Hunt Ransomware with Velociraptor: Build Custom VQL Artifacts for LockBit-Style TTPs

TL;DR: Yes, You Can Hunt LockBit-Style Ransomware with Custom Velociraptor Artifacts

You can hunt ransomware with Velociraptor—and you should. Pairing Velociraptor’s client-server DFIR architecture with custom VQL artifacts lets you detect shadow-copy deletion, GPO abuse, and mass encryption behaviors across hundreds of endpoints in near real time, before the encryption job finishes and your incident becomes a ransom negotiation.

Why Velociraptor for Ransomware Hunting

Traditional AV looks for signatures. EDR vendors sell you behavioral detections behind a black box and a per-endpoint license. Velociraptor—developed by Mike Cohen’s team and now part of Rapid7’s open source portfolio after the original Velocidex project—takes a different approach: it’s an open source DFIR platform that gives you a client-server architecture with a lightweight agent on every endpoint and a query language, VQL (Velociraptor Query Language), that turns every endpoint into a queryable telemetry source.

That matters for ransomware because ransomware is loud. LockBit 3.0 and its successors follow a well-documented playbook: escalate privileges, delete shadow copies, disable security tooling, spread via GPO or PSExec, then encrypt at maximum I/O velocity. CISA’s joint advisories on LockBit (most notably the February 2024 advisory AA24-041A, published after Operation Cronos disrupted the cartel) catalog these behaviors in detail. Most of them leave Windows event log entries and filesystem traces that VQL can surface—you just have to ask the right questions.

The trade-off is honest: Velociraptor doesn’t block anything. It’s a hunting and collection platform, not prevention. But for detection engineering teams that want transparency and control—writing their own detections instead of waiting on a vendor’s roadmap—it’s hard to beat.

LockBit-Style TTPs Mapped to Observable Events

Before writing a single line of VQL, map the behaviors to observables. The MITRE ATT&CK techniques behind LockBit-style operations translate to concrete Windows artifacts:

• T1490 – Inhibit System Recovery: vssadmin delete shadows /all /quiet, wmic shadowcopy delete, bcdedit /set recoveryenabled no. These command lines appear in Sysmon Event ID 1 (process creation) and Windows Security Event ID 4688; service installations like the well-known “MsSecFlush” pattern hit System Event ID 7045.
• T1484 – Domain Policy Modification: GPO edits that push scheduled tasks or startup scripts. Look for new files under \DOMAINSYSVOL...Policies, Group Policy event IDs 1500–1508 in the Microsoft-Windows-GroupPolicy log, and scripts dropped into SYSVOL.
• T1486 – Data Encrypted for Impact: Thousands of file write events in minutes, extension changes (e.g., .lockbit), ransom note drops (e.g., RESTORE-FILES.txt), and suspiciously high entropy in modified files.

Your job as a detection author is to convert each of these into a query that runs efficiently at endpoint scale.

Deploying a Velociraptor Server and Enrolling Endpoints

Start with a lab. On a Linux host, download the latest release binary from the Velociraptor GitHub repository and run the interactive configuration:

./velociraptor-v0.7x-linux-amd64 config generate -i

This wizard generates server.config.yaml, handles the frontend certificate, and creates admin credentials. For a lab, self-signed certs are fine; in production, put the frontend behind a proper HTTPS reverse proxy or supply your own certificates. Launch the server, then generate a client MSI or standalone binary with the embedded config:

velociraptor config repack --msi server.config.yaml client.config.yaml VelociraptorSetup.msi

Deploy that MSI to your test VMs via GPO, Ansible, or hand-execution. Within seconds, enrolled endpoints appear in the Velociraptor web UI under the Clients view, and you’re ready to start writing artifacts.

VQL Crash Course for Detection Authors

VQL reads like SQL but executes as a streaming pipeline on the endpoint. The core concepts:

• Sources: event logs (parse_evtx, watch_evtx), filesystem (glob), the registry (read_reg_key), and process data (pslist, parse_pe).
• LET statements: define reusable sub-queries: LET shad_deletes = SELECT * FROM watch_evtx(...).
• Artifact structure: each artifact has a name (namespaced like Custom.Ransomware.ShadowCopyDeletion), optional parameters, preconditions, and one or more query sources.

The full VQL reference lives in the official Velociraptor documentation. You don’t need to be a programmer—you need to think in terms of “what event stream contains the signal, and what filter isolates it?”

Artifact 1: Detecting Volume Shadow Copy Deletion

Shadow-copy deletion is one of the strongest pre-encryption signals you’ll get. Here’s a monitoring artifact that watches the System event log for service-based deletion techniques and flags known deletion command lines:

name: Custom.Ransomware.ShadowCopyDeletion
type: CLIENT_EVENT
parameters:
  - name: SuspiciousArgs
    default: "(?i)(shadowcopy|shadow).{0,20}delete"
sources:
  - query: |
      LET evtx = SELECT * FROM watch_evtx(
        filename='''C:\Windows\System32\winevt\Logs\System.evtx''')
      SELECT Timestamp, Computer, EventID,
        System eventData  = EventData
      FROM evtx
      WHERE EventID = 7045
        AND EventData.CommandLine =~ SuspiciousArgs

Layer on Sysmon Event ID 1 (or Security 4688 with command-line auditing enabled) to catch vssadmin delete shadows /all and wmic shadowcopy delete directly as process creations. If you only enable one piece of telemetry before doing anything else in this article, enable command-line process auditing—it’s the single highest-value source for ransomware pre-staging detection.

