mgreen27/detectraptorA repository to share publicly available Velociraptor detection content
A repository to share publicly available bulk Velociraptor detection content in an easy to consume way.
Simply take the release VQL zip and import it into Velociraptor.
This is made easy via the Velociraptor artifact exchange: Server.Import.DetectRaptor
This should import the "Import DetectRaptor" artifact.
Current artifacts include:
Server artifacts:
Some contributing repositories:
Run the Eventlogs, PSReadLine, and MFT regression tests from the repository root:
python -m unittest discover -s tests -v
Validate the MFT detection CSV directly:
python scripts/sync_mft_lolrmm.py
python scripts/normalize_mft_metadata.py
python scripts/assign_mft_metadata.py --check
python scripts/validate_mft.py
python scripts/validate_mft_whitelist.py
python scripts/build_mft_replay_coverage.py
python scripts/replay_mft.py --check
python scripts/benchmark_mft_replay.py --iterations 3
When adding an MFT rule, leave the generated metadata fields empty and run:
python scripts/assign_mft_metadata.py
This assigns an immutable DR-MFT-<CATEGORY>-NNN RuleID and baseline
category, confidence, source, and ATT&CK metadata. Existing RuleIDs are
preserved.
sync_mft_lolrmm.py regenerates LOLRMM-backed MFT rules from
csv/lolrmm.csv, preserving IDs through csv/MFT_RMM_IDs.csv and applying
csv/MFT_RMM_Overrides.csv. Sources that are inherently unsuitable for
filename-only MFT detection are documented in csv/MFT_RMM_Exclusions.csv.
normalize_mft_metadata.py then applies the reviewed confidence, severity,
scope, and ATT&CK policy. Generated DLL indicators are retained only when
their basename contains a product-specific LOLRMM name token; filtered DLLs
and explicit exclusions are recorded in csv/MFT_RMM_Coverage.csv. Known
ambiguous executable basenames are also filtered from filename-only
generation. Curated split overrides retain generic filenames only beneath
stable upstream product paths.
build_mft_replay_coverage.py creates a deterministic synthetic positive for
every MFT rule and records overlapping rule matches in
csv/MFT_Replay_Coverage.csv. replay_mft.py --check evaluates the sanitized
positive and negative fixtures under tests/fixtures/. It can also compare a
candidate rules file with a baseline using --baseline-rules, and write
detailed match, comparison, and summary output to explicitly selected paths.
csv/MFT_Whitelist.csv contains built-in path-aware suppression policies.
Policies require an exact RuleID and artifact plus matching filename and path
regexes. SuppressWhitelisted is enabled by default in MFT and Amcache;
disable it to audit suppressed rows and their WhitelistID metadata. Local or
customer-specific RMM approvals remain runtime parameters and are not
committed to the repository.
benchmark_mft_replay.py combines the sanitized fixtures with one generated
positive per rule. It reports raw, retained, and suppressed matches; unique
files and path strings; multi-match expansion; estimated rule evaluations; and
runtime. Additional replay-format CSV inputs may be supplied with --input.
Benchmark JSON is written only when --output is explicitly provided.
Regenerate the affected artifacts from scripts/:
cd scripts
python evtx.py
python psreadline.py
python iseautosave.py
python mft.py
python amcache.py
Verify the generated artifacts with Velociraptor:
./velociraptor artifacts verify \
vql/Evtx.yaml \
vql/PSReadline.yaml \
vql/ISEAutoSave.yaml \
vql/MFT.yaml
docs/eventlogs-detection-review.mddocs/mft-detection-uplift.md