Velociraptor: hunting one IOC across a fleet of endpoints

I have enough well-sourced material and four verified direct image URLs. Writing the post now.

The one-hash problem

Picture the worst kind of Tuesday. A threat-intelligence feed drops a single indicator into your inbox: the SHA-256 hash of a malicious DLL that a competitor in your sector found on a breached machine last week. The question your boss asks is deceptively simple. Do we have it too? You have roughly nine thousand laptops, workstations and servers scattered across four continents, half of them asleep in someone's bag. Checking them one at a time, by hand, would take a team of analysts the better part of a month. By then the answer would be worthless. This is the problem that endpoint hunting tools exist to solve, and few solve it as cleanly as Velociraptor, an open-source digital forensics and incident response (DFIR) platform. DFIR is the discipline of figuring out what an attacker did after the fact, and increasingly, of catching them mid-act. Velociraptor's pitch is that you can take that one hash, phrase it as a question, push the question out to every machine you own at once, and start seeing answers in minutes rather than weeks. According to the project's own documentation, a single server routinely watches over 10,000 to 15,000 endpoints.

The name is not an accident. The real animal was a small, fast, sharp-clawed hunter, and the tool's whole design philosophy is built around speed and reach rather than brute force. To understand how it pulls that off, and why the same design recently made it a gift to ransomware crews, it helps to start with where it came from.

Where Velociraptor came from

Velociraptor was created in 2018 by Mike Cohen, an Australian security engineer who had spent years at Google building exactly this kind of thing. Cohen worked on Google Rapid Response (GRR), Google's internal fleet-wide forensics agent, and on Rekall, a memory-analysis framework. Both were powerful and both were, by most accounts, painful to operate at scale. Velociraptor was his attempt to keep the power and throw out the pain. The commercial story caught up with the code in April 2021, when Rapid7 acquired Cohen's company, Velocidex Enterprises, based on Queensland's Gold Coast. The purchase price, disclosed in Rapid7's later SEC filings and reported by outlets including SiliconANGLE, was a modest $3.0 million. Crucially, Rapid7 kept the project open source. The company folded Velociraptor's guts into its commercial InsightIDR product, but the standalone tool remains free to download and self-host, which is why you find it running everywhere from Fortune 500 security operations centres to one-person consultancies parachuting into a breach.

Here is a common misconception worth clearing up before we go further. Velociraptor is not antivirus, and it is not a traditional EDR (endpoint detection and response) product that sits on a machine quietly blocking bad things. It does not, by default, decide anything on its own or stop an attack in progress. It is a visibility and collection engine: it answers the questions an analyst thinks to ask, as fast as the analyst can ask them. The intelligence lives in the human and in the queries they write. That distinction matters enormously for both its strengths and, as we will see, its dangers.

How the fleet stays reachable

Before you can hunt across ten thousand machines, ten thousand machines have to be listening. Velociraptor deploys a small agent, confusingly but conventionally called a client, as a background service on each endpoint. Each client holds open a persistent connection back to the central server, so every machine is available to be tasked the instant an analyst has a question. The communication design is more clever than it first appears, and Cohen wrote it up in detail. Rather than the old approach of clients polling the server every few seconds asking "anything for me yet?", which wastes bandwidth and adds latency, Velociraptor uses ordinary HTTPS POST requests to build what amounts to a full-duplex channel. The client opens a reader connection, and the server holds it open, trickling meaningless pad data down the pipe to keep it alive. The moment an analyst launches a task, the server has an open channel already waiting and forwards the request immediately. Because it is all standard HTTP inside TLS, it sails through corporate firewalls and proxies that would choke on anything more exotic. Security is baked into enrolment. Every Velociraptor deployment spins up its own internal public-key infrastructure (PKI): a certificate authority that issues an X.509 certificate and private key. The server verifies which client a message came from and the client verifies the server before it will talk. On top of that, the client configuration embeds a nonce, a shared secret, and the server flatly refuses to speak to any client that cannot present it. This stops a stranger's Velociraptor client from wandering onto your server, and vice versa. The single most important architectural choice is this: the queries go to the data, not the data to the queries. Most fleet-monitoring systems try to hoover every log and every file event back to a central lake and then search the lake. Velociraptor inverts that. It ships the question out to each endpoint, the endpoint parses its own artifacts locally, and only the answers come back. As the documentation puts it, the server largely just "writes the results to disk." That is why server load stays low enough for one frontend to carry the whole fleet, and it is the key to answering our one-hash question quickly.

VQL: turning an IOC into a question

The engine that makes all of this expressible is the Velociraptor Query Language, or VQL. If you have ever written SQL to interrogate a database, VQL will feel familiar: you SELECT columns FROM a plugin WHERE some condition holds. The difference is that the "tables" are live forensic sources on a running machine. One plugin enumerates processes, another parses the Windows registry, another walks the filesystem, another reads event logs. You compose them into a single query, and that query runs on the endpoint itself. A raw query is powerful but awkward to reuse. So Velociraptor wraps queries into artifacts: small YAML documents that bundle one or more VQL queries, give them a name, expose parameters, and document what they do. An artifact is the unit that gets shared, version-controlled and pushed to the fleet. The project ships hundreds of them out of the box, and the community publishes more, which means when a new threat surfaces, someone often has an artifact written for its specific indicators within hours. The workflow, as practitioners describe it, is that an analyst learns of a new indicator, writes the VQL to detect it, packages it as an artifact, and hunts it across the entire deployment in a matter of minutes. For our stray DLL, the workhorse artifact is Windows.Search.FileFinder, described in the docs as "the Swiss army knife of file searching." You hand it a glob such as C:\Users\*\AppData\**\*.dll, tell it to compute a hash of every match, and filter on the SHA-256 you were given. For indicators that hide inside files rather than being whole files, you reach for YARA, a pattern-matching language that scans byte content against rules; Velociraptor's YARA artifacts can sweep both files on disk and the memory of running processes.

Running the hunt

A query that runs on one machine is a collection. The same query fanned out across many machines is a hunt, and the hunt is where Velociraptor earns its keep. The hunting documentation describes it as "a logical collection of one or more artifacts from a group of systems." Creating one is deliberately anticlimactic. In the admin GUI you pick your artifact, Windows.Search.FileFinder primed with the malicious hash, set the scope (all Windows machines, or only those carrying a particular label such as finance or domain-controllers), and schedule it. A new hunt starts life paused; nothing happens until an administrator explicitly starts it, which is a small but sensible guard against firing a filesystem-wide scan at the whole company by accident. Once started, a component called the Hunt Manager watches for every client that matches the criteria and hands it the collection, exactly once, so no machine gets double-tasked. One design detail trips up newcomers and deserves emphasis: hunts do not complete, they expire. By default a hunt stays open for a week. This is not a bug but a direct response to reality: at any moment a big chunk of your fleet is powered off, on a plane, or otherwise offline. A hunt that "finished" the instant every currently-connected machine reported back would silently miss the laptop that boots up on Thursday. Instead the hunt sits there, and each machine collects its result whenever it next appears, until the expiry window closes. As results stream in, they land in a notebook, a workspace where you can run further VQL over the combined output from every endpoint at once. So even if three thousand machines report, you can write one line to filter down to the handful where the hash actually matched, then pivot straight from a hit into a deeper collection on those specific hosts, pulling their process lists, network connections and event logs. The one-hash question becomes a fleet-wide answer, and the answer becomes the start of the real investigation.

Not melting the fleet in the process

There is a reason the paused-by-default guard exists. Some artifacts are gentle; others are brutal. Scanning an entire filesystem with a YARA rule means opening and reading every file on every disk, and doing that to ten thousand machines simultaneously could hammer both the endpoints and the network. Velociraptor manages this on two fronts, and Cohen's performance notes lay out the logic. On the server side, concurrency is capped: the server processes only a small number of client connections at a time, on the order of eight to ten, to hold memory usage flat. When a client tries to upload results and the server is busy, the client simply backs off and retries the same buffer later. Nobody gets dropped; they just wait their turn. This is how one modest server survives a fleet ten thousand strong. On the endpoint side, there is a throttle the analyst controls directly. Velociraptor meters work in operations, a notional unit where, for YARA, one operation equals roughly one megabyte scanned or a single smaller file. When you launch a hunt you can cap the client at, say, twenty operations per second, and the agent will pace itself accordingly. The scan takes longer, but the user whose laptop it is running on never notices their fan spin up. Hunting a fleet you do not want to break is as much about restraint as reach.

When the hunters became the hunted

Everything that makes Velociraptor a superb defensive tool, quiet deployment, persistent reach, the ability to run arbitrary queries and pull files across a fleet, describes, from a slightly different angle, an almost perfect attack tool. In the autumn of 2025 that theoretical concern became a documented campaign. In a report published on 9 October 2025 (with a clarification added on 17 October), Cisco Talos described attackers installing Velociraptor on victim networks not to defend them but to own them. The activity was attributed, with moderate confidence, to a group Microsoft tracks as Storm-2603, associated with the Warlock and LockBit ransomware families. The intruders got in by exploiting the "ToolShell" chain of vulnerabilities in on-premises Microsoft SharePoint, then dropped Velociraptor via a malicious installer pulled from compromised Azure cloud storage. The clever, nasty twist was the version they chose. They deliberately deployed an outdated Velociraptor, version 0.73.4.0, which carries a known privilege-escalation flaw tracked as CVE-2025-6264. Rather than smuggle in their own custom implant, which a security team might flag, they used a legitimately signed forensics tool as their remote-access framework and then abused its own bug to seize full control. As The Register reported, the tool relaunched itself even after responders isolated a compromised host, and the crew used it to fetch Visual Studio Code and stand up a command-and-control tunnel. The endgame was ransomware: Warlock, LockBit, and, notably for the first time from this group, a Linux build of Babuk aimed at VMware ESXi servers. Talos and others have floated circumstantial indicators pointing toward a China nexus, access to the ToolShell exploit before public disclosure, malware features shipped within 48 hours, compilation timestamps aligning with China Standard Time, but this attribution remains contested and should be read as suggestive rather than settled. What is not contested is the lesson. A "living-off-the-land" attack that turns a trusted administrative tool against its owner is nearly invisible to defences tuned to spot foreign malware, precisely because the tool is not foreign. The defensive advice that followed was blunt: if you are not deliberately running Velociraptor, treat its sudden appearance on your network as an indicator of compromise in its own right, and keep any legitimate deployment patched. The current release line, 0.77.2, ships with the relevant fixes.

What to watch

The Velociraptor episode is a small, sharp instance of a pattern that keeps recurring in security: the same reach and automation that let a defender ask ten thousand machines a question in one breath let an attacker issue ten thousand commands just as fast. The tool is genuinely neutral; the PKI, the persistent channel, the arbitrary-query engine do not care whose hand is on the keyboard. That leaves defenders with a genuinely open question rather than a tidy resolution. As open-source DFIR frameworks grow more capable and more widely trusted, the signal "a legitimate admin tool is present" carries less and less information on its own. The interesting frontier is no longer what is running but who provisioned it, with what authority, and whether that provenance can be proven after the fact. Velociraptor made hunting one indicator across a fleet almost trivial. The harder hunt now is for the tools you did not deploy yourself.

Sources

1. Velociraptor / Rapid7, What is Velociraptor? (Overview), 2026.
2. Velociraptor / Rapid7, Hunting (GUI documentation), 2026.
3. Mike Cohen, Velociraptor, Velociraptor Network Communications, 2020.
4. Velociraptor / Rapid7, Windows.Search.FileFinder artifact reference, 2026.
5. Rapid7, Velociraptor Version 0.6.3: Dig Deeper With More Speed and Scalability, 2022.
6. Rapid7, Rapid7 Acquires Digital Forensics and Incident Response Open Source Project, Velociraptor, 2021.
7. SiliconANGLE, Rapid7 acquires open-source cybersecurity monitoring platform Velociraptor, 2021.
8. Cisco Talos Intelligence, Velociraptor leveraged in ransomware attacks, 2025.
9. The Register, SharePoint attackers add Velociraptor to ransomware tools, 2025.
10. BleepingComputer, Hackers now use Velociraptor DFIR tool in ransomware attacks, 2025.
11. Pen Test Partners, Using Velociraptor for large-scale endpoint visibility and rapid threat hunting, 2024.