Extending detection engineering to digital forensics: The Velociraptor unified detection-forensics methodology

Abstract

Detection engineering monitors live endpoint logs through centralised platforms. Digital forensics reconstructs past activity from durable artefacts such as Prefetch files and command history. These two disciplines work in parallel. Detection rules depend on log streams that attackers can clear, while forensic analysis remains largely manual.

This paper presents a unified methodology that treats forensic artefacts as structured log sources for Sigma detection rules. Detection logic initiates targeted evidence acquisition so that every alert carries the forensic artefacts that support it. A four-stage process converts artefact knowledge into reusable detection rules. Correlation rules link related detections using native timestamps where the artefact records them and positional ordering where it does not.

Two case studies demonstrate the approach. The first detects bursts of network discovery activity (MITRE ATT&CK T1016) in Windows Prefetch, a forensic fallback when event logs are unavailable. The second detects a four-step infection chain in Linux bash history, where no timestamps exist. Both operate on artefacts that persist after log tampering, and each rule is authored once and then reused across endpoints.