Velocidex/velociraptor v0.72

Release 0.72 RC1

on GitHub

I am very excited to announce that the latest Velociraptor release
0.72 is now available for testing in Release Candidate status.

Detailed release notes are at https://docs.velociraptor.app/blog/2024/2024-03-10-release-notes-0.72/

This release brings many new features:

1. EWF Support - In this release, Velociraptor supports EWF (AKA E01) format using the
   ewf accessor. This allows Velociraptor to analyze E01 image sets.

2. Allow remapping clients to use SSH accessor - This release added the ability to apply remapping in a similar way to
   the dead disk image method above to run a Virtual Client which
   connects to the remote system via SSH and emulates filesystem access
   over the sftp protocol.

3. Undo/Redo for notebook cells

4. Hunt view GUI is now paged

5. Secret Management - This release introduces Secrets as a first class concept within
   VQL. A Secret is a specific data object (key/value pairs) given a
   name which is used to configure credentials for certain plugins

6. Implemented Websocket based communication mechanism - In this release, Velociraptor introduces support for websockets as a
   communications protocol. The websocket protocol is designed for low
   latency and low overhead continouus communications method between
   clients and server (and is already used by e.g. most major social
   media platforms).

7. Dynamic DNS providers - The 0.72 release has now switched to CloudFlare as our default
   preferred Dynamic DNS provider. We also added noip.com as a second
   option.

8. Enhanced proxy support - The 0.72 release introduces more complex proxy condition
   capabilities. It is now possible to specify which proxy to use for
   which URL based on a set of regular expressions. Also PAC files are now supported.

9. Process memory access on MacOS

10. Multipart uploaders to http_client() - This release adds the files parameter to the http_client()
    plugin. This simplifies uploading multiple files and automatically
    streams those files without memory buffering - allowing very large
    files to be uploaded this way.

11. Yara plugin can now accept compiled rules

If you find any issues please file an issue on GitHub or chat with us on our discord server.