skills.rest
rjonhaas
rjonhaasCOMMUNITY
Explore all skills by this author →
GitHub

Threat Hunting & IOC Sweeps (YARA / Velociraptor)

Scan file systems and memory images with YARA and endpoints via Velociraptor hunts.

1|Updated Apr 25, 2026
Search Tags:#threat hunting#velociraptor#yara#memory forensics#dfir triage#ioc sweep#endpoint hunting
One-click install
npx skills add https://github.com/rjonhaas/SIFTics --skill threat-hunting-ioc-sweeps-yara-velociraptor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Threat Hunting & IOC Sweeps (YARA / Velociraptor)
Source: https://github.com/rjonhaas/SIFTics/tree/main/skills/yara-hunting
Command: npx skills add https://github.com/rjonhaas/SIFTics --skill threat-hunting-ioc-sweeps-yara-velociraptor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects malicious files and behaviors by sweeping evidence and memory for known and hypothesized indicators, reducing time-to-find during DFIR triage.

Core Features & Use Cases

  • YARA rule authoring for IOC families: Structure rules with meta, strings/regex, and robust conditions for files and memory images.
  • High-signal scanning workflow: Scan single files, recursively scan mounted Windows evidence, and scan memory images for hits with optional match details.
  • Velociraptor hunt guidance: Deploy endpoint hunts via web console using common hunting artifacts and YARA-based detection VQL patterns.
  • False-positive control: Compile rules, test against clean directories/known-good sets, and use scoping tactics to avoid noisy matches.

Quick Start

In the case workspace, ask your analyst agent to generate YARA rules for the highest-confidence IOCs and scan the mounted Windows evidence directory with match-string output saved to ./exports/yara_hits/ for review.

Frequently Asked Questions about Threat Hunting & IOC Sweeps (YARA / Velociraptor)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan memory images and file system evidence for malware IOCs?▼

Scan memory images and file systems for malware IOCs by compiling YARA rules and recursively sweeping mounted Windows evidence directories or memory images. Results are exported as structured match outputs to review hits.

How do I run an endpoint IOC sweep using Velociraptor hunts?▼

Run an endpoint IOC sweep using Velociraptor hunts by deploying common hunting artifacts and YARA-based detection VQL patterns via the web console. This orchestrates endpoint artifact queries to discover suspicious artifacts across clients.

Do I need YARA or Velociraptor pre-deployed to perform threat hunting?▼

You need local YARA 4.1.0 installed for file and memory scanning, or a Velociraptor environment with pre-deployed hunt artifacts for endpoint hunting. Rule compilation and recursive scanning depend on these specific tool versions.

What is the best way to control false positives during YARA threat hunting?▼

Control false positives during YARA threat hunting by compiling rules, testing them against clean directories or known-good sets, and applying scoping tactics to avoid noisy matches during high-signal scanning workflows.

How does YARA rule authoring work for detecting IOC families?▼

YARA rule authoring for IOC families structures rules with meta information, strings or regex patterns, and robust conditions for files and memory images to validate indicators and identify malicious artifacts.

Can I save YARA match details when scanning mounted Windows evidence?▼

Save YARA match details when scanning mounted Windows evidence by requesting match-string output during the recursive scan. Hits are written to designated export directories like ./exports/yara_hits/ for DFIR triage review.

Related Skills

Explore More Data & Analytics Skills→
refractionPOINTrefractionPOINT
29

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

Official
Advanced
Q16GQ16G
83

malware-detect

Identify and analyze potential malware on a host using YARA rules and forensic checks.

Community
Advanced
riparinoriparino
1

defensive-keylogger-detection

Detect keylogger activity using YARA rules and API hook detection.

Community
Advanced
Ramprasad4121Ramprasad4121
1

yara-rule-authoring

Guide YARA-X detection rule authoring for malware identification.

Community
Advanced