.wordlist.txt

aca
accelerometer
accessor
accessor's
accessors
adhoc
acl
ACLs
acls
ACSC
ActiveScript
ActiveXObject
adbe
ADDomain
AddPrinterDriverEx
admin's
admins
AEST
afp
Agentless
agentless
AGPL
alex
alice
allocs
amd
analyse
analysed
analysing
analystbob
analytics
andreafortuna
api
API's
APIs
apis
applet
apps
Arg
arg
args
argv
arn
arp
ASCII
async
atexit
Atim
atime
atoi
Att
AttackerKB
auditable
auditd
Auscert
auth
authenticator
authenticators
Authenticode
autocert
autoexec
autoplay
autorun
autoruns
backdoors
backend
backtick
backticks
backtrace
backtraces
balancer
BAM
basename
BasicCollection
Bigtable
binarydefense
BitField
bitfield
BitFields
bitfields
Bitlocker
bitsadmin
Blackhat
BlackJack
blockquote
blocksize
blog
blogs
blogspot
bool
boolean
btime
btn
BTV
bugfix
bugfixes
busybox
bzip
CA's
callgrind
cancelled
cancelling
CAs
catdb
CatRoot
catroot
CDN
CDROM
CentOS
centralized
centric
certbot
certs
CertUtil
changelog
charset
checkbox
Chromebook
CIDR
CLA
CIMV
clayscode
ClientId
cmd
Cmdline
CmdShell
CNTUSER
CobaltStrike
cocoatime
codebase
codebases
codec
commandlet
CommandLine
commandline
comms
Compat
COMPlus
complus
COMPUTERNAME
COMSPEC
conf
Conffiles
config
CPU
crashdump
creds
cron
crosshairs
crowdsourcing
crypto
cryptographic
csv
Ctrl
curated
CurrentControlSet
CurrentVersion
customizable
customizations
CVE
cyber
CyberChef
cybersecurity
datafile
dataset
datastore
ddclient
DDoS
debconf
debian
decrypt
decrypting
decrypts
dedup
deduplicate
deduplication
DefCon
deobfuscation
deployers
deps
DER
dereference
dereferences
dest
DstAddr
destructors
detections
DFIR
DFRWS
dhclient
dhcp
dict's
dicts
discoverable
dit
dll
DLLs
dlls
DNS
docx
facto

downsides
dpkg
drilldown
DSL
DWORD
DynDNS
ECS
EDR
EFS
eg
ElasticSearch
elasticsearch
ElfFile
emails
Encrypt's
Encrypt’s
endian
EndTime
EntryNumber
env
environ
EQL
ESE
ESEDatabaseView
ESEDatabaseViewer
ESM
EVTX
ETW
eval
EventConsumer
EventConsumers
EventData
evented
EventFilter
EventID
eventing
EventLog
eventlog
EventLogs
EventMessageFile
eventquery
EventRecordID
EVT
EvtxHunter
EWT
exe
exe's
executables
execve
exfiltration
ExpectedHash
Facebook
defacto
FailedEventData
failedLogonTimeWindow
FailedSystem
failureCount
fas
FatTimestamp
FC
FetchBinary
fifo
Fifos
FileBaseDataStore
FileFinder
FileFox
fileio
Fileless
FileName
filepath
filestore
filesystem
filesystem's
filesystems
FileTime
Filetime
FilterToConsumerBinding
FindByMagics
FindFile
FindFirstFile
Firefox
firewalls
FleetDM
fmt
foreach
FQDN
frontend
Frontend's
frontends
fs
FSP
fsutil
Fullname
FULLPATH
FullPath
FullPathRegex
fullscreen
func


