Windows: Suspicious Velociraptor Child Process Execution Indicators
Alerts when Velociraptor.exe spawns specific child processes tied to tunneling, msiexec web installs, or PowerShell download commands.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-08-29
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation where Velociraptor.exe spawns child processes with command lines indicative of tool execution, remote access tunneling, or staged payload retrieval. Such activity matters because attackers can abuse DFIR tooling to blend in while launching additional components using web downloads and scripting. It relies on process creation telemetry, specifically the parent executable path and the child process command line or image name patterns.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Velociraptor Child Process Execution Indicators"
id: 6e938dd1-68f9-4ffc-a14b-e6ffbcf5af8d
status: experimental
description: This rule flags Windows process creation where Velociraptor.exe spawns child processes with command lines indicative of tool execution, remote access tunneling, or staged payload retrieval. Such activity matters because attackers can abuse DFIR tooling to blend in while launching additional components using web downloads and scripting. It relies on process creation telemetry, specifically the parent executable path and the child process command line or image name patterns.
references:
- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-08-29
tags:
- attack.command-and-control
- attack.persistence
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \Velociraptor.exe
selection_child_vscode_tunnel:
CommandLine|contains|all:
- code.exe
- tunnel
- --accept-server-license-terms
selection_child_msiexec:
CommandLine|contains|all:
- msiexec
- /i
- http
selection_child_powershell:
Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
CommandLine|contains:
- "Invoke-WebRequest "
- "IWR "
- .DownloadFile
- .DownloadString
condition: selection_parent and 1 of selection_child_*
falsepositives:
- Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.
level: high
license: DRL-1.1
related:
- id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
type: derived