date-range parameters to return only requests submitted after or before a given ISO8601 date.
    • Performs ESE transaction log recovery via esentutl /r before parsing, ensuring all committed but uncheckpointed rows are visible and consistent with certutil output.
    • Updates the bundled Hayabusa tool reference to v4.0.0 (hayabusa-4.0.0-win-x64-live-response.zip, expected hash ab65bf3310cfa1b3baa383843546913b2ec18a2144688bfac0acb0eb1205a8c6).
    • Adds Windows.ADCS.CertificateAuthority.EDB artifact that parses the Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services ESE database directly from disk at C:\Windows\System32\CertLog\*.edb via the ntfs accessor, returning all certificate requests with disposition, requester/caller identity, subject DN, template, timestamps, and serial number.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports EDBGlob parameter (default C:/Windows/System32/CertLog/*.edb) to locate the CA database file.
    • Supports DispositionFilter parameter to filter results by disposition value (9=Issued, 11=Pending, 15=Revoked, 16=Error, 20=Failed, 21=Denied).
    • Supports RequesterRegex parameter to filter results on RequesterName or CallerName.
    • Supports SubjectRegex parameter to filter results on DistinguishedName or CommonName.

    +3 more show less

    • Supports TemplateRegex parameter to filter results on CertificateTemplate display name or OID.
    • Supports date-range parameters to return only requests submitted after or before a given ISO8601 date.
    • Performs ESE transaction log recovery via esentutl /r before parsing, ensuring all committed but uncheckpointed rows are visible and consistent with certutil output.

    1 more in Everything

11. docs update Sep 9, 2026 · issue 069

    New artifact Windows.ADCS.CertificateAuthority.EDB parses the ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESEESEExtensible Storage Engine, a Microsoft-developed embedded database engine used in Windows components like Active Directory and Exchange; cyber tools use it to read those stores without needing a running service. database directly from disk for certificate forensics

    └──▷ TRY IT
    Hunt for all issued certificates from a specific requester issued after a known compromise date, scoping to a non-default CA database path.
    copy

    $ velociraptor artifacts collect Windows.ADCS.CertificateAuthority.EDB --args EDBGlob='C:/Windows/System32/CertLog/*.edb' --args DispositionFilter=9 --args RequesterRegex='CORP\\suspicious_user' --args DateAfter='2025-01-01'

    Scope the collection to certificates issued from a particular template (e.g. User) to investigate template-abuse scenarios like ESC1.
    copy

    $ velociraptor artifacts collect Windows.ADCS.CertificateAuthority.EDB --args TemplateRegex='User' --args DispositionFilter=9

    • Adds Windows.ADCS.CertificateAuthority.EDB artifact that reads the CA database at C:\Windows\System32\CertLog\*.edb via the ntfs accessor while CertSvc is running, returning all certificate requests with disposition, requester/caller identity, subject DN, template, timestamps, and serial number.
    • Supports filtering via EDBGlob, DispositionFilter, RequesterRegex, SubjectRegex, TemplateRegex, DateAfter, and DateBefore parameters for targeted forensic triage.
    • Performs ESE transaction log recovery using esentutl /r against a temp copy of the database so committed-but-uncheckpointed rows are visible and match certutil output.
    • Maps numeric Disposition values to human-readable labels: 9=Issued, 11=Pending, 15=Revoked, 16=Error, 20=Failed, 21=Denied.

    4 details in Everything

12. docs update Aug 26, 2026 · issue 057

    New Linux.Forensics.Journal.Fields artifact reads systemd journal indexes fast, exposing field names, values, counts, and first/last timestamps without parsing entries.

    • New Linux.Forensics.Journal.Fields artifact lists every distinct field name and field value from the systemd journal index (equivalent to journalctl -N and an enriched journalctl -F <field>), including entry count and first/last entry timestamps — without reading individual log entries.
    • Sources JournalFields and JournalFieldValues are independently controllable: set ListFields to false to suppress field-name enumeration, or set FieldName to an empty string to suppress value enumeration.
    • Set FailIfMissing to promote skipped or unreadable journal files (no access, empty, corrupt, or legacy non-compact format) from warnings to errors, making incomplete collections explicitly visible.
    • Tune TailWindow (default 64 slots) to control how many tail index slots are sampled when resolving the last-seen timestamp for a field value, guarding against uncommitted placeholder entries.
    • Exports four reusable VQL helper functions: JournalFields(File, Accessor), JournalFieldValues(File, FieldName, TailWindow, Accessor), FieldValueTimes(File, FieldName, TailWindow, Accessor) (returns raw microsecond FirstUsec/LastUsec), and ValidJournalFiles(Glob, Accessor) — each accepting an optional LogLevel parameter (default WARN).

    +1 more show less

    • Only supports the modern compact journal format (systemd v252+, default since 2022); legacy non-compact journals are skipped with a warning and should be parsed with Linux.Forensics.Journal instead.

    6 details in Everything

13. advisory CVE-2026-85737 Aug 25, 2026 · issue 128
    • CVE-2026-85737: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 0.77.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
14. v0.77.2 Aug 10, 2026 · issue 042

    Velociraptor v0.77.2 adds a full-text index() plugin, VQL default parameters, hunt tags, dir_permissions in copy(), and more new VQL/UI capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.77.2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.77.2

    └──▷ USE IT
    Define a reusable VQL helper with default parameter values to simplify repeated queries.
    text copy

    LET Score(Severity='medium', Multiplier=2) = Severity + ' x' + str(str=Multiplier)
    SELECT Score(), Score(Severity='high'), Score(Multiplier=5) FROM scope()

    • Adds index() VQL plugin to build local full-text indexes, with batch mode for faster indexing.
    • Adds dir_permissions parameter to the copy() VQL function for controlling directory permissions during file operations.
    • Adds Tags argument to the hunt() VQL function, enabling programmatic tagging of hunts at creation time.
    • VQL functions and stored queries can now define default parameter values (e.g. LET F(X=2, Y=3) = X + Y); the artifact verifier flags missing required args.
    • Adds API support to the artifacts collect command-line run mode.

