Extending Detection Engineering to Digital Forensics: The Velociraptor Unified Detection-Forensics Methodology

• URL: http://arxiv.org/abs/2606.28812v1
• Date: Sat, 27 Jun 2026 08:44:22 GMT
• Title: Extending Detection Engineering to Digital Forensics: The Velociraptor Unified Detection-Forensics Methodology
• Abstract summary: This paper develops a unified detection-forensics methodology using Velociraptor.<n>It converts artefact knowledge into reusable and testable detection rules suitable for both post-incident triage and live monitoring.
• Score: 4.589542149325491
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Detection engineering and digital forensics have evolved in parallel rather than in partnership, leaving a gap between real-time alerting and forensic analysis. This paper develops a unified detection-forensics methodology using Velociraptor, where detection logic directly initiates targeted evidence acquisition at the point of detection. The contribution is threefold: (1) a four-stage methodology (baseline establishment, evidence correlation, attack chain analysis, and scenario labelling with confidence) that converts artefact knowledge into reusable and testable detection rules suitable for both post-incident triage and live monitoring; (2) a practical demonstration, using three Velociraptor BaseVQL log sources (/forensics/windows/prefetch, /forensics/windows/usn, and /windows/wmi) that practitioners can deploy today, showing that artefact-based detections enable scalable forensic triage without full disk acquisition; and (3) evidence that periodic artefact analysis offers continuous monitoring while substantially reducing data volume compared to conventional endpoint logging. Two case studies illustrate the approach: a Prefetch/USN baseline for triage when Windows Event Logs are cleared or unavailable, and a WMI persistence correlation supporting both triage and continuous monitoring through periodic artefact analysis.

Related papers

• A Deterministic Forensic Preprocessing Framework for Heterogeneous Network Datasets: Formal Foundations, Implementation, and Empirical Validation [3.861495812647291]
  This paper introduces a deterministic forensic preprocessing framework that converts heterogeneous network datasets into a reproducible canonical form.<n>A chunk-based architecture provides O(c) bounded memory.<n> Empirical evaluation across UNSW-NB15, IoT-23, and TON_IoT demonstrates 100% output consistency across repeated runs.
  arXiv  Detail & Related papers  (2026-06-10T01:45:09Z)
• AuthTrace: Diagnosing Evidence Construction in Thematically Dense Single-Author Corpora [6.956097396264084]
  We introduce AuthTrace, a diagnostic benchmark built on thematically dense single-author corpora.<n>AuthTrace provides explicit quoted evidence, exact fan-in annotation, and a unified pack-level protocol measuring evidence recall, evidence precision, and answer correctness.
  arXiv  Detail & Related papers  (2026-05-25T03:10:52Z)
• Monitoring Data-aware Temporal Properties (Extended Version) [56.386411908764494]
  We consider anticipatory monitoring of linear-time properties enriched with an arbitrary SMT theory over finite traces.<n>Anticipatory monitoring in this setting is highly challenging, as the monitoring state depends on both the trace prefix seen so far and all its possible finite continuations.<n>We present and formally prove the correctness of a novel foundational framework for monitoring properties in an expressive fragment offMT.
  arXiv  Detail & Related papers  (2026-05-14T10:23:11Z)
• Attribution-Guided Multimodal Deepfake Detection via Cross-Modal Forensic Fingerprints [4.598350938853635]
  We argue that a detector incapable of identifying how a video was forged is likely learning the wrong signal.<n>Unlike binary detection, attribution-guided learning imposes a stronger geometric constraint on the shared embedding space.<n>We propose the Attribution-Guided Multimodal Deepfake Detection framework, which jointly learns to detect and attribute manipulation.
  arXiv  Detail & Related papers  (2026-04-29T09:11:13Z)
• Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw [0.0]
  Agentic Al systems are increasingly deployed as personal assistants and are likely to become a common object of digital investigations.<n>This paper presents an empirical study of OpenClaw a widely used single-agent assistant.<n>We classify and correlate these traces to assess their investigative value in a systematic way.
  arXiv  Detail & Related papers  (2026-04-07T08:35:22Z)
• Beyond Artificial Misalignment: Detecting and Grounding Semantic-Coordinated Multimodal Manipulations [56.816929931908824]
  We pioneer the detection of semantically-coordinated manipulations in multimodal data.<n>We propose a Retrieval-Augmented Manipulation Detection and Grounding (RamDG) framework.<n>Our framework significantly outperforms existing methods, achieving 2.06% higher detection accuracy on SAMM compared to state-of-the-art approaches.
  arXiv  Detail & Related papers  (2025-09-16T04:18:48Z)
• Propose and Rectify: A Forensics-Driven MLLM Framework for Image Manipulation Localization [49.71303998618939]
  This paper presents a novel Propose-Rectify framework that bridges semantic reasoning with forensic-specific analysis.<n>Our framework ensures that initial semantic proposals are systematically validated and enhanced through concrete technical evidence, resulting in comprehensive detection accuracy and localization precision.
  arXiv  Detail & Related papers  (2025-08-25T12:43:53Z)
• Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs [4.893077353126799]
  Lateral movement is a crucial component of advanced persistent threat (APT) attacks in networks. We propose a multi-scale lateral movement detection framework called LMDetect.
  arXiv  Detail & Related papers  (2024-11-15T15:35:56Z)
• Discovering Transferable Forensic Features for CNN-generated Images Detection [100.12017277070576]
  We conduct the first analytical study to discover and understand transferable forensic features (T-FF) in universal detectors. In this work, we propose a novel forensic feature relevance statistic (FF-RS) to quantify and discover T-FF in universal detectors. Our investigations uncover an unexpected finding: color is a critical T-FF in universal detectors.
  arXiv  Detail & Related papers  (2022-08-24T07:48:07Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)
• No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems [95.54151664013011]
  We present a novel framework to generate adversarial spoofing signals that violate physical properties of the system. We analyze four anomaly detectors published at top security conferences.
  arXiv  Detail & Related papers  (2020-12-07T11:02:44Z)
• Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events [7.219077740523683]
  Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems.
  arXiv  Detail & Related papers  (2020-12-02T14:14:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.