new @velocidex artifact and write-up detailing CVE-2025-14847 and how to detect #MongoBleed from @eric_capuano 🤓🔥🦖 blog.ecapuano.com/p/hunting-…

Rapid7 recently observed threat actors misusing @velocidex. ⚠️ No vulnerability exists in the tool itself—the risk is in how attackers abuse it. To help org's detect misuse, Velociraptor deliberately creates easy to detect IOCs. Learn what to look for 👉 r-7.co/4g2JomU

At @AusCERT conference we presented "Sigma and Detection Engineering with @velocidex Velociraptor". Learn how to implement real time Sigma detection with forensic enhancements. Full presentation piped.video/watch?v=3EBrpFng… and slides docs.velociraptor.app/presen…

Looking forward to speaking on a panel at the @rapid7 Take Command Summit. Register for free below as we talk about between pen testing, red teaming and the benefits of running regular security exercises. rapid7.brighttalk.com/?utm_s…

I've recently built a @velocidex #velociraptor VQL artifact to support Linux forensics. This artifact collects metadata about open file descriptors (other files, sockets, etc) from active processes on a Linux system. #dfir docs.velociraptor.app/exchan…

Do you use @velocidex? 😎🦖 Want to learn more? Our course is for security analysts, SOC team members, incident responders, and cybersecurity professionals looking to enhance their threat hunting skills 🔥 Register for THVR @WWHackinFest here: wildwesthackinfest.com/wild-…

🚀 I’ve done lot of work on LNK file collection and automated analysis, and I recently updated the publicly available LNK parser in Velociraptor - Windows.Forensics.Lnk. This post Walks through the structure of LNK files and demonstrates some advanced analysis techniques. Hopefully there is some capabilities you may find useful 🙂 👉 LINK: rapid7.com/blog/post/2024/11… #DFIR #CTI @velocidex

Analysts can overlook lesser-known data points during LNK forensics for cyber threat intelligence, missing valuable insights. 🔍 Explore the structure of LNK files using @velocidex with analysis techniques used by Rapid7 Labs ⤵️ r-7.co/4ehleme

day 1 of THVR @WWHackinFest training off to a great start 🦖🤓🔥

Wrapping up day 2 of THVR @WWHackinFest 😎 Every time, @eric_capuano makes this stuff look like a breeze Fun side effects of running our @velocidex trainings - they almost always result in our team contributing back to Velociraptor 🔥🦖💙 PRs incoming!

Velociraptor release 0.73 is now available for testing! Read about all the cool new features here docs.velociraptor.app/blog/2… . An exciting new feature is built in timelining capability. Check the blog post here docs.velociraptor.app/blog/2…

@eric_capuano rocking the @velocidex content on Day 3! Students getting ready to hunt all the things. Day 3 @BlackHatEvents starting strong!

I recently conducted a Rapid incident Response utilizing @velocidex session. Here is the session notes with some VQLs that can be utilized in IR cases github.com/0xAnalyst/IRSessi… #IncidentResponse #Velociraptor #ThreatHunting

The incident started with a compromised server. When we extended the hunting to the entire network, we found traces of the "WayBack" campaign on a computer, which @yoroisecurity documented almost exactly three years ago [1]. We also found the exact same code as in the blog on the corresponding client in the customer's network. For three years, this and other code could have gone unnoticed in the network. Another reason for regular compromise assessments and hunting in the internal network. [1] yoroi.company/en/research/th…

Great example of VQL automation!

Quick and dirty VQL to search for hosts potentially vulnerable to #OpenSSH #regreSSHion 🐛#CVE20246387 in @velocidex #velociraptor🔍🦖 gist.github.com/weslambert/5… Use when hunting with with Linux.Debian.Packages and Linux.RHEL.Packages docs.velociraptor.app/artifa… #DFIR #Infosec

I was so excited about the new 0.72 release of Velociraptor I just could not wait to make a quick video to show you all the new features! #velociraptor #dfir #digitalforensics Check it out here piped.video/watch?v=FwmFYmTQ…

📣 Velociraptor v0.7.2 is now live! The long-awaited release is highlighted by EWF support, dynamic DNS, improved SSH access, secrets management & much more. Read up on all the exciting new features and download it today: r-7.co/3Uk9YNN

If you are a regular user, you'll no doubt have noticed new features since v0.7.1 that extend forensic capabilities on various systems. Nathanael Ndong shows us how to leverage those new features to perform forensic analysis of a VMware ESXi hypervisor. buff.ly/3W9l6Ql

Registration is now open for Rapid7's Take Command, a day-long virtual summit in partnership with AWS. You do not want to miss it. You’ll get new attack intelligence, insight into AI disruption, transparent MDR partnerships, and more. buff.ly/49PMXbn