home.social

#velociraptor — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #velociraptor, aggregated by home.social.

fetched live
  1. ----------------

    🚨 Incident Response
    ===================

    InfoGuard Labs recently published an article by Matthew Green titled "AI Ate My Velociraptor." Based on the provided metadata, the piece focuses on the intersection of artificial intelligence and the Velociraptor digital forensics and incident response (DFIR) tool.

    Context and Scope
    Velociraptor is a widely used open-source tool for endpoint visibility and digital forensics. The title suggests an exploration of how AI integration might fail, hallucinate, or otherwise disrupt traditional DFIR workflows. While the exact technical findings and methodologies are not detailed in the provided metadata, the author explicitly notes that the source content remains unverified and preliminary in this context.

    Technical Implications
    Given the title, the article likely addresses the risks of delegating forensic analysis to large language models (LLMs) or automated AI agents. Common issues in this space include:
    • Hallucinations: AI models generating non-existent artifacts or misinterpreting log structures.
    • Context Loss: LLMs failing to maintain the chain of custody or missing nuanced threat actor TTPs that a human analyst would catch.
    • Data Parsing Errors: AI misinterpreting binary data or complex event logs collected by Velociraptor.

    Analysis
    If AI is being used to parse or summarize Velociraptor artifacts, the failure mode might involve confidently presenting incorrect timelines or missing critical persistence mechanisms. This is a significant operational risk for incident response teams looking to automate triage.

    Conclusion
    The intersection of AI and DFIR requires strict validation. Automated tools cannot blindly replace human verification of forensic artifacts. The full details of Matthew Green's analysis are pending independent review of the InfoGuard Labs publication.

    🔹 DFIR #Velociraptor #AI #IncidentResponse #InfoGuard

    🔗 Source: labs.infoguard.ch/posts/ai_ate

  2. CVE-2026-19072 (CRITICAL, CVSS 9.9) impacts Rapid7 Velociraptor <0.77.2. 'Investigator' role can escalate to admin by injecting arbitrary VQL via API. Patch by upgrading to 0.77.2+. Details: radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE #Infosec

  3. CVE-2026-19072 (CRITICAL, CVSS 9.9) impacts Rapid7 Velociraptor <0.77.2. 'Investigator' role can escalate to admin by injecting arbitrary VQL via API. Patch by upgrading to 0.77.2+. Details: radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE #Infosec

  4. CVE-2026-19072 (CRITICAL, CVSS 9.9) impacts Rapid7 Velociraptor <0.77.2. 'Investigator' role can escalate to admin by injecting arbitrary VQL via API. Patch by upgrading to 0.77.2+. Details: radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE #Infosec

  5. CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header — full account takeover. No patch yet. Restrict GUI access, monitor requests. radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE202618972

  6. CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header — full account takeover. No patch yet. Restrict GUI access, monitor requests. radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE202618972

  7. CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header — full account takeover. No patch yet. Restrict GUI access, monitor requests. radar.offseq.com/threat/cve-20 #OffSeq #Velociraptor #CVE202618972

  8. [Art Fight] Taurientists!
    Science is meant to be shared!  :3

    Art Fight attack on @vicariousbirding!!
    With 3 minutes to spare!  And some edits afterwards to fix some obvious mistakes! 🙃

    #ArtFight #SpiralCyr #chameleon #taur #multifur #multiplelegs #multiplearms #raptor #velociraptor #velociraptaur #raptaur #dino #dinotaur #dinosaur

  9. [Art Fight] Taurientists!
    Science is meant to be shared!  :3

    Art Fight attack on @vicariousbirding!!
    With 3 minutes to spare!  And some edits afterwards to fix some obvious mistakes! 🙃

    #ArtFight #SpiralCyr #chameleon #taur #multifur #multiplelegs #multiplearms #raptor #velociraptor #velociraptaur #raptaur #dino #dinotaur #dinosaur

  10. ----------------

    🚨 Incident Response: Unifying Detection Engineering and Digital Forensics with Velociraptor
    ===================

    A new research paper proposes a unified detection-forensics methodology using Velociraptor, bridging the gap between real-time alerting and traditional forensic analysis. The core concept is that detection logic directly initiates targeted evidence acquisition at the point of detection, rather than operating in parallel.

