Suspicious Velociraptor Child Process

Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1219` Remote Access Tools

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection_parent`

ParentImage|endswith: '\Velociraptor.exe'

Stage 2: `1 of selection_child_vscode_tunnel`

CommandLine|contains: --accept-server-license-terms
CommandLine|contains: code.exe
CommandLine|contains: tunnel

Stage 3: `1 of selection_child_msiexec`

CommandLine|contains: '/i'
CommandLine|contains: http
CommandLine|contains: msiexec

Stage 4: `1 of selection_child_powershell`

or:
CommandLine|contains: .DownloadFile
CommandLine|contains: .DownloadString
CommandLine|contains: 'IWR '
CommandLine|contains: 'Invoke-WebRequest '
or:
Image|endswith: '\powershell.exe'
Image|endswith: '\powershell_ise.exe'
Image|endswith: '\pwsh.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`--accept-server-license-terms` corpus 3 (sigma 3) `.DownloadFile` corpus 2 (sigma 2) `.DownloadString` corpus 2 (sigma 2) `/i` `IWR` corpus 2 (sigma 2) `Invoke-WebRequest` corpus 4 (sigma 4) `code.exe` `http` corpus 31 (sigma 31) `msiexec` corpus 4 (sigma 4) `tunnel` corpus 3 (sigma 3)
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\powershell_ise.exe` corpus 27 (sigma 27) `\pwsh.exe` corpus 140 (sigma 140)
`ParentImage`	ends_with	`\Velociraptor.exe`

Suspicious Velociraptor Child Process

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: selection_parent

Stage 2: 1 of selection_child_vscode_tunnel

Stage 3: 1 of selection_child_msiexec

Stage 4: 1 of selection_child_powershell

Indicators

Stage 1: `selection_parent`

Stage 2: `1 of selection_child_vscode_tunnel`

Stage 3: `1 of selection_child_msiexec`

Stage 4: `1 of selection_child_powershell`