    +11 more show less

    • Allows a ZIP file to be imported using the --definitions flag.
    • Adds support for alphanumeric-only e-mail barrier authentication.
    • Reworks automated OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. role assignment.
    • Updates cache() and memoize() plugins to use disk-based LRU storage.
    • Adds ability to message users directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    • Adds a new flow-upload artifact for Azure Data Explorer (ADX).
    • Reworks the shell interface and GUI to utilize sessions, with graceful timeout for shell sessions.
    • Adds filters on the users list in the user management screen.
    • Adds initial implementation of a Velociraptor container.
    • Updates the Elastic client library to version 9.3.
    • Stores GUI state in sessionStorage for improved session continuity.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for old client APIs has been removed (Remove support for old client APIs).
15. v0.76.7 Aug 10, 2026 · issue 042

    Velociraptor v0.76.7 backports VQL default parameters, a new index() plugin, hunt tagging, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. enhancements from the 0.77 cycle.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.76.7 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.76.7

    └──▷ USE IT
    Enable OIDC login to accept users whose e-mail address is not yet verified by the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    yaml copy

    GUI:
      authenticator:
        claims:
          allow_unverified_email: true

    • Adds Tags argument to the hunt() VQL function to set hunt tags programmatically.
    • Adds GUI.authenticator.claims.allow_unverified_email and GUI.authenticator.claims.override_acls config keys for finer OIDC role-assignment control.
    • Adds index() VQL plugin to build local full-text indexes over collected data.
    • VQL stored queries and functions can now define default parameter values (e.g. LET F(X=2, Y=3) = X + Y), with the verifier flagging calls that omit required parameters.
    • Reworks automated OIDC role assignment, including support for alphanumeric-only e-mail barrier.

    +5 more show less

    • Updates cache() and memoize() plugins to use disk-based LRU, enabling larger datasets to be cached without exhausting memory.
    • Adds ability to message users directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    • Adds API support to the artifacts collect command.
    • Allows a ZIP file to be imported with the --definitions flag.
    • Adds user-list filters in the user management screen.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --config_override / -o flag has been removed from the CLI.
    • !Support for old client APIs has been removed (Remove support for old client APIs).
16. docs update Aug 9, 2026 · issue 040

    Two new exchange artifacts bring agentless Hayabusa Sigma analysis of uploaded EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. files to Velociraptor 0.74+

    └──▷ TRY IT
    Post-process EVTX files from a completed triage collection, scanning only Critical and High Sigma rules for a specific client and flow.
    copy

    $ SELECT * FROM Artifact.Server.Analysis.Windows.EventLogs.Hayabusa(ClientId='C.abc123', FlowId='F.def456')

    Restrict analysis to a specific time window and broaden rule coverage to include Medium-severity Sigma detections.
    copy

    $ SELECT * FROM Artifact.Server.Analysis.Windows.EventLogs.Hayabusa(
      ClientId='C.abc123',
      FlowId='F.def456',
      RuleLevel='Critical, High, and Medium',
      DateAfter='2024-06-01T00:00:00 Z',
      DateBefore='2024-06-30T23:59:59 Z'
    )

    Enable continuous automatic Hayabusa scanning of every completed triage collection by adding the monitor artifact to server event monitoring.
    📍In the Velociraptor GUI, go to Server Events and add the Server.Monitor.Windows.EventLogs.Hayabusa artifact. Adjust ArtifactRegex if collections other than Windows.KapeFiles.Targets or Windows.Triage.Targets upload .evtx files. Detection results will appear under Server Events for this artifact.
    • New Server.Analysis.Windows.EventLogs.Hayabusa artifact post-processes EVTX files already uploaded to the server by running the curated Hayabusa Sigma ruleset via Velociraptor's built-in Sigma engine — no Hayabusa binary deployed to endpoint or server.
    • Accepts ClientId and FlowId parameters to target a specific completed collection flow, with EvtxRegex (default (?i)\.evtx$) to filter which uploaded files are scanned.
    • Supports RuleLevel filter (choices: Critical, Critical and High, Critical, High, and Medium, Critical, High, Medium, and Low, All; default Critical and High) and RuleStatus filter (choices: Stable, Stable and Experimental, Stable and Test, All Rules; default Stable) to tune detection noise.
    • Supports RuleTitleFilter for scoping by rule title, plus DateAfter and DateBefore (format YYYY-MM-DDTmm:hh:ss Z) for time-bounded analysis.
    • Callable from VQL inside another artifact via SELECT * FROM Artifact.Server.Analysis.Windows.EventLogs.Hayabusa(ClientId=..., FlowId=...).

    +4 more show less

    • If security.allowed_file_accessor_prefix is configured on the server, the temporary staging directory must fall under an allowed prefix.
    • New Server.Monitor.Windows.EventLogs.Hayabusa artifact watches for completed client collections matching ArtifactRegex and automatically triggers Server.Analysis.Windows.EventLogs.Hayabusa against each flow's uploaded EVTX files, with results surfaced under Server Events.
    • Requires the curated Hayabusa Sigma package imported via Server.Import.CuratedSigma on Velociraptor 0.74, or Server.Import.Extras on 0.75+, from https://sigma.velocidex.com/.
    • Intended to work with triage collections such as Windows.KapeFiles.Targets and Windows.Triage.Targets that upload raw .evtx files; prefers live-volume copies over volume shadow copy duplicates when the same channel file appears multiple times.

    9 details in Everything

17. docs update Aug 1, 2026 · issue 032

    Velociraptor artifact exchange adds AI LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integrations, Sliver C2 detection, Microsoft Recall forensics, and new hunt-comparison artifacts.