    The paper introduces a four-stage methodology to convert artefact knowledge into reusable and testable detection rules suitable for both post-incident triage and live monitoring:

    1. Baseline establishment
    2. Evidence correlation
    3. Attack chain analysis
    4. Scenario labelling with confidence

    The researchers demonstrate this approach using three Velociraptor BaseVQL log sources: forensics/windows/prefetch, forensics/windows/usn, and /windows/wmi. They show that artefact-based detections enable scalable forensic triage without the need for full disk acquisition. Additionally, periodic artefact analysis offers continuous monitoring while substantially reducing data volume compared to conventional endpoint logging.

    Two case studies illustrate the practical application:

    First, a Prefetch and USN baseline for triage when Windows Event Logs are cleared or unavailable. Attackers routinely disable or clear volatile log sources (MITRE ATT&CK T1070.001). Relying on these logs for SIEM-based detection creates a single point of failure. By establishing baselines with Prefetch and USN Journal data, responders can reconstruct past activity even when standard logging mechanisms are compromised.

    Second, a WMI persistence correlation that supports both triage and continuous monitoring through periodic artefact analysis. Windows Management Instrumentation (WMI) is a common technique for maintaining persistence. Correlating WMI artefacts allows defenders to detect these mechanisms without relying solely on real-time event forwarding.

    The implications of this methodology are significant for SOCs and IR teams. By shifting some detection logic to endpoint artefacts rather than exclusively forwarding volatile logs to a SIEM, organizations can maintain visibility even when attackers attempt to cover their tracks. This approach also addresses the data volume problem that plagues many SIEM deployments, as periodic artefact collection is more efficient than continuous event logging.

    For practitioners, the paper provides deployable BaseVQL queries that can be used immediately. The integration of detection engineering with forensic artefacts provides a more resilient detection strategy.

    🔹 DFIR #Velociraptor #DetectionEngineering #DigitalForensics #IncidentResponse

    🔗 Source: arxiv.org/html/2606.28812v1

  11. [Art Fight] Kite Flight!
    Just dinos a human office worker and dino trying some fun at the park!  x3

    My fight Art Fight attack on @/chickensnpies.bsky.social on Bluesky!!

    #ArtFight #SpiralCyr #dino #dinosaur #dinotaur #taur #pterodactyl #ptaurodactyl #raptor #velociraptor

  12. CW: NSFW Anthro Penis

    Doodles
    Here are some sketches I did at Furvaria. Was a fun con, did some drawings for fun and some doodles for charity. And man that is soo stressfull...I wanna do a good job but also can't take forever as they are only supposed to be doodles lol. But everytime I do something like this I get better at managing that stress. Also the super tiny post-it note size in the top left really helps with not being able to do details anyways heh.

    And the bottom-left doodle is something I did real quick with a mouse now just to fill out the blank space :P

    #furry #art #furryart #nsfw #raptor #doodle #fox #velociraptor #headshotportrait #fulllengthportrait #pokemon #monochrome #penis #happy #happyexpression #openmouth #opensmile #sketch #sketchpage #pencilsketch #sheath #fluffy #fluffyears #fluffychest #dipsticktail #lookingatviewer #lookingforward #bedroomeyes #blush #blushlines #collar #ampharos #dinosaur #fluffydinosaur #canine #wolf #anthro #feral #lyingonbed #traditionalmediaartwork #coloredpencilartwork

  13. New Forensics Tool: DFIR-Companion 🆕
    An AI pair of eyes sitting over your shoulder, catching what you miss while you're deep in an investigation.

    Repo: github.com/hasamba/DFIR-Compan
    Landing page: hasamba.github.io/DFIR-Compani

    Honestly, it started out of frustration.

    I'm sitting on an investigation, open Velociraptor, spot an interesting lead, start digging into it, find another lead, and so on, and then suddenly I realize I completely forgot to go back to the other findings from the first artifact.

    The sheer amount of information you need to process during an investigation is simply more than one pair of eyes can handle, no matter how much coffee you've had.

    So I started building something to help myself and it ended up going somewhere I didn't expect.

    The original idea was a browser extension that takes screenshots every few seconds, so I could scroll back and see what I missed. Pretty dumb idea in hindsight, actually. But then the question came up: if I already have all those screenshots, why not let AI go through them while I work?

    And from there it exploded.

    Today it's a real-time dashboard that updates live as I investigate. It identifies findings, automatically builds an event timeline, extracts IOCs and enriches them from multiple sources, creating playbook that suggests what to check next, suggest hunt queries for velociraptor, run them and collect back the results, checks for data leaks, and answers the standard questions every investigation report needs: access vector, lateral movement, privilege escalation, etc. If a client confirms a finding-"that's legit, it's our weekly scan", one click and the entire analysis updates accordingly.

