Rule Info
Name
Velociraptor Abuse via Suspicious PowerShell Commands
Author
X__Junior
Description
Detects Velociraptor.exe being abused to execute suspicious PowerShell or command-line activity indicative of post-exploitation behavior.
Date
2026-01-27 00:00:00
Modified
None
Id
29ad8ccf-9b07-40cd-bda9-0d5d1f9c0efd
Tags
attack.command-and-control attack.persistence attack.defense-evasion attack.t1219
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR