Velociraptor DFIR Tool Deployment and Abuse Detection
This rule detects the deployment and potential abuse of Velociraptor, a DFIR (Digital Forensics and Incident Response) tool. It identifies Velociraptor by monitoring file creation/modification in common installation paths and for its executable name, process execution, and the creation of suspicious child processes (like PowerShell, cmd, curl, wget) by Velociraptor. The rule also attempts to correlate these activities to determine the severity of the detection, indicating potential post-exploitation activity.
Microsoft Sentinel (KQL)
