[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVGG0C8X6F1XM8ZYS2H0RE":3,"skill-same:01M6EVGG0C8X6F1XM8ZYS2H0RE":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6EVGG0C8X6F1XM8ZYS2H0RE","implementing-velociraptor-for-ir-collection",null,"Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"velociraptor","collection","implementing velociraptor for ir collection","forensic-artifacts","hunting","Scalable","across","incident","artifact","conversion","threat","configure","cybersecurity","endpoint-collection","analysis","rapid7","t1490","t1078","threat-hunting","incident response","2026-11-10 10:12:30",false,"---\nname: implementing-velociraptor-for-ir-collection\ndescription: Deploy and configure Velociraptor for scalable endpoint forensic artifact\n  collection during incident response using VQL queries, hunts, and pre-built artifact\n  packs across Windows, Linux, and macOS environments.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- velociraptor\n- dfir\n- endpoint-collection\n- vql\n- forensic-artifacts\n- rapid7\n- threat-hunting\n- incident-response\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\n- T1005\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Implementing Velociraptor for IR Collection\n\n## Overview\n\nVelociraptor is an advanced open-source endpoint monitoring, digital forensics, and incident response platform developed by Rapid7. It uses the Velociraptor Query Language (VQL) to create custom artifacts that collect, query, and monitor almost any aspect of an endpoint. Velociraptor enables incident response teams to rapidly collect and examine forensic artifacts from across a network, supporting large-scale deployments with minimal performance impact. The client-server architecture with Fleetspeak communication enables real-time data collection from thousands of endpoints simultaneously, with offline endpoints picking up hunts when they reconnect.\n\n\n## When to Use\n\n- When deploying or configuring implementing velociraptor for ir collection capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Components\n- **Velociraptor Server**: Central management console with web UI and API\n- **Velociraptor Client (Agent)**: Lightweight agent deployed to endpoints\n- **Fleetspeak**: Communication framework between client and server\n- **VQL Engine**: Query language engine for artifact collection\n- **Filestore**: Server-side storage for collected artifacts\n- **Datastore**: Metadata storage for hunts, flows, and client information\n\n### Supported Platforms\n- Windows (7+, Server 2008R2+)\n- Linux (Debian, Ubuntu, CentOS, RHEL)\n- macOS (10.13+)\n\n## Deployment\n\n### Server Installation\n```bash\n# Download latest release\nwget https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases\u002Flatest\u002Fdownload\u002Fvelociraptor-linux-amd64\n\n# Generate server configuration\n.\u002Fvelociraptor-linux-amd64 config generate -i\n\n# Start the server\n.\u002Fvelociraptor-linux-amd64 --config server.config.yaml frontend\n\n# Or run as systemd service\nsudo cp velociraptor-linux-amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fvelociraptor\nsudo velociraptor --config \u002Fetc\u002Fvelociraptor\u002Fserver.config.yaml service install\n```\n\n### Client Deployment\n```bash\n# Repack client MSI for Windows deployment\nvelociraptor --config server.config.yaml config client > client.config.yaml\nvelociraptor config repack --msi velociraptor-windows-amd64.msi client.config.yaml output.msi\n\n# Deploy via Group Policy, SCCM, or Intune\n# Client runs as a Windows service: \"Velociraptor\"\n\n# Linux client deployment\nvelociraptor --config client.config.yaml client -v\n\n# macOS client deployment\nvelociraptor --config client.config.yaml client -v\n```\n\n### Docker Deployment\n```bash\ndocker run --name velociraptor \\\n  -v \u002Fopt\u002Fvelociraptor:\u002Fvelociraptor\u002Fdata \\\n  -p 8000:8000 -p 8001:8001 -p 8889:8889 \\\n  velocidex\u002Fvelociraptor\n```\n\n## Core IR Artifact Collection\n\n### Windows Forensic Artifacts\n\n```sql\n-- Collect Windows Event Logs\nSELECT * FROM Artifact.Windows.EventLogs.EvtxHunter(\n  EvtxGlob=\"C:\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx\",\n  IDRegex=\"4624|4625|4648|4672|4688|4698|4769|7045\"\n)\n\n-- Collect Prefetch files for execution evidence\nSELECT * FROM Artifact.Windows.Forensics.Prefetch()\n\n-- Collect Shimcache entries\nSELECT * FROM Artifact.Windows.Registry.AppCompatCache()\n\n-- Collect Amcache entries\nSELECT * FROM Artifact.Windows.Forensics.Amcache()\n\n-- Collect UserAssist data\nSELECT * FROM Artifact.Windows.Forensics.UserAssist()\n\n-- Collect NTFS MFT timestamps\nSELECT * FROM Artifact.Windows.NTFS.MFT(\n  MFTFilename=\"C:\u002F$MFT\",\n  FileRegex=\".(exe|dll|ps1|bat|cmd)$\"\n)\n\n-- Collect scheduled tasks\nSELECT * FROM Artifact.Windows.System.TaskScheduler()\n\n-- Collect running processes with hashes\nSELECT * FROM Artifact.Windows.System.Pslist()\n\n-- Collect network connections\nSELECT * FROM Artifact.Windows.Network.Netstat()\n\n-- Collect DNS cache\nSELECT * FROM Artifact.Windows.Network.DNSCache()\n\n-- Collect browser history\nSELECT * FROM Artifact.Windows.Applications.Chrome.History()\n\n-- Collect PowerShell history\nSELECT * FROM Artifact.Windows.Forensics.PowerShellHistory()\n\n-- Collect autoruns\u002Fpersistence\nSELECT * FROM Artifact.Windows.Persistence.PermanentWMIEvents()\nSELECT * FROM Artifact.Windows.System.Services()\nSELECT * FROM Artifact.Windows.System.StartupItems()\n```\n\n### Linux Forensic Artifacts\n\n```sql\n-- Collect auth logs\nSELECT * FROM Artifact.Linux.Sys.AuthLogs()\n\n-- Collect bash history\nSELECT * FROM Artifact.Linux.Forensics.BashHistory()\n\n-- Collect crontab entries\nSELECT * FROM Artifact.Linux.Sys.Crontab()\n\n-- Collect running processes\nSELECT * FROM Artifact.Linux.Sys.Pslist()\n\n-- Collect network connections\nSELECT * FROM Artifact.Linux.Network.Netstat()\n\n-- Collect SSH authorized keys\nSELECT * FROM Artifact.Linux.Ssh.AuthorizedKeys()\n\n-- Collect systemd services\nSELECT * FROM Artifact.Linux.Services()\n```\n\n### Triage Collection (All-in-One)\n\n```sql\n-- Windows Triage Collection artifact\n-- Collects event logs, prefetch, registry, browser data, and more\nSELECT * FROM Artifact.Windows.KapeFiles.Targets(\n  Device=\"C:\",\n  _AllFiles=FALSE,\n  _EventLogs=TRUE,\n  _Prefetch=TRUE,\n  _RegistryHives=TRUE,\n  _WebBrowsers=TRUE,\n  _WindowsTimeline=TRUE\n)\n```\n\n## Hunt Operations\n\n### Creating a Hunt\n```\n1. Navigate to Hunt Manager in Velociraptor Web UI\n2. Click \"New Hunt\"\n3. Configure:\n   - Description: \"IR Triage - Case 2025-001\"\n   - Include\u002FExclude labels for targeting\n   - Artifact selection (e.g., Windows.Forensics.Prefetch)\n   - Resource limits (CPU, IOPS, timeout)\n4. Launch hunt\n5. Monitor progress in real-time\n```\n\n### VQL Hunt Examples\n\n```sql\n-- Hunt for specific file hash across all endpoints\nSELECT * FROM Artifact.Generic.Detection.HashHunter(\n  Hashes=\"e99a18c428cb38d5f260853678922e03\"\n)\n\n-- Hunt for YARA signatures in memory\nSELECT * FROM Artifact.Windows.Detection.Yara.Process(\n  YaraRule='rule malware { strings: $s1 = \"malicious_string\" condition: $s1 }'\n)\n\n-- Hunt for Sigma rule matches in event logs\nSELECT * FROM Artifact.Server.Import.SigmaRules()\n\n-- Hunt for suspicious scheduled tasks\nSELECT * FROM Artifact.Windows.System.TaskScheduler()\nWHERE Command =~ \"powershell|cmd|wscript|mshta|rundll32\"\n\n-- Hunt for processes with network connections to suspicious IPs\nSELECT * FROM Artifact.Windows.Network.Netstat()\nWHERE RemoteAddr =~ \"10\\\\.13\\\\.37\\\\.