Gb
gb
GCP
GEfw
GeoIP
geolocation
getpid
GetShortPathName
gif
github
gitlab
GLIBC
GLOBALROOT
globals
globbing
gmail
golang
Golang's
google
googlegroups
goroutine
goroutines
gpg
gpupdate
Graeber
Graphana
grep
grok
gRPC
grpc
GRR
Grr
GRR's
gui
GUID
guid
GUIDs
gz
gzip
Harddisk
HashFunction
HashSize
HEC
Hexview
HFS
homedir
Homepage
hostkey
hostname
hostnames
hosts's
http
https
HuntId
IAM
IIS
ImagePath
img
impactful
ImportCollection
indx
InfoSec
Infosec
Infosec's
initialised
inode
inodes
InsightIDR
Inspiron
InstalledSize
instantiation
intel
interdependency
interoperability
ints
InUse
investigatoralice
IOC
IOCs
ip
IPC
ipconfig
IPS
ipup
IPv
iro
isabled
ISDIR
IsDir
IsLink
IsSlack
iterable
javascript
JECmd
jitter
Jonny
journaling
jpeg
jpg
Jrnl
JS
js
JSecurity
json
jsonl
jupyter
Jupyter's
KAPE
Kape
KapeFile
KapeFiles
KapeTriage
kb
kcachegrind
keepalive
Khatri
Kibana
killkillkill
kleinco
kolide
Koppeling
Kroll's
Laddr
Landers
langauge
LargestPid
lastaccesstime
LastModified
LastUserLogin
lastwritetime
launchctl
launchd
layed
LazyExpr
LegacyQuery
Lego
len
Letsencrypt
LHS
libcap
libmagic
librally
libsoup
libyara
libyara's
lifecycle
liftingm
LinkedIn
Linux
linuxDpkgStatus
ListDirectory
ListProcesses
livepatch
lnk
localaccounts
LocalGroupMember
localgroupmember
LocalHashes
localhost
localizations
LogFileCleared
logman
logon
logons
LogonTime
logstash
lolbas
Lolbin
LookupAccountSid
lookups
lookupSID
loopback
lowcase
lpd
linux
LPE
Lpid
lsass
MacOS
mactime
MagicID
Magid
MagidID
mailto
maintainance
MajorVersion
makeslice
malpedia
malware
MappingName
matcher
matplotlib
Mattos
MaxMind
maxmind
mb
md
MDR
MDRlY
mdsec
mdShell
memoize
menutitle
messagedb
MessageList
metadata
metasploit
metdata
mft
MFTId
mgreen
mic
microsoft
MimiKatz
mimikatz
mimilib
MinorVersion
mis
misp
MITM
Mitre
mmap
Modelling
ModuleAnalysisCache
ModuleLength
MOF
motd
motivators
mozallowfullscreen
mru
MSBuild
msg
msh
msha
mshta
msi
msiexec
msrc
Mti
Mtim
mtime
mtimefrom
MUI
multifrontend
Multiline
multithreaded
mutex
mutexes
mxdwdrv
MyBadMutex
MyCode
myconfig
mydb
myexternalip
myhashes
myhostname
myprocess
myRules
mysql
mystat
n'th
namespace
namespaces
NameType
Nano
natively
nd
netaddr
netcat
netspi
netstat
NetUserEnum
NewQuarantine
NewQuery
NFS
nginx
nirsoft
nobanner
NOOP
nPrivileges
ns
nSubject
ntds
ntfs
ntfswalker
ntuser
NTUserPath
nviso
NZA
NZITF
OAuth
oauth
objtree
OIDC
ok
Okta
oleparse
OleParser
olevba
OneDrive
onlinehashcrack
opensource
openssl
ordereddict
OriginalFileName
OSDFC
OSINT
OSQuery
osquery
OSQuery's
OSs
OWASP
pagefile
Palantir
parallelization
parallelize
params
Parsers
parsers
passwd
patchboard
PathName
PathRegex
pathspec
PayloadType
pc
pdf
pDriverContainer
pe
PEB
pem
performant
PermanentWMIEvents
phishing
PHP
pid
PidLookup
PII
PKCS
PKI
placeholders
plist
plugin
plugins
pmem
png
POC
postgres
postprocessing
PowerShell
powershell
powershell's
PPID
Ppid
ppp
pprof
pre
preconfigure
preconfigured
predictiple
prefetch
prepended
prepends
PrinterNightmare
printf
PrintNightmare
printnightmare
privatekey
PrivilegeList
proactively
proc
procdump
procedurally
proces
ProcessCreation
ProcessHollowing
ProcessID
ProcessInfo
ProcessMemory
ProcessNames
procmon
Procs
programmatically
proto
protobuf
protobufs
PRs
ps
psexe
PsExec
