Windows: Suspicious Velociraptor Child Process Execution Indicators

Alerts when Velociraptor.exe spawns specific child processes tied to tunneling, msiexec web installs, or PowerShell download commands.

FreeUnreviewedSigmahighv1

windows-suspicious-velociraptor-child-process-execution-indicators-4bc90587

title: "Windows: Suspicious Velociraptor Child Process Execution Indicators"
id: 6e938dd1-68f9-4ffc-a14b-e6ffbcf5af8d
status: experimental
description: This rule flags Windows process creation where Velociraptor.exe spawns child processes with command lines indicative of tool execution, remote access tunneling, or staged payload retrieval. Such activity matters because attackers can abuse DFIR tooling to blend in while launching additional components using web downloads and scripting. It relies on process creation telemetry, specifically the parent executable path and the child process command line or image name patterns.
references:
  - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-08-29
tags:
  - attack.command-and-control
  - attack.persistence
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \Velociraptor.exe
  selection_child_vscode_tunnel:
    CommandLine|contains|all:
      - code.exe
      - tunnel
      - --accept-server-license-terms
  selection_child_msiexec:
    CommandLine|contains|all:
      - msiexec
      - /i
      - http
  selection_child_powershell:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
    CommandLine|contains:
      - "Invoke-WebRequest "
      - "IWR "
      - .DownloadFile
      - .DownloadString
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.
level: high
license: DRL-1.1
related:
  - id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
    type: derived

What it detects

This rule flags Windows process creation where Velociraptor.exe spawns child processes with command lines indicative of tool execution, remote access tunneling, or staged payload retrieval. Such activity matters because attackers can abuse DFIR tooling to blend in while launching additional components using web downloads and scripting. It relies on process creation telemetry, specifically the parent executable path and the child process command line or image name patterns.

Known false positives

Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.