BlueCloud

Resumen Despliegue de Cyber Range de HELK y Velociraptor. Implementación automatizada con Terraform de un sistema que ejecuta el servidor HELK + Velociraptor con un endpoint Windows registrado en Azure o AWS. Una colección de scripts de Terraform y Ansible que implementan automáticamente y...

veeam-velociraptor

Veeam Backup & Replication Velociraptor artifacts - PoC This repository contains a collection of Velociraptor artifacts acting as a proof-of-concept for a remote Veeam Backup & Replication forensics pipeline: artifacts/ contains the artifact definitions tools/ contains a qemu-img.zip archive that...

velociraptor

Velociraptor - Herramienta de visibilidad y recolección de endpoints. Velociraptor es una herramienta para recolectar información del estado del host mediante consultas en el Lenguaje de Consultas Velociraptor VQL. Para obtener más información sobre Velociraptor, lea la documentación en:...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...

CVE-2026-77797

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...

CVE-2026-77798

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

EUVD-2026-85882

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-77798

The Velociraptor software contains a deadlock condition within its user management module . This issue is caused by a lock management bug and can be triggered by authenticated users . The primary impact is a high availability risk, potentially leading to a denial of service . No specific patch ve...

CVE-2026-77798 Velociraptor Authenticated Denial of Service

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

EUVD-2026-85881

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...

CVE-2026-77797

The Velociraptor prefetch library contains an out of bounds vulnerability. This flaw may cause a crash when the library parses specific malformed prefetch files . No specific affected versions, exploit details, or remediation steps are provided in the documents.

CVE-2026-77797 Velociraptor Prefetch parser out of bounds

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...

CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

EUVD-2026-85870

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-19072

The Velociraptor platform is vulnerable to a security bypass because it allows users to set the internal "compiled_collector_args" field via a user API call. This flaw allows a user with the minimal "investigator" role to inject compiled VQL statements for a hunt while bypassing standard ACL chec...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

soc-automation-lab

SOC Automation Lab This repository documents the design, detection logic, automation workflows, and lessons learned from building an automated SOC demo using open-source tools. The project focuses on how alerts move from detection to investigation and notification , and what breaks along the way...

DetectRaptor

DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...

CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...