https://cybertoolchain.io/tools/velociraptor New releases and features in Velociraptor, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 01:00:38 GMT https://github.com/Velocidex/velociraptor/releases/tag/v0.77.3 https://github.com/Velocidex/velociraptor/releases/tag/v0.77.3 Mon, 05 Oct 2026 01:00:38 GMT Velociraptor v0.77.3 adds Azure Monitor upload, a VQL LSP server, ARM64 Windows support, and custom .deb/.rpm service user/group options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds azure_monitor_upload() VQL plugin and `Azure.Monitor.Upload` server-event artifact to stream completed-flow results to an Azure Log Analytics workspace via the Logs Ingestion API, supporting service principal, `AZURE_*` environment variables, managed identity, and the Azure SDK default credential chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `Azure Monitor Creds` secret type for storing Log Analytics credentials and destination in the secrets service. • Adds a VQL Language Server Protocol (LSP) server (`velociraptor lsp`) providing diagnostics, syntax highlighting, hover, completions, and document symbols for VQL artifact development. • Adds an ARM64 Windows build target, with MSI and offline collectors updated to support ARM64 (and x86 support removed). • Adds `download_transforms` option to the inventory service, currently supporting `gunzip` to decompress gzip-compressed files before storing them in the inventory. • Adds `Client.Logging`, `Client.Logging.output_directory`, `Client.Logging.separate_logs_per_component`, `Client.Logging.rotation_time`, `Client.Logging.max_age`, `Client.Logging.debug`, `Client.Logging.info`, `Client.Logging.error`, `Client.Logging.remote_syslog_server`, `Client.Logging.remote_syslog_protocol`, and `Client.Logging.remote_syslog_components` configuration keys for granular client-side log management. • `Server.Utils.BackupDirectory`, `Server.Utils.BackupGCS`, and `Server.Utils.BackupS3` now emit only `ClientId`, `FlowId`, and fields derived from them rather than all columns. Breaking changes: • `Server.Utils.BackupDirectory`, `Server.Utils.BackupGCS`, and `Server.Utils.BackupS3` now emit only `ClientId`, `FlowId`, and derived fields — downstream consumers reading any other column will break and must be updated. • The ARM64 Windows MSI and offline collectors no longer include x86 support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2 https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2 Mon, 10 Aug 2026 11:18:05 GMT Velociraptor v0.77.2 adds a full-text index() plugin, VQL default parameters, hunt tags, `dir_permissions` in copy(), and more new VQL/UI capabilities. • Adds index() VQL plugin to build local full-text indexes, with batch mode for faster indexing. • Adds `dir_permissions` parameter to the copy() VQL function for controlling directory permissions during file operations. • Adds `Tags` argument to the hunt() VQL function, enabling programmatic tagging of hunts at creation time. • VQL functions and stored queries can now define default parameter values (e.g. `LET F(X=2, Y=3) = X + Y`); the artifact verifier flags missing required args. • Adds API support to the `artifacts collect` command-line run mode. • Allows a ZIP file to be imported using the `--definitions` flag. • Adds support for alphanumeric-only e-mail barrier authentication. • Reworks automated OIDC role assignment. • Updates cache() and memoize() plugins to use disk-based LRU storage. • Adds ability to message users directly from the GUI. • Adds a new flow-upload artifact for Azure Data Explorer (ADX). • Reworks the shell interface and GUI to utilize sessions, with graceful timeout for shell sessions. • Adds filters on the users list in the user management screen. • Adds initial implementation of a Velociraptor container. • Updates the Elastic client library to version 9.3. • Stores GUI state in `sessionStorage` for improved session continuity. Breaking changes: • Support for old client APIs has been removed (`Remove support for old client APIs`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.76.7 https://github.com/Velocidex/velociraptor/releases/tag/v0.76.7 Mon, 10 Aug 2026 11:16:58 GMT Velociraptor v0.76.7 backports VQL default parameters, a new index() plugin, hunt tagging, and OIDC enhancements from the 0.77 cycle. • Adds `Tags` argument to the hunt() VQL function to set hunt tags programmatically. • Adds `GUI.authenticator.claims.allow_unverified_email` and `GUI.authenticator.claims.override_acls` config keys for finer OIDC role-assignment control. • Adds index() VQL plugin to build local full-text indexes over collected data. • VQL stored queries and functions can now define default parameter values (e.g. `LET F(X=2, Y=3) = X + Y`), with the verifier flagging calls that omit required parameters. • Reworks automated OIDC role assignment, including support for alphanumeric-only e-mail barrier. • Updates cache() and memoize() plugins to use disk-based LRU, enabling larger datasets to be cached without exhausting memory. • Adds ability to message users directly from the GUI. • Adds API support to the `artifacts collect` command. • Allows a ZIP file to be imported with the `--definitions` flag. • Adds user-list filters in the user management screen. Breaking changes: • The `--config_override` / `-o` flag has been removed from the CLI. • Support for old client APIs has been removed (`Remove support for old client APIs`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.77.1 