    • Adds AI analysis artifacts integrating with Anthropic, Google, OpenAI, and Ollama — serializing endpoint data into LLM prompts for assisted triage.
    • New hunt-baseline comparison artifact lets analysts diff results between two hunts (Baseline_Hunt_1 vs Hunt_2) on a chosen column.
    • New Microsoft Recall forensics artifact reads and correlates multiple Recall database tables, including enriched Window Capture events.
    • New Sliver PsExec C2 detection pack identifies artifacts left by default configurations of the Sliver framework's PsExec module.
    • New artifact surfaces scheduled tasks missing the Security Descriptor (SD) value in the task cache, exposing tasks hidden from common query methods.

    +9 more show less

    • New artifact parses FreeFileSync and GoodSync sync-log files for forensic review.
    • Adds ErrorHandling option to control failed-flow behavior in applicable artifacts.
    • New artifact enumerates NetworkManager state and all configured network connections on Linux endpoints.
    • New artifact normalizes MDATP health information across endpoints and classifies hypervisor/cloud flavors from product_name.
    • New artifact surfaces Windows ActivitiesCache.db clipboard activity logging (available since Windows 10 1803).
    • Supports configurable thread count for parallelized artifact collection workloads.
    • New user-filter parameter enables filtering process artifacts by parent user.
    • SeverityTransforms support deriving normalized severity from one or more source fields in artifact definitions.
    • New artifact collects Scheduled Task registry data without relying on standard query methods that can be evaded.

    14 details in Everything

18. v0.77.1 Jun 23, 2026 · issue 001

    Velociraptor v0.77.1 adds VQL default parameters, full-text indexing, hunt tagging, shell sessions, user messaging, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.77.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.77.1

    └──▷ TRY IT
    Define a reusable VQL function with optional defaults so callers can omit common arguments in ad-hoc queries.
    copy

    $ LET Score(Host, Severity=5) = dict(host=Host, severity=Severity)
    SELECT Score(Host="workstation1"), Score(Host="dc01", Severity=9) FROM scope()

    Tag a new hunt programmatically so it appears pre-categorised in the hunt list for triage workflows.
    copy

    $ SELECT hunt(description="Collect prefetch from all endpoints", artifacts="Windows.Analysis.Prefetch", Tags=["triage", "prefetch"]) FROM scope()

    Import a community artifact exchange ZIP directly on the command line instead of unpacking it first.
    copy

    $ velociraptor artifacts collect --definitions /path/to/exchange-artifacts.zip Server.Import.Exchange

    • Adds default parameter values for VQL functions and stored queries, enabling optional arguments and verifier enforcement of required ones.
    • Adds new index() VQL plugin to build local full-text indexes over collected data, with batch mode for fast ingestion.
    • Adds dir_permissions parameter to the copy() VQL function for controlling directory permission on copy operations.
    • Adds Tags argument to the hunt() VQL function, enabling programmatic tagging of hunts at creation time.
    • Adds API support to the artifacts collect command for programmatic artifact collection invocation.

    +13 more show less

    • Adds ability to import artifact definitions from a ZIP file via the --definitions flag.
    • Adds new Azure Data Explorer (ADX) flow upload artifact for forwarding collected flows to ADX.
    • Adds alphanumeric-only e-mail barrier support for access control.
    • Reworks OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. role assignment for automated role mapping.
    • Reworks the shell interface to utilize persistent sessions with graceful timeout support.
    • Adds ability to message users directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    • Adds filters on the users list in the user management screen.
    • Updates cache() and memoize() VQL plugins to use disk-based LRU, enabling larger caches.
    • Adds initial Velociraptor container implementation.
    • Introduces a sumo build tag (make linux_sumo) for builds that include full AWS and Google Cloud client libraries; default builds are significantly smaller (up to ~27 MB reduction).
    • Removes the starlark() plugin from default builds.
    • Adds a reformat tooltip to the New Artifact modal in the GUI.
    • Stores GUI state in sessionStorage for improved browser session handling.

    18 details in Everything

19. v0.75 Aug 25, 2025 · release notes

    Velociraptor 0.75 adds yarax(), new artifacts, a decrypt command, S3 path-style support, ADFS/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.75 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.75

    └──▷ TRY IT
    Upload to an S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. endpoint (e.g. MinIO) that requires path-style URLs.
    copy

    $ SELECT upload_s3(file=OSPath, bucket='my-bucket', key=str(str=OSPath), path_style=true) FROM glob(globs='/**')

    • New yarax() VQL plugin for YARA-X scanning support.
    • New Windows.System.Threads artifact for enumerating system threads.
    • New SharpHound artifact for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. bloodhound-style collection.
    • Adds decrypt CLI command to decrypt an encrypted offline container.
    • New path_style option on upload_s3() for S3-compatible storage endpoints that require path-style URLs.

    +6 more show less

    • Secrets can now be inherited from the root org, enabling cross-org secret sharing.
    • Updated watch_syslog() to accept a query parameter for filtered syslog monitoring.
    • New denied_file_accessor_prefix config option to restrict file accessor paths.
    • Adds ADFS support for OIDC authentication where claims are delivered in the access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Global Messages surface now alerts users when critical server-side errors occur.
    • Client audit information is now logged on the client side.

    11 details in Everything

20. v0.74 Feb 26, 2025 · release notes

    Velociraptor v0.74 ships a reworked Sigma rule editor and new live event sources for Linux and Windows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.74 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.74

    • Adds a reworked Sigma rule editor for developing and testing Sigma rules directly within Velociraptor.
    • Adds new live event sources for Linux and Windows to power real-time Sigma-based detections.
    • Introduces a new timeline feature for correlating and reviewing detection events.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Elastic index names may change: sanitization rules were relaxed to align with official Elastic naming conventions, which can rename existing indexes in your pipeline.
21. v0.73 Sep 21, 2024 · release notes

    Velociraptor v0.73 revamps the timelining feature for improved forensic timeline analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.73 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.73

    • Revamped timelining feature with a redesigned timeline investigation workflow.

