Velociraptor by LimaCharlie provides the ability to effectively investigate a wide range of digital forensic use cases. It can be used to reconstruct attacker activities through digital forensic analysis, hunt for evidence of sophisticated adversaries, investigate malware outbreaks and suspicious network activities, monitor for suspicious user activities, discover disclosure of confidential information, and gather endpoint data for threat hunting and future investigations. Velociraptor’s power and flexibility come from the Velociraptor Query Language (VQL). The VQL framework creates customized scripts to collect, query, and monitor endpoints or networks. Custom VQL scripts are deployed as 'Artifacts,' which are YAML text files that encapsulate the VQL and provide customizable parameters. Velociraptor automates the deployment and running of Velociraptor Artifacts. It supports three actions: list to show all built-in Artifacts, show to display the usage of a specific built-in Artifact, and collect to trigger an actual collection of Artifacts. Once generated by Velociraptor, a zip file with all collected data is ingested automatically into LimaCharlie for download. The download can also be automated using an Output stream with detection triggers.