\"\n```\n\n## Real-Time Monitoring\n\n```sql\n-- Monitor for new process creation\nSELECT * FROM watch_etw(guid=\"{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}\")\nWHERE EventData.ImageName =~ \"powershell|cmd|wscript\"\n\n-- Monitor file system changes\nSELECT * FROM watch_directory(path=\"C:\u002FWindows\u002FTemp\u002F\")\n\n-- Monitor registry changes\nSELECT * FROM watch_registry(key=\"HKLM\u002FSOFTWARE\u002FMicrosoft\u002FWindows\u002FCurrentVersion\u002FRun\u002F**\")\n```\n\n## Integration with SIEM\u002FSOAR\n\n### Splunk Integration\n```\nVelociraptor Server --> Elastic\u002FOpenSearch --> Splunk HEC\n                   --> Direct syslog forwarding\n                   --> Velociraptor API --> Custom scripts --> Splunk\n```\n\n### Elastic Stack Integration\n```yaml\n# Velociraptor server config for Elastic output\nMonitoring:\n  elastic:\n    addresses:\n      - https:\u002F\u002Felastic.local:9200\n    username: velociraptor\n    password: secure_password\n    index: velociraptor\n```\n\n## MITRE ATT&CK Mapping\n\n| Technique | VQL Artifact |\n|-----------|-------------|\n| T1059 - Command Scripting | Windows.EventLogs.EvtxHunter (4104, 4688) |\n| T1053 - Scheduled Task | Windows.System.TaskScheduler |\n| T1547 - Boot\u002FLogon Autostart | Windows.Persistence.PermanentWMIEvents |\n| T1003 - OS Credential Dumping | Windows.Detection.Yara.Process |\n| T1021 - Remote Services | Windows.EventLogs.EvtxHunter (4624 Type 3\u002F10) |\n| T1070 - Indicator Removal | Windows.EventLogs.Cleared |\n\n## References\n\n- [Velociraptor Official Documentation](https:\u002F\u002Fdocs.velociraptor.app\u002F)\n- [Rapid7 Velociraptor Product Page](https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Fvelociraptor\u002F)\n- [CISA Velociraptor Resource](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fvelociraptor)\n- [Velociraptor GitHub Repository](https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor)\n- [Pen Test Partners: Large-Scale Velociraptor](https:\u002F\u002Fwww.pentestpartners.com\u002Fsecurity-blog\u002Fusing-velociraptor-for-large-scale-endpoint-visibility-and-rapid-threat-hunting\u002F)\n","# Implementing Velociraptor for IR Collection\n\n## Overview\n\nVelociraptor is an advanced open-source endpoint monitoring, digital forensics, and incident response platform developed by Rapid7. It uses the Velociraptor Query Language (VQL) to create custom artifacts that collect, query, and monitor almost any aspect of an endpoint. Velociraptor enables incident response teams to rapidly collect and examine forensic artifacts from across a network, supporting large-scale deployments with minimal performance impact. The client-server architecture with Fleetspeak communication enables real-time data collection from thousands of endpoints simultaneously, with offline endpoints picking up hunts when they reconnect.\n\n\n## When to Use\n\n- When deploying or configuring implementing velociraptor for ir collection capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with incident response concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Architecture\n\n### Components\n- **Velociraptor Server**: Central management console with web UI and API\n- **Velociraptor Client (Agent)**: Lightweight agent deployed to endpoints\n- **Fleetspeak**: Communication framework between client and server\n- **VQL Engine**: Query language engine for artifact collection\n- **Filestore**: Server-side storage for collected artifacts\n- **Datastore**: Metadata storage for hunts, flows, and client information\n\n### Supported Platforms\n- Windows (7+, Server 2008R2+)\n- Linux (Debian, Ubuntu, CentOS, RHEL)\n- macOS (10.13+)\n\n## Deployment\n\n### Server Installation\n```bash\n# Download latest release\nwget https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor\u002Freleases\u002Flatest\u002Fdownload\u002Fvelociraptor-linux-amd64\n\n# Generate server configuration\n.