psexec
PsexecService
psexesv
psexesvc
pslist
psql
Pstree
publically
PublishDate
PubSub
Pubsub
pubsub
pulldown
py
pydata
pyvelociraptor
QoS
QPS
QWORD
RabbitMQ
ransomware
RawSec
RBAC
rcuos
RDP
README
realtime
RecordLength
recurse
recursed
recursing
recusive
recyclebin
refactored
regex
RegEx
regexes
regexp
regparser
RegRipper
rekall
Rekall's
relpath
relref
remediations
remoting
repo
repos
represent's
representable
responder
responders
RESTfull
resx
resync
reusability
rhq
RHS
roadmap
RootCAStore
rootkit
RPC
rpcrt
RPCs
RSA
rsync
rubo
runas
runkey
runlist
runme
RunOnce
runtime
rwxr
saml
sbin
sc
scalability
scalable
SCCM
SCHTASKS
scop
scp
screencast
screenshot
screenshots
secfs
securityLogFile
SeDebugPrivilege
sedebugprivilege
SelectMyParent
selectmyparent
sep
serializable
serversideencryption
ServiceCreation
ServiceName
ServiceType
setshortname
SFTP
sftp
SHA
sha
Shae
sharable
shellcode
shimcache
shortname
shoutout
sid
SIEM
signficant
silcollector
SIze
SlackOffset
sleuthkit
sm
SmallestPid
SMB
SMS
smtp
sneakernet
someuser
sourced
sourcetype
spam
speced
specing
splunk
Spooler
spoolsv
Sprintf
sql
SQL's
SQLite
src
SrcAddr
SRUDB
srum
ssd
SSDs
ssh
ssl
ssltls
SSO
stager
standalone
starl
starlark
STDERR
Stderr
stdout
StoredQuery
str
stringifier
struct
struct's
StructName
StructObject
structs
subdirectories
subdirectory
SubjectUserName
SubjectUserSid
subkey
subnet
suboptimal
subqueries
subquery
subscope
subselects
substr
substring
SuccessEventData
SuccessSystem
sudo
summarise
supertimeline
Supertimeline's
svg
swiss
symlink
symlinks
sys
sysadmins
sysinfo
Sysinternal
Sysinternal's
sysinternals
syslog
syslogs
sysmon
Sysmon's
systemctl
systemd
SystemLog
systemLogFile
SystemRoot
systemroot
SystemTime
SysWOW
SZ
Tanium
taskschd
TaskScheduler
tcp
teamers
tempdir
tempfile
Terabytes
Terraform
testcomputer
testdata
th
thirdparty
Thumbdrives
TimeCreated
timeframe
timeline
timelines
timerange
Timestomp
timestomping
timetracker
timezone
timezones
tkape
TLS
tmp
TokenIsElevated
toml
toolbar
TotalUsers
tradeoff
tradeoffs
TriageCapa
triaged
TriageGene
TriageUpload
triaging
trojan
TTP
txt
TypeName
UAC
Ubuntu
UI
uid
uint
unallocated
UNC
unchecking
unhex
uninstall
unix
UnixNano
unpatched
unquarantine
unsplash
untrusted
upcase
Uptime
uri
URIs
url
urls
UrlSize
USD
UseBasicParsing
usec
UserData
UserID
username
usernames
UserSID
userspace
usn
UsnJrnl
usr
UsrClass
utf
utils
uuid
vad
varname
VBA
VBox
vectorpouch
velocidex
velociraptor
velociraptor's
velociraptors
verifications
versioned
versioning
vfilter
VFS
VFSListDirectoryflow
VIRT
VirusTotal
VM
VMs
vmware
vql
VQL's
vqlargs
VQLCollectorArgs
VQLResponse
VR
VSS
vssadmin
VSSAnalysis
vtesting
Vtype
vtypes
watchlist
WBEM
WebBrowsers
WebDAV
webdav
webhook
Webhooks
webkitallowfullscreen
webmasters
WebRequest
webshell
website
websites
wevtutil
whitelist
whitelisted
whitelisting
whitepaper
whitespace
whoami
wiki
wildcards
windir
WinEVT
winevt
winfiletime
WinFileTime
winfsp
winhttp
winioctl
winlogbeat
winobj
winpmem
WinRM
WinSxS
Wix
Wixtoolset
wkscli
wmi
wmic
WMIE
wmie
WMIEventing
WMIEventingNoismaker
WMIProcessCreation
wmisdk
workflow
workflows
WORKGROUP
workspaces
WOWed
WQL
writeback
writeup
WScript
wtmp
www
xcopy
xml
xor
xpnsec
yaml
yara
yara's
YaraRule
YouTube


