{"id":"4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c","title":"Suspicious Velociraptor Child Process","description":"Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-08-29","modified":"","tags":["attack.command-and-control","attack.persistence","attack.t1219"],"technique_ids":["T1219"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts."],"references":["https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml","source_sha256":"90b85c80b886cc49b65623b157bc706642915072715e1ff28597f332ea6cb8ef","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Velociraptor Child Process\nid: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c\nstatus: experimental\ndescription: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.\nreferences:\n    - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-08-29\ntags:\n    - attack.command-and-control\n    - attack.persistence\n    - attack.t1219\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\Velociraptor.exe'\n    selection_child_vscode_tunnel:\n        CommandLine|contains|all:\n            - 'code.exe'\n            - 'tunnel'\n            - '--accept-server-license-terms'\n    selection_child_msiexec:\n        CommandLine|contains|all:\n            - 'msiexec'\n            - '/i'\n            - 'http'\n    selection_child_powershell:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\powershell_ise.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - 'Invoke-WebRequest '\n            - 'IWR '\n            - '.DownloadFile'\n            - '.DownloadString'\n    # Add more child process patterns as needed\n    condition: selection_parent and 1 of selection_child_*\nfalsepositives:\n    - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","page":"techniques/enterprise/T1219/"}],"data_path":"data/detection-rules/4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c.json","kind":"sigma"}