Build a Sigma + Velociraptor Detection Lab: From Rule to Hunt in One Afternoon

TL;DR: Yes, You Can Go From Sigma Rule to Working Velociraptor Hunt in One Afternoon

Yes—with nothing but free tools, a single VM, and this guide, you can deploy and validate a Sigma-based hunt against live endpoint telemetry today. Sigma gives you portable detection logic; Velociraptor gives you collection and hunting at scale. Wire them together and you have a functioning detection engineering loop in three to four hours—no SIEM license, no procurement cycle, no excuses.

Why Pair Sigma With Velociraptor?

Sigma is to log detection what YARA is to file detection: a portable, human-readable rule format that describes suspicious behavior without locking you into a vendor’s query language. Velociraptor—now a Rapid7 open-source project—is an endpoint visibility and hunting platform built around VQL, its Velociraptor Query Language. These two solve different halves of the detection problem.

Sigma answers the question “what does bad look like?” Velociraptor answers “how do I go look?” The division of labor is clean:

• Sigma — vendor-neutral YAML rules describing detection logic (field names, values, conditions), with a mature conversion ecosystem (pySigma, sigma CLI) targeting dozens of backends.
• Velociraptor — client-server architecture where lightweight agents on endpoints expose real-time telemetry; hunts execute VQL across thousands of hosts in parallel without shipping terabytes of logs to a central store first.

Traditional detection engineering assumes a SIEM: forward all logs, index everything, query centrally. That’s expensive and slow to stand up. Velociraptor inverts the model—you push the query to the endpoint and pull back only matches. Pairing Sigma with Velociraptor means your detection logic stays portable (usable in Splunk, Elastic, or Sentinel later) while your hunting platform stays cheap and surgical.

Lab Architecture and Prerequisites

You need three roles, which can live on as few as two machines:

• Analysis workstation — where you run the sigma CLI, write VQL, and browse the Velociraptor GUI. Your normal laptop works.
• Velociraptor server — a Linux VM (2 vCPU, 4 GB RAM is plenty for a lab) reachable from both the workstation and the victim VM.
• Victim VM — Windows 10 or 11, where you’ll generate telemetry. 2 vCPU, 4 GB RAM.

Software you’ll need, all free:

• VirtualBox or VMware Workstation Player (or Proxmox if you have a homelab hypervisor)
• Velociraptor binaries from github.com/Velocidex/velociraptor
• sigma CLI from github.com/SigmaHQ/sigma-cli
• Sysmon from Microsoft’s Sysinternals and the SwiftOnSecurity configuration file from github.com/SwiftOnSecurity/sysmon-config

Network layout: put the victim VM and Velociraptor server on a host-only or NAT network. Isolation is non-negotiable—you will be running attacker tooling on that victim box, and CISA’s guidance on secure home labbing (see CISA’s Secure Our World resources) starts with the same principle: segment the experiment from production.

Installing and Configuring the Velociraptor Server

Velociraptor ships as a single static binary—no dependencies, no database to install. On your Linux VM:

1. Download the latest release binary, rename it velociraptor, and chmod +x it.
2. Generate a server configuration:

   sudo ./velociraptor config generate -i

   The interactive flag walks you through frontend binding, certificate generation, and a GUI admin username/password. Self-signed certificates are fine for a lab.

3. Install as a service and start it:

   sudo ./velociraptor service install -c server.config.yaml
   sudo ./velociraptor frontend -c server.config.yaml

4. Browse to https://<server-ip>:8889 and log in.

For the Windows victim, download the MSI from the release page and install it with the server URL, or copy the generated client config and run velociraptor client -c client.config.yaml as administrator. Within a minute, the client should appear under Hardware Assets in the GUI. That green checkmark is your foundation—everything else depends on it.

Generating Telemetry on the Victim Host

A detection is only validated if you’ve seen it fire. You need safe, realistic activity that produces the events your Sigma rules target. Two lab-friendly options:

• Suspicious PowerShell — run an encoded command, which is one of the most commonly detected TTPs in the wild:

  powershell -nop -w hidden -enc SQBFAFgAIAAiAGgAdAB0AHAAOgAvAC8AMQAyADcALgAwAC4AMAAuADEAIgA=

  (Make it a harmless payload—an IEX block pointing nowhere works. The point is the event, not the effect.)

• Mimikatz-like activity — downloading a known test binary such as a public Mimikatz release from GitHub into a temp directory and attempting to execute it (Defender will likely block it—which is fine; the process-creation event 4688 and Sysmon Event ID 1 already fired).

Both generate the exact telemetry categories MITRE ATT&CK covers under T1059 (Command and Scripting Interpreter) and T1003 (OS Credential Dumping). For broader validation later, the Atomic Red Team project at github.com/redcanaryco/atomic-red-team provides scripted, per-technique test cases mapped to ATT&CK.

Collecting the Right Artifacts: Windows Event Logs and Sysmon

Sigma rules for Windows overwhelmingly expect three telemetry sources:

• Sysmon Event ID 1 (process creation with full command line and hashes) — the workhorse of most SigmaHQ process rules
• Security log Event ID 4688 — process creation if you enable command-line auditing via Group Policy
• PowerShell Operational log (Event ID 4104) — script block logging, where encoded-command activity surfaces

Install Sysmon on the victim with the SwiftOnSecurity config, then enable PowerShell script block logging:

Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindowsPowerShellScriptBlockLogging" -Name EnableScriptBlockLogging -Value 1

In Velociraptor, deploy a monitoring artifact. The built-in Windows.Sys.EventLog family plus Windows.Sysmon artifacts cover most needs; if you want a single purpose-built artifact, search the Velociraptor Artifact Exchange for a Sysmon EVTX collector or use Windows.EventLogs.EvtxHunter for targeted pulls. Configure it as a client monitoring artifact so events flow continuously—that’s what turns Velociraptor from a point-in-time collector into something that can catch the activity your Sigma rules describe.

Converting Sigma Rules to Velociraptor VQL

Velociraptor doesn’t speak Sigma natively. The bridge is the sigma CLI, which uses pySigma processing pipelines to emit backend-specific queries. Take a classic SigmaHQ rule targeting encoded PowerShell:

title: Suspicious Encoded PowerShell Command Line
detection:
    selection:
        EventID: 1
        Image|endswith: 'powershell.exe'
        CommandLine|contains:
            - ' -enc'
            - ' -EncodedCommand'
    condition: selection

Install and convert:

pip install sigma-cli pysigma
sigma convert -t velociraptor /path/to/rule.yml

With the Velociraptor pipeline from the SigmaHQ sigma-cli plugin set, you get a VQL WHERE clause roughly like:

SELECT * FROM watch_evtx(filename='''C:/Windows/System32/Winevt/Logs/Sysmon.evtx''')
WHERE EventData.Image =~ '(?i)powershell.exe$'
  AND EventData.CommandLine =~ '(?i)( -enc| -EncodedCommand)'

Read the VQL carefully—this is where you build the muscle of understanding what your detection actually does at the endpoint. Field mapping mismatches (Sigma’s Image vs. Sysmon’s actual schema) are the number-one source of silent detection failures, and eyeballing the converted VQL catches them instantly.

Wiring the Hunt: Deploying a Velociraptor Hunt From Your Converted Rule

Now you turn the query into an operation:

1. In the Velociraptor GUI, go to Hunts → New Hunt.
2. Under artifact selection, choose Add Artifact, then paste your converted VQL into a new custom artifact—give it a proper name like Custom.Detection.EncodedPowerShell and set it as a hunting artifact against watch_evtx or a one-shot query against parse_evtx.
3. Scope the hunt: select all clients or filter by OS to Windows only.
4. Set the expiry and launch.