    1 detail in Everything

22. v0.72 Mar 11, 2024 · release notes

    Velociraptor v0.72 adds EWF/E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. image support, SSH remapping, VQL Secrets, Websocket protocol, and http_client multipart upload.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.72 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.72

    • Adds the ewf accessor to analyze EWF (E01) disk images
    • Allows remapping clients to use the sftp protocol via SSH accessor for Virtual Clients
    • Introduces Secrets in VQL as a named key/value data object for plugin credentials
    • Implements Websocket based communication mechanism for low latency client-server comms
    • Adds Dynamic DNS providers: switched default to CloudFlare and added noip.com as an option

    +3 more show less

    • Enhances proxy support with PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files and regex-based URL matching rules
    • Enables Process memory access on MacOS
    • Adds the files parameter to the http_client() plugin for multipart streaming uploads

    8 details in Everything

23. v0.7.1 Dec 14, 2023 · release notes

    Adds NOTEBOOK artifact templates, SSH accessor, local encrypted logs, etw_sessions() stats, VFS collection button, and sigma plugin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.7.1

    • Adds NOTEBOOK artifact type to define global notebook templates
    • Adds artifact_set_metadata() VQL function to hide artifacts in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.
    • Adds etw_sessions() plugin to show ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. session statistics including dropped events
    • Adds SSH accessor allowing plugins to transparently use SSH for filesystem access
    • Enables distributed notebook processing by offloading queries from Master to Minion nodes in Multi-Frontend configurations

    +3 more show less

    • Introduces secure local encrypted log file format for Velociraptor clients
    • Adds built-in Sigma rule execution capabilities directly on endpoints
    • Adds VFS collection button to initiate file collections from the VFS view

    8 details in Everything

24. v0.7.0 Aug 28, 2023 · release notes

    Velociraptor v0.7.0 adds Chrome Session Storage artifacts, S3 and VSS accessors, GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. filtering, and SQLiteHunter.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Adds GUI.allowed_cidr config option to restrict GUI access by source IP
    • Adds ntfs_vss accessor for Volume Shadow Copies analysis with deduplication
    • Adds S3 accessor allowing plugins like glob() to query and read from S3 buckets
    • Adds Windows.Forensics.Lnk artifact with comprehensive Lnk file parsing
    • Incorporates SQLiteHunter artifact for finding and analyzing SQLite files

    +1 more show less

    • Adds Chrome artifacts including a leveldb parser for Chrome Session Storage

    6 details in Everything

25. v0.6.9 May 25, 2023 · release notes

    Velociraptor v0.6.9 adds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. transport, VQL EXPLAIN, lockdown mode, and multi-file download.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.9 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.9

    • Adds EXPLAIN keyword for debugging VQL queries in the notebook or client
    • Introduces lockdown server mode to prevent new collections/hunts while allowing data viewing
    • Adds audit event viewer to the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for events like collection launch and hunt creation
    • Enables specifying expected hash for tools defined in external third-party artifacts
    • Supports Azure blob storage for offline collector uploads

    +5 more show less

    • Allows uploading the offline collector to an SMB share
    • Allows serving tools from an SMB share
    • Adds multi-file download capability in the VFS GUI
    • Adds hex viewer widget for direct file preview in the GUI
    • Enables filtering artifact packs and setting prefix during manual import in the GUI

    10 details in Everything

26. v0.6.8-2 Feb 13, 2023 · release notes

    New VFS paging, upload_preview column type, client-side collection tracing, and temp file materializer for VQL.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.8-2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.8-2

    • VFS uses pageable tables to view arbitrarily large directories without memory exhaustion
    • Trace collection parameter allows automatic client-side state capture during any hunt or collection

    2 details in Everything

27. v0.6.7-5 Oct 27, 2022 · release notes

    Encrypted offline collections and urgent hunt priority in Velociraptor v0.6.7-5

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.7-5 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.7-5

    └──▷ HOW TO FIND IT
    Launch a collection with high priority to ensure it runs before scheduled batch hunts.
    📍# In the GUI Collection Launch Wizard, select the urgent option for the new collection.
    Schedule a single Hunt to target assets in multiple Organizational Units simultaneously.
    📍# In the GUI, create/edit a Hunt and select multiple Orgs from the organization selector before scheduling.
    • Adds X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols./PGP encryption support for offline collector files to secure collected data at rest.
    • Adds urgent flag to the collection launch wizard to pre-empt larger hunts on busy systems.
    • Allows scheduling Hunts across multiple organizations directly from the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

    3 details in Everything

28. v0.6.6-1 Sep 8, 2022 · release notes

    Velociraptor v0.6.6-1 adds full multi-tenancy via on-the-fly org creation and expanded process tracker access.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.6-1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.6-1

    • Adds full multi-tenancy support allowing administrators to create new organizations (orgs) dynamically at runtime for client separation
    • Expands the process tracker capability, enabling VQL queries to access historical process information from the endpoint
    • Enables right-click context menu actions in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for table cells, including sending data to VirusTotal and Cyberchef
    • Allows Notebook users to share notebooks publicly with all users in the organization

    4 details in Everything

29. v0.6.5-0 Jun 6, 2022 · release notes

    Velociraptor v0.6.5 adds VQL log levels for fail-on-error, multi-language GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., and MUSL build target.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.5-0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.5-0

    • Adds ERROR level logging in VQL to make collections fail explicitly when critical errors occur
    • Supports French, German, Spanish, and Portuguese locales in the Velociraptor GUI
    • Allows users to select a custom display timezone for timestamps
    • Adds MUSL build target providing a static binary for older Linux systems

    4 details in Everything

30. v0.6.4-2 Mar 29, 2022 · release notes

    Adds dead disk image emulation, per-query CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. throttling, and multi-provider OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to Velociraptor

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.4-2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.4-2

    • Emulate a live client against dead disk images to run standard VQL artifacts for offline forensic analysis
    • Throttle VQL queries using a feedback-based controller to maintain a target average CPU utilization on the endpoint
    • Configure and authenticate against multiple OAuth2 providers simultaneously in the Velociraptor GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.

