505 matches found
velociraptor
Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...
forensic-msvpn
Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...
DetectRaptor
DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...
BlueCloud
Overview Cyber Range deployment of HELK and Velociraptor! Automated terraform deployment of one system running HELK + Velociraptor server with one registered Windows endpoint in Azure or AWS. A collection of Terraform and Ansible scripts that automatically and quickly deploys a small HELK +...
soc-automation-lab
SOC Automation Lab This repository documents the design, detection logic, automation workflows, and lessons learned from building an automated SOC demo using open-source tools. The project focuses on how alerts move from detection to investigation and notification , and what breaks along the way...
veeam-velociraptor
Veeam Backup & Replication Velociraptor artifacts - PoC This repository contains a collection of Velociraptor artifacts acting as a proof-of-concept for a remote Veeam Backup & Replication forensics pipeline: artifacts/ contains the artifact definitions tools/ contains a qemu-img.zip archive that...
velociraptor_CVE-2025-6264_PoC
CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...
SUSE CVE-2026-77797
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...
SUSE CVE-2026-77798
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
SUSE CVE-2026-19072
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...
CVE-2026-77797
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...
CVE-2026-77798
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
CVE-2026-77798 Velociraptor Authenticated Denial of Service
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
CVE-2026-77798 Velociraptor Authenticated Denial of Service
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
EUVD-2026-85882
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
CVE-2026-77798
The Velociraptor software contains a deadlock condition within its user management module . This issue is caused by a lock management bug and can be triggered by authenticated users . The primary impact is a high availability risk, potentially leading to a denial of service . No specific patch ve...
CVE-2026-77798 Velociraptor Authenticated Denial of Service
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...
CVE-2026-77797 Velociraptor Prefetch parser out of bounds
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...