For continuous monitoring rather than one-shot hunting, install the artifact under client monitoring instead—Velociraptor will then evaluate the rule continuously as events stream in, and you can configure a velociraptor monitor or notebook alerting on hits. Both modes matter: hunts for retrospective sweeps across the fleet, monitoring for real-time detection.

Validating Detections Against Real Telemetry

Trigger the encoded PowerShell command on the victim again, then return to the GUI. If you ran a hunt, results appear per-client under the hunt’s overview; if you’re using monitoring, check the artifact’s collected results for that client. You should see a row containing the full command line, parent process, and hash—your detection fired.

Now do the work that separates detection engineers from rule copiers:

• Tune false positives. Legitimate admin scripts sometimes use -enc. Narrow with additional conditions (parent process, user context) the way mature SigmaHQ rules do.
• Test the negative case. Run benign PowerShell and confirm no hit.
• Iterate. Modify the Sigma rule, reconvert, redeploy. Each loop should take minutes, not hours—that speed is the entire point of this lab.

Troubleshooting Common Lab Failures

• Client not checking in: almost always TLS trust or firewall. The victim must reach port 8000 (frontend) and you port 8889 (GUI). Verify with Test-NetConnection <server> -Port 8000.
• Empty event logs: Sysmon not installed, or script block logging never enabled. Confirm with Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational -MaxEvents 5.
• VQL syntax errors: pySigma field mappings occasionally don’t match the Velociraptor artifact schema. Edit the WHERE clause manually—VQL is readable enough that this is a fix, not a rewrite.
• Conversion pipeline mismatches: ensure your sigma-cli plugin version matches your pySigma version; mismatched processing pipelines produce subtly wrong output.

Where to Take the Lab Next

Once one rule fires end-to-end, scale the exercise:

• Batch-convert SigmaHQ. The SigmaHQ rule repository has thousands of rules—write a script to convert entire categories (Windows process creation is the sweet spot) into artifacts.
• Scheduled monitoring hunts for continuous detection rather than ad-hoc sweeps.
• Atomic Red Team integration — automate test execution and measurement, building your own detection-coverage matrix.
• Map detections to ATT&CK — Sigma rules carry tags; track your validated coverage per technique, which is how you demonstrate detection capability to leadership.

You started the afternoon with a YAML file and a blank VM. You’re ending it with a validated, repeatable detection pipeline—which is more detection engineering than most organizations accomplish in a quarter.

Frequently Asked Questions

Do I need paid tools to build this lab?

No. Sigma, Velociraptor, Sysmon, and the sigma CLI are all free and open source (Velociraptor under the AGPL). Any modest VM or spare hardware works—the entire lab runs comfortably in 12 GB of host RAM.

Can Velociraptor run Sigma rules directly?

Not natively. You convert Sigma rules to VQL using the sigma CLI conversion pipeline (backed by pySigma), then deploy the resulting VQL as a Velociraptor artifact or hunt. The Sigma rule remains your source of truth; the VQL is a generated, editable output.

Is this setup safe to run at home?

Yes, if isolated. Use a host-only or NAT lab network and never connect the victim VM to your production network or corporate VPN. The simulated attacks are deliberately restrained, but isolation is the safety boundary—treat it as mandatory.

Which Sigma rules should beginners start with?

Simple process-creation rules from SigmaHQ that map to Sysmon Event ID 1—suspicious PowerShell, encoded command detections, and LOLBin execution. They have clear field mappings, obvious test procedures, and produce unambiguous hits.

How is this different from running Sigma in a SIEM?

Velociraptor hunts query endpoint telemetry on demand via VQL, giving per-host results without deploying a full SIEM, a log shipper fleet, or index-based licensing. A SIEM centralizes long-term correlation and alerting; Velociraptor gives you surgical, high-fidelity hunting across endpoints—the two complement each other rather than compete.