    The coolest part, to me, is that this started as a Velociraptor-specific solution but in practice became an AI layer on top of every tool I have open in the browser: SIEM, Security Onion, Splunk4DFIR, VolWeb, you name it. Even tools with no built-in AI suddenly get smarter, and all the data consolidates in one place instead of me jumping between ten tabs.

    Important to understand: this is NOT another detection layer. Your Sigma, YARA, and Suricata rules are already doing their job. This tool is the layer after detection-it takes all the verdicts from your tools, correlates them, and builds the "so what."

    The tool didn't stop at screenshots either. You can feed it almost any DFIR output and it will automatically detect the format and import it deterministically (no burning tokens on AI for that).

    Additional features:
    • Data correlation
    • Threat intel enrichment — with OPSEC in mind
    • AI input anonymization
    • Asset ↔ IoC graph
    • Targeted query generation
    • Export to multiple platforms
    • Free-form case Q&A against an LLM
    and much more...

    📎 If you work in DFIR, Blue Team, or SOC — I'd love for you to try it out, open issues, suggest features, submit PRs, or just tell me what you think.

    #DFIR #CyberSecurity #IncidentResponse #BlueTeam #ThreatHunting #OpenSource #MITRE #velociraptor

  14. Ever Wondered What a Deadly Flying Squirrel With Velociraptor Claws Would Look Like? Science Has Your Answer.

    The velociraptor had a four-winged cousin that, according to the artist rendering released with news of its discovery,…
    #NewsBeep #News #Wildlife #AU #Australia #dinosaurs #flyingsquirrel #Science #velociraptor
    newsbeep.com/au/736209/

  15. Ever Wondered What a Deadly Flying Squirrel With Velociraptor Claws Would Look Like? Science Has Your Answer.

    The velociraptor had a four-winged cousin that, according to the artist rendering released with news of its discovery,…
    #NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Wildlife #Dinosaurs #flyingsquirrel #Science #Velociraptor
    newsbeep.com/us/703210/

  16. CW: NSFW Erect Anthro

    Horny Raptor in Grey
    Looks like someone needs some help...

    Played around with a marker brush and made a nice sketch. Refined that all in one layer with transparency and regretted that decision afterwards heh. Overlaying colors or getting clean edges was not working out so I just kept it grey. Refined the edges a bit so it doesn't look like artifact city and now it doesn't look so bad :)

    #furry #art #nsfw #furryart #raptor #velociraptor #anthro #penis #presenting #presentingpenis #anus #taperingpenis #claws #toeclaws #tail #tailtuft #greyscale #monochrome #sigh #lookingatviewer #lookingdown #lowangleview #standing #erection #dinosaur #mohawk #fur #furreddinosaur #scalie #furredscalie #tailanus #solo #simplebackground #digitalmediaartwork #digitaldrawingartwork

  17. Some dinosaurs at the pool. Size does matter in these Cretaceous waters…

    Feat.
    @caudlewag.bsky.social
    @chickensnpies.bsky.social

    #dinosaur #tyrannosaurus #velociraptor #inflatable #marinereptile #pliosaur #ichthyosaur #furryart #wip

  18. Some dinosaurs at the pool. Size does matter in these Cretaceous waters…

    Feat.
    @caudlewag.bsky.social
    @chickensnpies.bsky.social

    #dinosaur #tyrannosaurus #velociraptor #inflatable #marinereptile #pliosaur #ichthyosaur #furryart #wip

  19. Some dinosaurs at the pool. Size does matter in these Cretaceous waters…

    Feat.
    @caudlewag.bsky.social
    @chickensnpies.bsky.social

    #dinosaur #tyrannosaurus #velociraptor #inflatable #marinereptile #pliosaur #ichthyosaur #furryart #wip

  20. A wild velociraptor I mean, sorry let me start over - a wild American turkey…. Those are easy to get confused - hanging out in my neighbor’s yard.

    #Nature #Birds #Velociraptor #Turkey #Georgia #USA

  21. A wild velociraptor I mean, sorry let me start over - a wild American turkey…. Those are easy to get confused - hanging out in my neighbor’s yard.

    #Nature #Birds #Velociraptor #Turkey #Georgia #USA

  22. A wild velociraptor I mean, sorry let me start over - a wild American turkey…. Those are easy to get confused - hanging out in my neighbor’s yard.

    #Nature #Birds #Velociraptor #Turkey #Georgia #USA