Suspicious Velociraptor Child Process

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · GPL-2.0

Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

title: Suspicious Velociraptor Child Process
id: d6a4c9bc-d5cf-bd43-fc5b-0a8b0a3c125f
related:
    - id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
      type: derived
status: experimental
description: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
references:
    - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-29
tags:
    - attack.command-and-control
    - attack.persistence
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_parent:
        ParentProcessName|endswith: \Velociraptor.exe
    selection_child_vscode_tunnel:
        CommandLine|contains|all:
            - code.exe
            - tunnel
            - --accept-server-license-terms
    selection_child_msiexec:
        CommandLine|contains|all:
            - msiexec
            - /i
            - http
    selection_child_powershell:
        CommandLine|contains:
            - 'Invoke-WebRequest '
            - 'IWR '
            - .DownloadFile
            - .DownloadString
    # Add more child process patterns as needed
        NewProcessName|endswith:
            - \powershell.exe
            - \powershell_ise.exe
            - \pwsh.exe
    condition: process_creation and (selection_parent and 1 of selection_child_*)
falsepositives:
    - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

99f29307-9cf2-48c7-88ba-4bec7add14b1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion