A repository to share publicly available bulk Velociraptor detection content in an easy to consume way.
Simply take the release VQL zip and import it into Velociraptor.
This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor
- Import Velociraptor Artifact Exchange
Server Artifacts > + Server.Import.ArtifactExchange
This should import the "Import DetectRaptor" artifact.
- Import DetectRaptor
Server Artifacts > + Exchange.Server.Import.DetectRaptor
Current artifacts include:
- DetectRaptor.Windows.Detection.Amcache
- DetectRaptor.Windows.Detection.Applications
- DetectRaptor.Windows.Detection.BinaryRename
- DetectRaptor.Windows.Detection.Bootloaders
- DetectRaptor.Windows.Detection.Evtx
- DetectRaptor.Windows.Detection.HijackLibsEnv
- DetectRaptor.Windows.Detection.HijackLibsMFT
- DetectRaptor.Windows.Detection.Powershell.ISEAutoSave
- DetectRaptor.Windows.Detection.LolDriversMalicious
- DetectRaptor.Windows.Detection.LolDriversVulnerable
- DetectRaptor.Windows.Detection.Yara.LolDrivers
- DetectRaptor.Windows.Detection.LolRMM
- DetectRaptor.Windows.Detection.MFT
- DetectRaptor.Windows.Detection.NamedPipes
- DetectRaptor.Windows.Registry.NetworkProvider
- DetectRaptor.Windows.Detection.Powershell.PSReadline
- DetectRaptor.Windows.Detection.Webhistory
- DetectRaptor.Generic.Detection.YaraFile
- DetectRaptor.Linux.Detection.YaraProcessLinux
- DetectRaptor.Macos.Detection.YaraProcessMacos
- DetectRaptor.Windows.Detection.YaraProcessWin
- DetectRaptor.Generic.Detection.YaraWebshell
- DetectRaptor.Windows.Detection.ZoneIdentifier
Server artifacts:
- DetectRaptor.Server.StartHunts
- DetectRaptor.Server.ManageContent
Some contributing repositories: