BlueCloud

Overview Cyber Range deployment of HELK and Velociraptor! Automated terraform deployment of one system running HELK + Velociraptor server with one registered Windows endpoint in Azure or AWS. A collection of Terraform and Ansible scripts that automatically and quickly deploys a small HELK +...

velociraptor

Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...

DetectRaptor

DetectRaptor A repository to share publicly available bulk Velociraptor detection content in an easy to consume way. Simply take the release VQL zip and import it into Velociraptor. This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor 1. Import Velociraptor Artifac...

veeam-velociraptor

Veeam Backup & Replication Velociraptor artifacts - PoC This repository contains a collection of Velociraptor artifacts acting as a proof-of-concept for a remote Veeam Backup & Replication forensics pipeline: artifacts/ contains the artifact definitions tools/ contains a qemu-img.zip archive that...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

velociraptor_CVE-2025-6264_PoC

CVE-2025-6264 DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes Affected versions before 0.74.3 Affects Windows, MacOS and Linux The Admin.Client.UpdateClientConfig artifact is missing...

soc-automation-lab

SOC Automation Lab This repository documents the design, detection logic, automation workflows, and lessons learned from building an automated SOC demo using open-source tools. The project focuses on how alerts move from detection to investigation and notification , and what breaks along the way...

EUVD-2026-118460

Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql VQL plugin...

Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin

Summary The sql VQL plugin runs a caller-supplied database driver and connection string with no permission check vql/parsers/sql/sql.go:93, SQLPlugin.Call. For driver='mysql' or driver='postgres' the handle comes from GetHandleOther sql.go:39, which passes the connection string straight to Go...

GHSA-9QQ5-422F-33C2 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin

Summary The sql VQL plugin runs a caller-supplied database driver and connection string with no permission check vql/parsers/sql/sql.go:93, SQLPlugin.Call. For driver='mysql' or driver='postgres' the handle comes from GetHandleOther sql.go:39, which passes the connection string straight to Go...

CVE-2026-85737

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-85737 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-85737

Velociraptor versions prior to 0.77.2 are vulnerable to arbitrary outbound database connections due to a lack of plugin-level FILESYSTEM_READ or NETWORK checks in vql/parsers/sql/sql.go. The SQLPlugin.Call function fails to validate caller-controlled connection strings before they are passed to s...

CVE-2026-85737 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-85737

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

PT-2026-138433

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.77.2 Description The SQLPlugin.Call function in vql/parsers/sql/sql.go fails to enforce FILESYSTEM READ or NETWORK checks before passing a caller-controlled connstring to sql.Open. This allows arbitrary outboun...

CVE-2026-85737: Velocidex velociraptor: Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-61739

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in backend/app/incidents/routes/incidentalert.py omit role and tenant authorization, and POST...

CVE-2026-61739 SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in backend/app/incidents/routes/incidentalert.py omit role and tenant authorization, and POST...

EUVD-2026-114005

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in backend/app/incidents/routes/incidentalert.py omit role and tenant authorization, and POST...