Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

The Gentlemen – Velociraptor DFIR Tool Deployed for Offensive C2

Thegentlemen Command and Control Sentinel
MITRE ATT&CK
Remote Access Tools
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (thegentlemen)
What This Detects
The Gentlemen's toolkit includes Velociraptor — a legitimate open-source DFIR/endpoint-visibility platform — repurposed as a remote-access/C2 channel, alongside TrustedSec Titanis and ZeroPulse. Its presence outside a sanctioned IR engagement is a strong red flag.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("velociraptor.exe","velociraptor-client.exe")
| project Timestamp, DeviceName, ProcessCommandLine, FolderPath, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.