    3 details in Everything

31. v0.6.3 Jan 26, 2022 · release notes

    Adds in-memory search index, multi-frontend config support, YARA/regex UI parameters, root cert config key, and file upload to artifacts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.3 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.3

    └──▷ USE IT
    Scan directories with fine-grained control over recursion.
    vql copy

    glob(path='/etc', recursion_callback={ 'skip': [ '/etc/sudoers.d' ] })

    Manually purge old monitoring data to reclaim disk space on the server.
    vql copy

    SELECT Server.Utils.DeleteMonitoringData(keep_days=30)

    • VQL glob plugin gains recursion_callback option for fine-grained directory control
    • Server.Utils.DeleteManyFlows and Server.Utils.DeleteMonitoringData artifacts for disk space management
    • New Windows.Forensics.SAM artifact for parsing the SAM registry hive
    • Hunt wizard can now estimate client count based on label/OS conditions
    • Adhoc file upload to artifact parameters via new Upload File Form element

    +1 more show less

    • Server.Config.RootCerts in config file allows specifying root certificates (e.g. for MITM proxies)

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Windows.Collectors.File artifact was renamed to Generic.Collectors.File; custom artifacts referencing the old name will fail.
32. v0.6.2 Nov 2, 2021 · release notes

    Velociraptor v0.6.2 adds password protection for exports and memory-based Cobalt Strike config extraction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.2

    • Users can now specify a password to lock downloads, creating password-protected exports.
    • The Cobalt Strike config parser now supports extracting configuration directly from memory.
    • New artifact Windows.Forensics.UserAccessLogs parses UAL ESEESEExtensible Storage Engine, a Microsoft-developed embedded database engine used in Windows components like Active Directory and Exchange; cyber tools use it to read those stores without needing a running service. files for Windows forensics.

    3 details in Everything

33. v0.6.1 Aug 15, 2021 · release notes

    Velociraptor v0.6.1 adds Starlark to VQL, registry modification plugins, and new GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. monitoring capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.1

    • Adds starlark support within VQL for writing custom routines
    • Adds reg_set_value, reg_rm_value, and reg_rm_key VQL functions to modify the Windows registry
    • Adds user_delete() and user_create() VQL functions to manage users from VQL or API
    • Adds geoip VQL function for IP address lookup in Maxmind databases
    • Adds xor VQL function to uncover simple encryption

    +1 more show less

    • Adds Windows.Carving.CobaltStrike artifact for carving and decoding Cobalt Strike configurations

    6 details in Everything

34. v0.6.0 Jun 9, 2021 · release notes

    Velociraptor v0.6.0 adds Shellbags artifact, USN carver, VQL-aware GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. editor, and dynamic hunt-label assignment

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    └──▷ HOW TO FIND IT
    Specify a custom notebook for an artifact to automate post-processing workflows after hunt collection.
    📍In the artifact definition, set the notebook field to your desired notebook name. Access it in the GUI via the hunts interface.
    Share common VQL functions across multiple artifacts by importing them directly into your artifact definition.
    📍In the VQL code section of your artifact, use import statements to pull in shared functions from other artifacts.
    Start a hunt targeted at a specific label and dynamically add clients to it by assigning the label while the hunt is active.
    📍1. Create a new hunt and select Target Label in the setup screen. 2. While the hunt runs, assign the target label to new clients via the client management UI.
    • Adds steps to configure artifacts with a custom notebook tab for post-processing in hunts
    • Enables importing and exporting VQL code within artifacts to share functions
    • Introduces the Shellbags artifact with native parsing support and an alternative SBECmd.exe parser
    • Adds a new USN record carver capability to recover rotated USN records
    • Implements authenticode information parsing for PE files, including .cat files

    +1 more show less

    • Allows starting hunts targeting specific labels and dynamically assigning clients by adding the label post-start

    6 details in Everything

35. v0.5.9 Apr 28, 2021 · release notes

    Velociraptor v0.5.9 adds FreeBSD support, SQL plugin, and server monitoring query logs to filestore

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.9 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.9

    └──▷ TRY IT
    Run a VQL query against a remote MySQL instance directly from Velociraptor artifacts.
    copy

    $ SELECT * FROM sql(
      query='SELECT version()',
      driver='mysql',
      source=['host=localhost:3306 user=root password=pass']
    )

    • Adds Freebsd build target for client/server binaries
    • Adds SQL plugin allowing VQL queries to directly access MySQL or PostgreSQL databases (with sqlite aliased as an alias)
    • Enables writing server monitoring query logs to the filestore, making them visible in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.

    3 details in Everything

36. v0.5.8 Apr 1, 2021 · release notes

    Native artifact preconditions, column_filter plugin, and new Windows.Forensics.ProcessInfo artifact

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.8 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.8

    • Adds native support for artifact preconditions on clients (Fixes #930)
    • Adds column_filter() plugin to remove columns from SELECT * FROM expressions
    • Adds a process accessor allowing direct operation on process memory (e.g. yara scan, upload)
    • Adds Windows.Forensics.ProcessInfo artifact to extract process information from the process PEB

    4 details in Everything

37. v0.5.7 Mar 15, 2021 · release notes

    Dark mode UI toggle and GODEBUG config for legacy CN certificates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.7 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.7

    └──▷ HOW TO FIND IT
    Enable dark mode in the Velociraptor GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
    📍Click the user label (top right corner) in the GUI.
    • Adds dark mode to the GUI accessible via the user label in the top right corner.
    • Adds time selector support for both UTC and Local time in the GUI.

    2 details in Everything

38. v0.5.5 Jan 19, 2021 · release notes

    Adds VQL binary parser, multithreaded ZIP writer for offline collector, and file-backed SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. overflow

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.5 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.5

    • New BinaryParser objects available in VQL allow implementing custom parsers inside queries.
    • Offline collector now uses a multithreaded ZIP writer to leverage multiple cores for compression.
    • VQL engine performance improved with more lazy evaluation points.
    • Server side event queues implement file backed overflow for better scalability and speed.
    • New artifact: Splunk upload artifacts matching previous Elastic based ones.