https://github.com/Velocidex/velociraptor/releases/tag/v0.77.1 Tue, 23 Jun 2026 00:01:42 GMT Velociraptor v0.77.1 adds VQL default parameters, full-text indexing, hunt tagging, shell sessions, user messaging, and more. • Adds default parameter values for VQL functions and stored queries, enabling optional arguments and verifier enforcement of required ones. • Adds new index() VQL plugin to build local full-text indexes over collected data, with batch mode for fast ingestion. • Adds `dir_permissions` parameter to the copy() VQL function for controlling directory permission on copy operations. • Adds `Tags` argument to the hunt() VQL function, enabling programmatic tagging of hunts at creation time. • Adds API support to the `artifacts collect` command for programmatic artifact collection invocation. • Adds ability to import artifact definitions from a ZIP file via the `--definitions` flag. • Adds new Azure Data Explorer (ADX) flow upload artifact for forwarding collected flows to ADX. • Adds alphanumeric-only e-mail barrier support for access control. • Reworks OIDC role assignment for automated role mapping. • Reworks the shell interface to utilize persistent sessions with graceful timeout support. • Adds ability to message users directly from the GUI. • Adds filters on the users list in the user management screen. • Updates cache() and memoize() VQL plugins to use disk-based LRU, enabling larger caches. • Adds initial Velociraptor container implementation. • Introduces a `sumo` build tag (`make linux_sumo`) for builds that include full AWS and Google Cloud client libraries; default builds are significantly smaller (up to ~27 MB reduction). • Removes the starlark() plugin from default builds. • Adds a reformat tooltip to the New Artifact modal in the GUI. • Stores GUI state in sessionStorage for improved browser session handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.75 https://github.com/Velocidex/velociraptor/releases/tag/v0.75 Mon, 25 Aug 2025 04:37:44 GMT Velociraptor 0.75 adds yarax(), new artifacts, a decrypt command, S3 path-style support, ADFS/OIDC, and more. • New yarax() VQL plugin for YARA-X scanning support. • New `Windows.System.Threads` artifact for enumerating system threads. • New SharpHound artifact for Active Directory bloodhound-style collection. • Adds `decrypt` CLI command to decrypt an encrypted offline container. • New `path_style` option on upload_s3() for S3-compatible storage endpoints that require path-style URLs. • Secrets can now be inherited from the root org, enabling cross-org secret sharing. • Updated watch_syslog() to accept a query parameter for filtered syslog monitoring. • New `denied_file_accessor_prefix` config option to restrict file accessor paths. • Adds ADFS support for OIDC authentication where claims are delivered in the access token. • Global Messages surface now alerts users when critical server-side errors occur. • Client audit information is now logged on the client side. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.74 https://github.com/Velocidex/velociraptor/releases/tag/v0.74 Wed, 26 Feb 2025 04:12:12 GMT Velociraptor v0.74 ships a reworked Sigma rule editor and new live event sources for Linux and Windows. • Adds a reworked Sigma rule editor for developing and testing Sigma rules directly within Velociraptor. • Adds new live event sources for Linux and Windows to power real-time Sigma-based detections. • Introduces a new timeline feature for correlating and reviewing detection events. Breaking changes: • Elastic index names may change: sanitization rules were relaxed to align with official Elastic naming conventions, which can rename existing indexes in your pipeline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.73 https://github.com/Velocidex/velociraptor/releases/tag/v0.73 Sat, 21 Sep 2024 04:58:30 GMT Velociraptor v0.73 revamps the timelining feature for improved forensic timeline analysis. • Revamped timelining feature with a redesigned timeline investigation workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.72 https://github.com/Velocidex/velociraptor/releases/tag/v0.72 Mon, 11 Mar 2024 13:55:49 GMT Velociraptor v0.72 adds EWF/E01 image support, SSH remapping, VQL Secrets, Websocket protocol, and http_client multipart upload. • Adds the `ewf` accessor to analyze EWF (E01) disk images • Allows remapping clients to use the `sftp` protocol via SSH accessor for Virtual Clients • Introduces `Secrets` in VQL as a named key/value data object for plugin credentials • Implements Websocket based communication mechanism for low latency client-server comms • Adds Dynamic DNS providers: switched default to `CloudFlare` and added `noip.com` as an option • Enhances proxy support with PAC files and regex-based URL matching rules • Enables Process memory access on MacOS • Adds the `files` parameter to the http_client() plugin for multipart streaming uploads Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0 https://github.com/Velocidex/velociraptor/releases/tag/v0.7.0 Mon, 28 Aug 2023 06:22:11 GMT Velociraptor v0.7.0 adds Chrome Session Storage artifacts, S3 and VSS accessors, GUI CIDR filtering, and SQLiteHunter. • Adds `GUI.allowed_cidr` config option to restrict GUI access by source IP • Adds `ntfs_vss` accessor for Volume Shadow Copies analysis with deduplication • Adds S3 accessor allowing plugins like glob() to query and read from S3 buckets • Adds `Windows.Forensics.Lnk` artifact with comprehensive Lnk file parsing • Incorporates `SQLiteHunter` artifact for finding and analyzing SQLite files • Adds Chrome artifacts including a leveldb parser for Chrome Session Storage Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.9 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.9 Thu, 25 May 2023 01:07:31 GMT Velociraptor v0.6.9 adds SMB transport, VQL EXPLAIN, lockdown mode, and multi-file download. • Adds `EXPLAIN` keyword for debugging VQL queries in the notebook or client • Introduces 'lockdown' server mode to prevent new collections/hunts while allowing data viewing • Adds audit event viewer to the GUI for events like collection launch and hunt creation • Enables specifying expected hash for tools defined in external third-party artifacts • Supports Azure blob storage for offline collector uploads • Allows uploading the offline collector to an SMB share • Allows serving tools from an SMB share • Adds multi-file download capability in the VFS GUI • Adds hex viewer widget for direct file preview in the GUI • Enables filtering artifact packs and setting prefix during manual import in the GUI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.8-2 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.8-2 Mon, 13 Feb 2023 11:39:18 GMT New VFS paging, `upload_preview` column type, client-side collection tracing, and temp file materializer for VQL. • `VFS` uses pageable tables to view arbitrarily large directories without memory exhaustion • `Trace` collection parameter allows automatic client-side state capture during any hunt or collection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.7-5 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.7-5 Thu, 27 Oct 2022 12:32:59 GMT Encrypted offline collections and urgent hunt priority in Velociraptor v0.6.7-5 • Adds X509/PGP encryption support for offline collector files to secure collected data at rest. • Adds `urgent` flag to the collection launch wizard to pre-empt larger hunts on busy systems. • Allows scheduling Hunts across multiple organizations directly from the GUI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.6-1 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.6-1 Thu, 08 Sep 2022 02:01:14 GMT Velociraptor v0.6.6-1 adds full multi-tenancy via on-the-fly org creation and expanded process tracker access. • Adds full multi-tenancy support allowing administrators to create new organizations (orgs) dynamically at runtime for client separation • Expands the process tracker capability, enabling VQL queries to access historical process information from the endpoint • Enables right-click context menu actions in the GUI for table cells, including sending data to VirusTotal and Cyberchef • Allows Notebook users to share notebooks publicly with all users in the organization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.5-0 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.5-0 Mon, 06 Jun 2022 15:30:00 GMT Velociraptor v0.6.5 adds VQL log levels for fail-on-error, multi-language GUI, and MUSL build target. • Adds `ERROR` level logging in VQL to make collections fail explicitly when critical errors occur • Supports French, German, Spanish, and Portuguese locales in the Velociraptor GUI • Allows users to select a custom display timezone for timestamps • Adds MUSL build target providing a static binary for older Linux systems Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.4-2 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.4-2 Tue, 29 Mar 2022 04:45:39 GMT Adds dead disk image emulation, per-query CPU throttling, and multi-provider OAuth2 SSO to Velociraptor • Emulate a live client against dead disk images to run standard VQL artifacts for offline forensic analysis • Throttle VQL queries using a feedback-based controller to maintain a target average CPU utilization on the endpoint • Configure and authenticate against multiple OAuth2 providers simultaneously in the Velociraptor GUI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.3 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.3 Wed, 26 Jan 2022 16:50:54 GMT Adds in-memory search index, multi-frontend config support, YARA/regex UI parameters, root cert config key, and file upload to artifacts. • `VQL` glob plugin gains `recursion_callback` option for fine-grained directory control • `Server.Utils.DeleteManyFlows` and `Server.Utils.DeleteMonitoringData` artifacts for disk space management • New `Windows.Forensics.SAM` artifact for parsing the SAM registry hive • Hunt wizard can now estimate client count based on label/OS conditions • Adhoc file upload to artifact parameters via new Upload File Form element • `Server.Config.RootCerts` in config file allows specifying root certificates (e.g. for MITM proxies) Breaking changes: • The `Windows.Collectors.File` artifact was renamed to `Generic.Collectors.File`; custom artifacts referencing the old name will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor https://github.com/Velocidex/velociraptor/releases/tag/v0.6.2 https://github.com/Velocidex/velociraptor/releases/tag/v0.6.2 Tue, 02 Nov 2021 16:55:02 GMT Velociraptor v0.6.2 adds password protection for exports and memory-based Cobalt Strike config extraction • Users can now specify a password to lock downloads, creating password-protected exports. • The Cobalt Strike config parser now supports extracting configuration directly from memory. • New artifact `Windows.Forensics.UserAccessLogs` parses UAL ESE files for Windows forensics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/velociraptor