\u002Fvelociraptor-linux-amd64 config generate -i\n\n# Start the server\n.\u002Fvelociraptor-linux-amd64 --config server.config.yaml frontend\n\n# Or run as systemd service\nsudo cp velociraptor-linux-amd64 \u002Fusr\u002Flocal\u002Fbin\u002Fvelociraptor\nsudo velociraptor --config \u002Fetc\u002Fvelociraptor\u002Fserver.config.yaml service install\n```\n\n### Client Deployment\n```bash\n# Repack client MSI for Windows deployment\nvelociraptor --config server.config.yaml config client > client.config.yaml\nvelociraptor config repack --msi velociraptor-windows-amd64.msi client.config.yaml output.msi\n\n# Deploy via Group Policy, SCCM, or Intune\n# Client runs as a Windows service: \"Velociraptor\"\n\n# Linux client deployment\nvelociraptor --config client.config.yaml client -v\n\n# macOS client deployment\nvelociraptor --config client.config.yaml client -v\n```\n\n### Docker Deployment\n```bash\ndocker run --name velociraptor \\\n  -v \u002Fopt\u002Fvelociraptor:\u002Fvelociraptor\u002Fdata \\\n  -p 8000:8000 -p 8001:8001 -p 8889:8889 \\\n  velocidex\u002Fvelociraptor\n```\n\n## Core IR Artifact Collection\n\n### Windows Forensic Artifacts\n\n```sql\n-- Collect Windows Event Logs\nSELECT * FROM Artifact.Windows.EventLogs.EvtxHunter(\n  EvtxGlob=\"C:\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002F*.evtx\",\n  IDRegex=\"4624|4625|4648|4672|4688|4698|4769|7045\"\n)\n\n-- Collect Prefetch files for execution evidence\nSELECT * FROM Artifact.Windows.Forensics.Prefetch()\n\n-- Collect Shimcache entries\nSELECT * FROM Artifact.Windows.Registry.AppCompatCache()\n\n-- Collect Amcache entries\nSELECT * FROM Artifact.Windows.Forensics.Amcache()\n\n-- Collect UserAssist data\nSELECT * FROM Artifact.Windows.Forensics.UserAssist()\n\n-- Collect NTFS MFT timestamps\nSELECT * FROM Artifact.Windows.NTFS.MFT(\n  MFTFilename=\"C:\u002F$MFT\",\n  FileRegex=\".(exe|dll|ps1|bat|cmd)$\"\n)\n\n-- Collect scheduled tasks\nSELECT * FROM Artifact.Windows.System.TaskScheduler()\n\n-- Collect running processes with hashes\nSELECT * FROM Artifact.Windows.System.Pslist()\n\n-- Collect network connections\nSELECT * FROM Artifact.Windows.Network.Netstat()\n\n-- Collect DNS cache\nSELECT * FROM Artifact.Windows.Network.DNSCache()\n\n-- Collect browser history\nSELECT * FROM Artifact.Windows.Applications.Chrome.History()\n\n-- Collect PowerShell history\nSELECT * FROM Artifact.Windows.Forensics.PowerShellHistory()\n\n-- Collect autoruns\u002Fpersistence\nSELECT * FROM Artifact.Windows.Persistence.PermanentWMIEvents()\nSELECT * FROM Artifact.Windows.System.Services()\nSELECT * FROM Artifact.Windows.System.StartupItems()\n```\n\n### Linux Forensic Artifacts\n\n```sql\n-- Collect auth logs\nSELECT * FROM Artifact.Linux.Sys.AuthLogs()\n\n-- Collect bash history\nSELECT * FROM Artifact.Linux.Forensics.BashHistory()\n\n-- Collect crontab entries\nSELECT * FROM Artifact.Linux.Sys.Crontab()\n\n-- Collect running processes\nSELECT * FROM Artifact.Linux.Sys.Pslist()\n\n-- Collect network connections\nSELECT * FROM Artifact.Linux.Network.Netstat()\n\n-- Collect SSH authorized keys\nSELECT * FROM Artifact.Linux.Ssh.AuthorizedKeys()\n\n-- Collect systemd services\nSELECT * FROM Artifact.Linux.Services()\n```\n\n### Triage Collection (All-in-One)\n\n```sql\n-- Windows Triage Collection