Hunting an Edge Appliance Compromise with Velociraptor

The earlier articles in this series covered a continuous wave of edge device vulnerabilities: SonicWall, Check Point, SimpleHelp, Palo Alto, Citrix. The DBIR 2026 report confirms the trend, and the field numbers are unambiguous: remote access services served as the entry point for 87 percent of ransomware claims, with VPN compromises alone accounting for 73 percent of intrusions where the entry vector was identified. The question, for a defense team, is therefore no longer just "how to detect exploitation," but "how to hunt what has already gotten in."

The post-compromise pattern of an edge intrusion

SentinelOne's DFIR team documented several incidents where firewalls were compromised to establish a beachhead. The pattern is instructive. Exploitation allows extracting the appliance configuration file, which frequently contains service account credentials and valuable network topology information. The attacker then uses the appliance service account to pivot into the internal network, T1133 followed by T1078 (Valid Accounts). At scale, the FortiBleed campaign harvested the credentials of over 86,000 FortiGate devices worldwide.

Once inside, several traces appear: logons by the appliance service account from hosts that have no reason to use it, unknown workstation names joining the domain, local accounts created, persistence scheduled tasks. These traces are scattered across dozens or hundreds of hosts. That is exactly the problem Velociraptor solves: hunting an artifact across the whole estate, in a single query.

Why Velociraptor for hunting at scale

Velociraptor is an open-source DFIR and threat hunting tool that queries endpoints using a query language, VQL. Instead of inspecting one host at a time, you launch a hunt that queries the entire estate simultaneously and surfaces only the hosts presenting the sought artifact. For an edge intrusion, three hunts are priorities.

The first looks for logons by the appliance service account where it should never appear. If your VPN or firewall service account logs on to a domain controller or a file server, that is a strong anomaly. The hunt extracts logon events and filters on that account.

name: Custom.Hunt.EdgeServiceAccountLogon
description: Looks for appliance service account logons on internal hosts
parameters:
  - name: ServiceAccount
    default: svc-vpn
sources:
  - query: |
      SELECT Computer, EventTime, EventData.TargetUserName AS Account,
             EventData.IpAddress AS SourceIP, EventData.LogonType AS LogonType
      FROM parse_evtx(filename="C:/Windows/System32/winevt/Logs/Security.evtx")
      WHERE EventID = 4624
        AND Account =~ ServiceAccount
        AND LogonType IN ("3", "10")

The second hunt targets recently created local accounts and unknown workstation names, markers of persistent access set up after the pivot. The third looks for suspicious scheduled tasks across all hosts, a classic persistence mechanism after an intrusion.

Correlate with appliance indicators

The host-side hunt benefits from correlation with appliance-side traces. VPN or firewall logs often hold the first signal: a session established without matching authentication, a connection from an unusual IP address, a workstation name evoking an offensive tool. The correlation is done over time: an abnormal session on the appliance, followed shortly by a service account logon on an internal host, draws the complete pivot chain.

This correlation is the added value of a structured incident response. An isolated signal on the appliance may be a false positive; the same signal followed by service account activity inside the network is an intrusion to treat urgently.

From hunting to remediation

When a hunt surfaces affected hosts, remediation follows a precise sequence. First, isolate the affected hosts and the edge appliance. Then, rotate all credentials extractable from the appliance configuration, especially service accounts, because they are the key to the pivot. Next, find and remove persistence on the affected hosts, the local accounts and scheduled tasks identified by the hunts. Finally, only restore the appliance once it is patched, because bringing it back into service still vulnerable reopens the same door.

The lesson of the 2026 wave is that exploitation detection and post-compromise hunting are inseparable. An exploited edge device should always trigger an internal hunt, because initial access is only the first step. Having ready-to-use hunt artifacts, covering the pivot patterns actually observed, turns a multi-day incident response into a few-hour operation.

That is what the ThreatClaw Velociraptor feed provides: hunt and forensic collection artifacts built on the pivot and persistence techniques actually observed, to hunt across the whole estate what has crossed the edge.