Threat Hunting & IOC Sweeps (YARA / Velociraptor)

What problem does it solve?

Detects malicious files and behaviors by sweeping evidence and memory for known and hypothesized indicators, reducing time-to-find during DFIR triage.

Core Features & Use Cases

• YARA rule authoring for IOC families: Structure rules with meta, strings/regex, and robust conditions for files and memory images.
• High-signal scanning workflow: Scan single files, recursively scan mounted Windows evidence, and scan memory images for hits with optional match details.
• Velociraptor hunt guidance: Deploy endpoint hunts via web console using common hunting artifacts and YARA-based detection VQL patterns.
• False-positive control: Compile rules, test against clean directories/known-good sets, and use scoping tactics to avoid noisy matches.

Quick Start

In the case workspace, ask your analyst agent to generate YARA rules for the highest-confidence IOCs and scan the mounted Windows evidence directory with match-string output saved to ./exports/yara_hits/ for review.