artifact\n-- Collects event logs, prefetch, registry, browser data, and more\nSELECT * FROM Artifact.Windows.KapeFiles.Targets(\n  Device=\"C:\",\n  _AllFiles=FALSE,\n  _EventLogs=TRUE,\n  _Prefetch=TRUE,\n  _RegistryHives=TRUE,\n  _WebBrowsers=TRUE,\n  _WindowsTimeline=TRUE\n)\n```\n\n## Hunt Operations\n\n### Creating a Hunt\n```\n1. Navigate to Hunt Manager in Velociraptor Web UI\n2. Click \"New Hunt\"\n3. Configure:\n   - Description: \"IR Triage - Case 2025-001\"\n   - Include\u002FExclude labels for targeting\n   - Artifact selection (e.g., Windows.Forensics.Prefetch)\n   - Resource limits (CPU, IOPS, timeout)\n4. Launch hunt\n5. Monitor progress in real-time\n```\n\n### VQL Hunt Examples\n\n```sql\n-- Hunt for specific file hash across all endpoints\nSELECT * FROM Artifact.Generic.Detection.HashHunter(\n  Hashes=\"e99a18c428cb38d5f260853678922e03\"\n)\n\n-- Hunt for YARA signatures in memory\nSELECT * FROM Artifact.Windows.Detection.Yara.Process(\n  YaraRule='rule malware { strings: $s1 = \"malicious_string\" condition: $s1 }'\n)\n\n-- Hunt for Sigma rule matches in event logs\nSELECT * FROM Artifact.Server.Import.SigmaRules()\n\n-- Hunt for suspicious scheduled tasks\nSELECT * FROM Artifact.Windows.System.TaskScheduler()\nWHERE Command =~ \"powershell|cmd|wscript|mshta|rundll32\"\n\n-- Hunt for processes with network connections to suspicious IPs\nSELECT * FROM Artifact.Windows.Network.Netstat()\nWHERE RemoteAddr =~ \"10\\\\.13\\\\.37\\\\.\"\n```\n\n## Real-Time Monitoring\n\n```sql\n-- Monitor for new process creation\nSELECT * FROM watch_etw(guid=\"{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}\")\nWHERE EventData.ImageName =~ \"powershell|cmd|wscript\"\n\n-- Monitor file system changes\nSELECT * FROM watch_directory(path=\"C:\u002FWindows\u002FTemp\u002F\")\n\n-- Monitor registry changes\nSELECT * FROM watch_registry(key=\"HKLM\u002FSOFTWARE\u002FMicrosoft\u002FWindows\u002FCurrentVersion\u002FRun\u002F**\")\n```\n\n## Integration with SIEM\u002FSOAR\n\n### Splunk Integration\n```\nVelociraptor Server --> Elastic\u002FOpenSearch --> Splunk HEC\n                   --> Direct syslog forwarding\n                   --> Velociraptor API --> Custom scripts --> Splunk\n```\n\n### Elastic Stack Integration\n```yaml\n# Velociraptor server config for Elastic output\nMonitoring:\n  elastic:\n    addresses:\n      - https:\u002F\u002Felastic.local:9200\n    username: velociraptor\n    password: secure_password\n    index: velociraptor\n```\n\n## MITRE ATT&CK Mapping\n\n| Technique | VQL Artifact |\n|-----------|-------------|\n| T1059 - Command Scripting | Windows.EventLogs.EvtxHunter (4104, 4688) |\n| T1053 - Scheduled Task | Windows.System.TaskScheduler |\n| T1547 - Boot\u002FLogon Autostart | Windows.Persistence.PermanentWMIEvents |\n| T1003 - OS Credential Dumping | Windows.Detection.Yara.Process |\n| T1021 - Remote Services | Windows.EventLogs.EvtxHunter (4624 Type 3\u002F10) |\n| T1070 - Indicator Removal | Windows.EventLogs.Cleared |\n\n## References\n\n- [Velociraptor Official Documentation](https:\u002F\u002Fdocs.velociraptor.app\u002F)\n- [Rapid7 Velociraptor Product Page](https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Fvelociraptor\u002F)\n- [CISA Velociraptor Resource](https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fservices\u002Fvelociraptor)\n- [Velociraptor GitHub Repository](https:\u002F\u002Fgithub.com\u002FVelocidex\u002Fvelociraptor)\n- [Pen Test Partners: Large-Scale Velociraptor](https:\u002F\u002Fwww.pentestpartners.com\u002Fsecurity-blog\u002Fusing-velociraptor-for-large-scale-endpoint-visibility-and-rapid-threat-hunting\u002F)\n",{"name":5,"tags":49,"author":53,"domain":36,"license":15,"version":54,"nist_csf":55,"subdomain":52,"description":7,"mitre_attack":60,"d3fend_techniques":66},[24,50,37,51,27,39,42,52],"dfir","vql","incident-response","mahipal","1.0",[56,57,58,59],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01",[61,62,63,64,65],"T1486","T1490","T1070","T1078","T1005",[67,68,69,70,71],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-velociraptor-for-ir-collection",{"tool":86,"command":87},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-velociraptor-for-ir-collection",{"tool":89,"command":90},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-velociraptor-for-ir-collection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002FSKILL.md",true,[94,100,105,111,115,119,125],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"assets\u002Ftemplate.md","ASSET","资产文件",1237,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Fassets\u002Ftemplate.md",{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002FLICENSE",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"references\u002Fapi-reference.md","REFERENCE","参考文档",4564,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Freferences\u002Fapi-reference.md",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"references\u002Fstandards.md",1795,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Freferences\u002Fstandards.md",{"path":116,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fworkflows.md",3139,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Freferences\u002Fworkflows.md",{"path":120,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fagent.py","SCRIPT","脚本",10647,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Fscripts\u002Fagent.py",{"path":126,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fprocess.py",12605,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-velociraptor-for-ir-collection\u002Fscripts\u002Fprocess.py",[130,171,180,189,211,238],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":151,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[137,140,143,146],{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":141,"categoryName":142,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[132,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":172,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[175,176,177,178],{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":141,"categoryName":142,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},[132,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170],{"skillNo":181,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[184,185,186,187],{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":141,"categoryName":142,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},[132,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170],{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[196,197,198,199,200,201,202,203,204,205,206,207,208,209,210],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":220,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[217],{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[221,222,223,224,225,226,38,227,228,229,230,163,164,231,232,233,234,235,236,237],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":134,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":254,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[244,247,250,251],{"categoryNo":245,"categoryName":246,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":248,"categoryName":249,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":252,"categoryName":253,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000036","内容创作者",[255,256,257,258,259,260,261,262,160,263,163,164,165,264,265,266,267,268,210,269],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]