Artifact 2: Hunting GPO Abuse for Ransomware Distribution

LockBit affiliates routinely abuse Group Policy to push ransomware binaries and scheduled tasks domain-wide—one compromise, fleet-wide detonation. Detect it with a client event artifact on domain controllers watching the GroupPolicy operational log, plus a periodic SYSVOL sweep:

name: Custom.Ransomware.GPOAbuse
sources:
  - query: |
      LET recent = SELECT FullPath, Mtime, Size
        FROM glob(globs='''\\DC01\SYSVOL\*\Policies\**\*.{bat,ps1,exe,vbs}''')
        WHERE Mtime > now() - 86400 * 3
      SELECT * FROM recent

New scripts or executables appearing under a policy’s UserScripts or MachinePreferencesScheduledTasks directories deserve scrutiny—especially when the creating account isn’t your tier-0 admin. Combine the filesystem sweep with Microsoft-Windows-GroupPolicy/Operational event IDs 4016–4022 (policy processing) to correlate which machines processed the modified GPO.

Artifact 3: Identifying Mass Encryption Behavior

Encryption is the loudest phase, and the goal is to catch it before it completes. The answer to “can Velociraptor detect ransomware before encryption finishes?” is yes—if you measure I/O velocity rather than waiting for ransom notes. A filesystem-heavy heuristic artifact:

name: Custom.Ransomware.MassEncryption
type: CLIENT_EVENT
parameters:
  - name: WriteThreshold
    default: 1000
sources:
  - query: |
      LET writes = SELECT FullPath, Size, Mtime
        FROM glob(globs='''C:\Users\**\*''')
        WHERE Mtime > now() - 300
          AND FullPath =~ '''(?i)\(Documents|Desktop|Photos)\'''
      SELECT count(items=writes) AS ModifiedCount,
        enumerate(items=writes.FullPath) AS SamplePaths
      FROM scope()
      WHERE ModifiedCount > WriteThreshold

In production, tighten this with extension-change detection (files gaining a new suffix like .lockbit), entropy scoring on sampled file contents, and ransom-note filename patterns. This is a heuristic, not a certainty—tune the threshold to your environment (see pitfalls below).

Running Hunts at Scale: Scheduled Hunts, Monitoring, and Alerts

Client event artifacts stream continuously from enrolled endpoints. For one-time sweeps—say, checking every machine for a specific IOC after an advisory drops—use Hunt mode: select your artifact, launch against “all clients,” and watch results aggregate in the server UI. Automation options:

• Server monitoring artifacts watch for new clients or results and can trigger server-side VQL.
• The Velociraptor API lets you create and schedule hunts programmatically via the Python bindings.
• Webhook/SIEM piping: forward artifact results to Splunk, Elastic, or a Slack webhook so your SOC sees detections without opening the Velociraptor console.

CISA’s StopRansomware program publishes detection guidance that maps neatly onto this workflow—treat each new advisory as a prompt to write a new artifact.

Validating Your Artifacts in a Ransomware Lab

Never test against live ransomware on anything you care about. Instead, simulate the behaviors:

• Run vssadmin delete shadows /all /quiet in a snapshotted, isolated VM and confirm your artifact fires.
• Create a test GPO that drops a benign scheduled task, and verify the SYSVOL sweep catches it.
• Script a loop that renames and rewrites a few thousand dummy files to trigger the mass-encryption heuristic.

You get the same telemetry signals without the payload—which is the entire point of behavior-based detection authoring.

Common Pitfalls and Tuning for False Positives

Your first week of hunting will generate noise. Expect it and plan for it:

• Backup software deletes shadow copies too. Veeam, Windows Server Backup, and Acronis legitimately manage VSS. Scope alerts by process path—C:Program FilesVeeam is a different story than C:UsersPublic.
• Legitimate admin tools trigger command-line alerts. Your patch management system running wmic at 2 AM is noise; the same binary run from a user’s Temp directory at 2 AM is a signal. Baseline before you alert.
• Mass-file-write heuristics flag compilers, sync clients, and CI runners. Exempt developer workstations or tune thresholds per-OU.
• Don’t hunt everything at once. Scoped hunts against high-risk groups (file servers, domain admins’ workstations) beat fleet-wide noise.

False positives aren’t a failure—they’re your environment teaching you its baseline.

Next Steps: Extending Velociraptor Beyond Ransomware

Once these artifacts are running, you have a detection engineering platform, not just a ransomware tripwire. Explore the Artifact Exchange for community-contributed hunts covering persistence, lateral movement, and credential theft. Build triage collections—prefetch, AmCache, SRUM—for incident response speed. Combine KapeFiles artifacts with timeline collection to reconstruct an intrusion end-to-end. And when the next LockBit successor starts making headlines, you won’t be waiting for a vendor signature. You’ll write the detection yourself, push it to a thousand endpoints, and know within minutes whether you’re affected. That’s what hunting looks like.

Frequently Asked Questions

Is Velociraptor free to use?

Yes. Velociraptor is open source under the AGPL license and free for both commercial and personal use.

Does Velociraptor replace my EDR or antivirus?

No. It complements them as a DFIR and hunting platform; it doesn’t block malware. Think of it as visibility and detection engineering, not prevention.

Can I test these artifacts safely without infecting a real machine?

Yes. Simulate the behaviors—running vssadmin delete shadows, dropping test GPO scripts, scripting mass file modifications—in an isolated lab VM rather than executing live ransomware.

What Windows versions do these artifacts work on?

The VQL artifacts rely on standard Windows event logging and work on Windows 10/11 and Server 2016+. Exact event IDs may vary slightly by version.

Where can I find more pre-built detection artifacts?

The Velociraptor Artifact Exchange hosts community-contributed artifacts, including ransomware and persistence hunts you can deploy or adapt as custom detections.