    +3 more show less

    • New artifact: Certutils metadata parser using the new binary parser framework.
    • New artifact: Lnk file parser using the new binary parser in VQL.
    • New artifact: Hive interfacing artifacts.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !MySQL is disabled as a filestore backend; previously supported but withdrawn due to performance and stability issues.
39. v0.5.4 Dec 26, 2020 · release notes

    Velociraptor v0.5.4 adds automatic VQL type conversion, server metadata screen, parallel post-processing, daily query logs, and new artifacts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.4 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.4

    └──▷ HOW TO FIND IT
    Configure the tool URL for external hosting via the setup UI.
    📍Navigate to Tool Setup › Override tool URL, then enter your S3/GCS endpoint
    Access centrally managed global parameters (e.g. credentials) for artifacts.
    📍In the console, go to Server › Metadata screen and edit user-settable configuration parameters
    • Tool setup now allows overriding the tool URL (useful when hosting tools off S3 or GCS)
    • Automatic type conversion for artifact parameters eliminates manual string-to-VQL conversion
    • Parallel plugin enables up to x10 faster notebook post-processing
    • New server metadata screen allows user-settable global configuration parameters for artifacts
    • Write monitoring query logs to a daily log file

    +1 more show less

    • Adds new artifacts: MacOS.System.Wifi, Server.Slack.Clients.Online, Windows.ActiveDirectory.BloodHound, Windows.Application.Firefox.History, Windows.ETW.EdgeURLs, Windows.ETW.WMIProcessCreate, Windows.Forensics.SolarwindsSunburst

    6 details in Everything

40. v0.5.3 Dec 3, 2020 · release notes

    Adds ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors./sysmon forwarding, offline collector bundle import, SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. upload, client concurrency limits, and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. notebook/deduction features.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.3 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.3

    • Adds ETW plugin and Sysmon log forwarding with automatic installation and configuration management
    • Introduces automatic Notebook generation for Hunts and Flows for post-processing in the GUI
    • Adds an offline collector bundle import feature into the GUI for notebook-based post-processing
    • Introduces client concurrency limiting (default 2 concurrent queries) to prevent client overload, with GUI queries bypassing the limit
    • Adds a Delete Client button in the GUI to remove clients and collected artifacts

    +1 more show less

    • Adds support for new macOS artifacts: MacOS.Detection.InstallHistory, MacOS.System.Plist, MacOS.System.QuarantineEvents, MacOS.System.TimeMachine

    6 details in Everything

41. v0.5.2 Nov 12, 2020 · release notes

    Velociraptor v0.5.2 adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. USN Journal support, OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, sinkhole domain blocking, and Cobalt Strike memory scan artifact.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.2

    • Adds indexed query result sets on the server for fast seeking in large JSON files
    • Enables infinite paging for all tables in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. to view all results
    • Introduces experimental on-host local hash database powered by USN parser
    • Adds support for OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect authentication
    • Adds sinkhole capability to block domain names on endpoints via hosts file manipulation

    +2 more show less

    • Adds Windows.Detection.ProcessMemory.CobaltStrike artifact for Cobalt Strike memory scanning
    • Allows selecting specific columns during table exports to CSV or JSON in the GUI

    7 details in Everything

42. v0.5.1 Oct 23, 2020 · release notes

    New React-based GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. in v0.5.1 adds flow/hunt cancellation/deletion, recursive VFS download and listing, and keyboard navigation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.1

    └──▷ HOW TO FIND IT
    Cancel an active hunt to stop resource consumption.
    📍Open the GUI, navigate to your active hunts list, select the hunt in question, and click Cancel.
    Download a directory structure from a remote host's VFS for offline analysis.
    📍In the GUI VFS view, navigate to the target directory and select Recursive Download.
    List all files recursively in a remote directory to identify new artifacts without downloading them.
    📍In the GUI VFS view, navigate to the target directory and select Recursive Listing.
    • Adds a new React-based GUI replacing the previous UI implementation
    • Adds ability to cancel or delete flows or hunts directly from the GUI
    • Adds recursive download of files in the VFS view
    • Adds recursive listing of files in the VFS view
    • Adds keyboard navigation support for faster interface interaction

    5 details in Everything

43. v0.5.0 Sep 21, 2020 · release notes

    Velociraptor v0.5.0 introduces a cache VQL plugin and expression support for Group by

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Added a cache VQL plugin which stores data for a configurable time to enable recursive walking of process parent trees.
    • Group by now supports expressions.

    2 details in Everything

44. v0.4.9 Sep 2, 2020 · release notes

    Velociraptor v0.4.9 adds velociraptor.exe gui command and OSQuery support via Windows.OSQuery.Generic artifact

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.9 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.9

    • Adds velociraptor.exe gui subcommand to launch a standalone frontend/client for VQL development or demos without installation
    • Adds Windows.OSQuery.Generic artifact to automatically collect and convert osquery output to VQL
    • Adds configurable row limits and total upload limits for artifact collections to protect server stability against oversized results
    • Adds Tools UI feature in the web console to upload, serve (local or external URL), and retrieve tools from GitHub releases

    4 details in Everything

45. v0.4.8 Aug 15, 2020 · release notes

    Velociraptor v0.4.8 adds client-side label-based event monitoring, hunt label exclusion, direct file downloads, and GitHub OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. config fixes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.8 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.8

    • Implements client side event monitoring based on labels for targeted group execution
    • Added hunt exclude condition to allow excluding clients from hunts by label
    • Added direct download link to uploaded files bypassing zip preparation
    • Adds console color support for improved UI visibility
    • Automatically upgrades client tools when server version changes

    5 details in Everything

46. v0.4.7 Jul 29, 2020 · release notes

    Adds Github/Azure AD SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authenticators, host shell UI, and KillKillKill client protocol.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.7 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.7

    • Windows.Remediation.Quarantine artifact isolates endpoints while remaining reachable from Velociraptor
    • System.DNSCache artifact queries Windows DNS cache
    • KillKillKill message immediately kills and restarts the client
    • Host info screen shell UI for interactive remote command execution
    • Timezone selection in JSON encoder output

    +1 more show less

    • Notebooks restricted to creator visibility with explicit sharing

    6 details in Everything

47. v0.4.6 Jul 12, 2020 · release notes

    Velociraptor v0.4.6 adds VSS live hunting, artifact pack loading, notebook export, and HTML reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.6 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.6

    • Adds Windows.Search.VSS artifact for live hunting of Volume Shadow Copies
    • Adds support to load artifact packs by importing a zip file containing multiple artifacts

    2 details in Everything

48. v0.4.5 Jun 11, 2020 · release notes

    Adds context-sensitive command completion in the Notebook editor to VQL queries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.5 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.5

    └──▷ HOW TO FIND IT
    Automatically complete a VQL plugin name when writing a query in the Notebook editor.
    📍1. Open the Notebook editor. 2. Type SELECT * FROM and trigger completion (or type ?).
    View all available completions for VQL functions or local variables at any point in a query.
    📍1. Open the Notebook editor. 2. Type ? in the text input area to see current possibilities.
    • Typing ? anywhere in the Notebook editor displays all current completions.

    1 detail in Everything

49. v0.4.4 Jun 1, 2020 · release notes

    Adds a GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for creating standalone collectors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.4 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.4

    └──▷ HOW TO FIND IT
    Use the new interface to configure and generate a standalone collector without writing config files manually.
    📍Open the Velociraptor GUI, navigate to the Collector creation section, configure settings, and export.
50. v0.4.2 Apr 16, 2020 · release notes

    Adds experimental MySQL-based datastore to server.config.yaml for distributed frontend support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.2 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.2

    └──▷ USE IT
    Configure Velociraptor to use MySQL as its backend datastore in server.config.yaml.
    yaml copy

    Datastore:
      implementation: MySQL
      mysql_username: root
      mysql_password: password
      mysql_server: 127.0.0.1
      mysql_database: velociraptor

    • Introduces a new MySQL implementation for the data store, configured via server.config.yaml.

    1 detail in Everything

51. v0.4.1 Mar 28, 2020 · release notes

    Adds role-based ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. model and built-in Velociraptor Notebooks; requires manual ACL grants for upgrade.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.1

    └──▷ TRY IT
    Grant administrator role to a user after upgrade to prevent lockout.
    copy

    $ velociraptor acl grant username@example.com --role administrator

    Create and run forensic analysis directly in the Velociraptor UI using the new notebook feature.
    📍In the console, go to Notebooks and create a new notebook to execute queries without external Jupyter dependencies.
    • Introduces a role based ACL model to restrict user permissions.
    • Replaces the Jupyter notebook workflow with built-in Velociraptor Notebooks.
    • Adds the velociraptor acl grant subcommand to assign roles to users and API keys.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing users have no access until ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. are granted; run velociraptor acl grant username@example.com --role administrator to restore access.
    • !API client keys stop working unless new access is granted via the ACL system.
52. v0.4.0 Mar 9, 2020 · release notes

    Velociraptor v0.4.0 adds WriteEvent API for client-side event pushing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds WriteEvent() API method to allow clients to push events to the server
    • Configurable optimization limit for up to 10k endpoints

    2 details in Everything

53. v0.3.9 Feb 11, 2020 · release notes

    Adds gzipped datastore support, plist parser, config merge, and recursive VFS refresh

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.9 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.9

    • Adds config generate JSON merging capability to automate config generation
    • Adds Plist parser for MacOS artifact analysis
    • Enables reading gzipped datastore files when storage is limited
    • Implements recursive VFS refresh functionality
    • Adds parse_evtx() message database support for message resolution

    5 details in Everything

54. v0.3.8 Jan 11, 2020 · release notes

    Velociraptor v0.3.8 adds S3 upload, grok/syslog watcher, VQL ref generation, auditd parsing, unzip/csv commands, and Linux artifacts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.8 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.8

    └──▷ HOW TO FIND IT
    Export collected event logs to S3 for long-term storage or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
    📍# Configure artifact with S3 upload in the upload settings section of the config.yaml
    • S3 upload functionality enables exporting collected data directly to an S3 bucket.
    • grok function and syslog watcher enable pattern-based log parsing and continuous syslog monitoring.
    • Automatic VQL reference generation provides documentation for VQL queries.
    • Native auditd logs parsing allows direct analysis of Linux audit subsystem logs.
    • unzip and csv commands allow extracting and querying results from exported zip files.

    +1 more show less

    • Expanded Linux artifacts collection covers more data sources on Linux systems.

    6 details in Everything

55. v0.3.7 Dec 7, 2019 · release notes

    Velociraptor v0.3.7 adds VAD/Handles process plugins, ESEESEExtensible Storage Engine, a Microsoft-developed embedded database engine used in Windows components like Active Directory and Exchange; cyber tools use it to read those stores without needing a running service. parser, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output, and hunt download GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.7 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.7

    • Adds VAD, Handles, Mutants, DLLList, and Windows Object tree analysis plugins for process forensics.
    • Adds a parser for ESE files to process SRUM database and Internet Explorer history artifacts.
    • Adds JSONL as an optional output format compatible with jq and logstash.
    • Enables downloading hunt bundles directly from the GUI, previously limited to individual collections.

