Velociraptor collect

velociraptor artifacts collect -a Windows.Sysinternals.Autoruns

Collect forensic artifacts from endpoints with Velociraptor (here Autoruns) in a distributed manner, without touching the host more than necessary.

Deploy Velociraptor when you need forensic collection at scale: the Velociraptor server launches artifacts (predefined data collections: autoruns, processes, network, EVTX, prefetch...) on all endpoints at once, and results return to the console with the timeline. The Windows.Sysinternals.Autoruns artifact collects persistence points (Run keys, services, tasks, boot DLLs) from each host — the key question of 'where does the attacker survive?' answered across the entire fleet in minutes. It is the default modern IR tool: lightweight agent, distributed queries (VQL), and on-demand or scheduled collection.

Don't use it without planning the deployment: Velociraptor requires installing the agent on endpoints and an accessible server — in an ongoing IR, mass deployment is a decision (and a change on hosts) that must be coordinated. Heavy artifacts (full EVTX, memory) generate traffic and load on endpoints and the server: select artifacts with criteria and scope by host or group. And watch out: collection is a snapshot — artifacts that change (processes, connections) must be interpreted with temporal context; for volatile data, prioritize collection over analysis.