    4 details in Everything

56. v0.3.6 Nov 12, 2019 · release notes

    Velociraptor v0.3.6 adds JS interpreter to VQL, MFT parsing plugin, client-side cancellation, and EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. message expansion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.6 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.6

    • parse_mft() plugin added to VQL for parsing and exporting all filenames in the Master File Table (MFT).
    • VQL now supports a javascript interpreter, enabling JavaScript execution within queries.
    • Client-side cancellation implemented: stopping a flow immediately cancels all running queries on the client.
    • EVTX parser now includes event messages extracted from message DLLs, with EventData parameters expanded on the endpoint.
    • velociraptor config repack can now repack external binaries.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The API and data store representation have changed; previous data may not be readable by the new binary, requiring a data store backup.
57. v0.3.5 Oct 8, 2019 · release notes

    Velociraptor v0.3.5 adds auto-indexing for collections, GCS uploads via VQL, and encrypted standalone zips.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.5 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.5

    └──▷ TRY IT
    Configure an Elastic artifact to automatically index collected results into an Elasticsearch cluster
    copy

    $ -- See release notes for specific Elastic VQL plugin parameters and config keys required for automatic indexing.

    • upload_gcs() plugin allows VQL to automatically upload artifact collection data to Google Cloud Storage
    • Elastic VQL plugins and artifacts now support automatic indexing of artifact collections
    • Standalone zip files created by Velociraptor can now be encrypted
    • VQL editor in the UI now features syntax highlighting for better rendering

    4 details in Everything

58. v0.3.4 Sep 30, 2019 · release notes

    Adds KapeFile repository ported as single artifact with VSS deduplication, I30 scanning, and KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. collection artifacts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.4 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.4

    • Imports the KapeFile repository into Velociraptor as a single artifact for forensic file collection triaging
    • Implements VSS deduplication in the KapeFile artifact to retrieve all relevant versions of collected files
    • Adds I30 scanning artifact for recovering potentially deleted files
    • Adds an Autoruns artifact leveraging Sysinternals Autoruns to identify potentially malicious programs
    • Adds Kerberoasting collection artifact to detect if a weak golden ticket has been issued

    5 details in Everything

59. v0.3.3 Sep 6, 2019 · release notes

    Adds client-side buffering for offline event monitoring and resumable server-side ZIP generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.3 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.3

    • Introduces a client.local_buffer file to store event monitoring artifacts when the endpoint is offline
    • Moves zip file preparation to the server with pause/resume support for large downloads

    2 details in Everything

60. v0.3.1 Jul 15, 2019 · release notes

    Velociraptor v0.3.1 adds signed MSI distribution, generic file finder artifact, built-in dashboard, and new binary parsers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    • Distributes Velociraptor as a signed MSI with an interactive configuration wizard for deployment.
    • Adds the GenericFileFinder artifact, replacing the deprecated flow of the same name.
    • Introduces a built-in dashboard for monitoring, reducing reliance on Grafana in most cases.
    • Adds support for parsing AppCompatCache keys, SQLite, and prefetch file formats.

    4 details in Everything

61. v0.3.0 May 20, 2019 · release notes

    v0.3.0 adds in-GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. editing for client/server artifacts and VQL-based reporting primitives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ HOW TO FIND IT
    Update client monitoring artifacts via the GUI without restarting the server.
    📍In the GUI, navigate to the Client monitoring section and edit the artifact definitions directly.
    Create a report template for an artifact using graphical primitives like tables or timelines.
    📍In the GUI, navigate to Artifact › View › Edit Report and add VQL queries with table/chart/timeline primitives.
    Search for artifacts by description in the collector.
    📍In the GUI, open the Artifact collector and enter search terms in the description field.
    • Adds Client monitoring artifacts settable via the GUI without restarting the server.
    • Adds Server event artifacts settable via the GUI.
    • Adds report templates to the artifact view with support for tables, line charts and timelines.
    • Enables artifact description search in the Artifact collector.

    4 details in Everything

62. 0.2.9 Apr 8, 2019 · release notes

    Adds raw registry accessor, Grafana reverse proxy, Windows FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules., artifact packs and readonly GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. users in Velociraptor 0.2.9

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.9 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout 0.2.9

    • Adds support for a raw registry accessor to parse locked hives like ntuser.dat or amcache.
    • Enables a reverse proxy integration with Grafana.
    • Introduces a Windows fuse implementation.
    • Implements artifact packs allowing artifacts to collect multiple VQL tables and contain other artifacts.
    • Adds ability to create read only users in the GUI.

    5 details in Everything

63. 0.2.8 Feb 20, 2019 · release notes

    Velociraptor 0.2.8 adds self-signed SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination., process memory dumping via proc_dump(), VQL fifo() plugin, and Prometheus metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.8 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout 0.2.8

    └──▷ HOW TO FIND IT
    Dump the memory of a specific process by PID for forensic analysis
    📍SELECT * FROM proc_dump(pid=12345)
    Create an artifact that triggers on a specific time window using the fifo() plugin
    📍SELECT * FROM fifo(interval=60, max_count=1) WHERE event_type='login_failed'
    • Adds proc_dump() VQL plugin to dump process memory from endpoints
    • Adds fifo() VQL plugin for time-based detection artifacts
    • Adds Prometheus metrics endpoint for monitoring Velociraptor server health
    • Adds Authenticode support for Windows code signing verification

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API connections now require TLS; unencrypted gRPC connections are no longer supported
64. 0.2.7 Dec 28, 2018 · release notes

    Adds autocert for self-provisioned SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. and Google OAuth SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.7 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout 0.2.7

    • Enables autocert to allow the server to provision its own SSL certificates automatically.
    • Adds oauth configuration to enable Google SSO integration.
    • Reworks the Hunts flow in the UI for simplicity.

    3 details in Everything

65. 0.2.6 Dec 13, 2018 · release notes

    Adds interactive shell VQL plugin and server-side event monitoring capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.6 https://github.com/Velocidex/velociraptor.git
    # already have the repo? check out this version:
    $ git checkout 0.2.6

    └──▷ TRY IT
    Execute a command on the target client via VQL.
    copy

    $ SELECT * FROM Execve(command='ls -la /tmp')

    Configure an artifact to trigger alerts based on collected events.
    copy

    $ SELECT * FROM ClientEvents() WHERE Name = 'EscalationEvents'

    • Adds InteractiveShell VQL plugin for running arbitrary commands on clients
    • Enables server-side VQL queries to watch client monitoring events

    2 details in Everything