AMSI
amsi
appcompatcache

# plugin descriptions
ArrayObject
Amcache
ASEP
binparsergen

# Some HTML tags
br
href
html
le
li
linktitle
lt
noindex
ol
ul

## To be fixed in vql.yaml
ascii
asyncronous
asyncronously
authenticode
cidr
connstring
credentialskey
credentialssecret
CountOfEntries
ctime
DelegateAccessor
DelegatePath
DirectoryGlobs
direname
dirname
disableToc
DNSQueries
dns
dont
DownloadFile
DownloadTime
downsample
etw
ese
evtx
externalip
fqdn
GCS
gcs
geoip
hh
hhmm
nocase
nosymlink
noverifycert
OU
noop
pkcs
rc
sqlite

## British spelling that should be accepted
behaviour
behavioural
centralised
defence
enrol
enrolment
enrols
favourite
normalisation
normalise


## Names
Brower
Capuano
Carlos
Caspari
Cheung
Cunha
DeGrazia
DeGrazia's
Didier
Didier's
alfaifi
Abagnale
Gamell
hasherezade
Welgemoed
wlambertts
Yogesh

# Special case
# As de-queue
de
dat


MyLabel
Memoizing
memoizing
OSPath
kwargs
shannon


noTitle
noDisqus
iops
lzxpress
rekey
cpu
subprocess
rekeying

editURL

pathspecs
stringified
suprisingly
deserialization

mnt

hashselect
SMA
VirtualHostname
RSS
sso

MSIs
plaintext

CentoOS
RedHat
SUSSE
centos
libc

overriden
superset

jq

VeloCon
CFP
cybercrime

MUSL

callchain
gunzip
lru
Gunzip
LRU

Cliftons
iteratively

OrgId
orgs


APTA
ARTifacts
Cibernética
DinoSOAR
DinoSOARLab
Ensino
Fardell
Hammerschmidt
IDESP
Instituto
LLC
NIDS
Opensearch
Paulo
Pereira
Pilkington
Segurança
Superiorde
Suricata
São
VPN
VeloCON
Velocistack
Wes
XDR
Zeek
datacentre
explainability
observables
prise
reimplement
scikit
Gartner
TCC
macOS

backport
keyring

velocon
APAC

tlsh
pubkey

OpenSoc
ReconInfosec
virtualized

blackholing

CVEs

TLDR
musl
vfs

deduped
LazyAny

VelociraptorDarwin
VelociraptorLinux
VelociraptorWindows
os
IOPs
ProcessEntry
ProcessTrackerUpdate
enrichments
msec

namespece
cwd
PIDs
EBS

pskill
BlackHat

MSSP
infosec

# content/blog/2023/2023-04-05-qakbot/_index.md
IPs
QBOT
QBot
Qak
Qakbot
Qbot
Unescaped
Virustotal
onwards
unbacked

# content/docs/offline_triage/remote_uploads/_index.md
SAS
uploader

# content/vql_reference/plugin/http_client/_index.md
SkipVerify

# content/vql_reference/misc/efivariables/_index.md
efi
efivariables
sas

# content/vql_reference/misc/upload_smb/_index.md
ShareName
smb

# content/announcements/2023-velocon/_index.md
TBD

# content/presentations/2023_auscert/_index
exfiltrated
CyberCrime

# content/blog/2023/2023-05-05-release-notes-0.6.9/_index.md
lockdown
gapped

# content/announcements/2023-trainings/_index.md
MPLogs
cmdline
geeking
teamserver

# content/vql_reference/basic/unzip/_index.md
autodetected
tgz

#content/vql_reference/plugin/upload_s3/_index.md
KMS
kmsencryptionkey
uploadroot
credentialstoken

# content/blog/2023/2023-07-27-release-notes-0.7.0/index.md
SQLiteHunter
deduplicates
leveldb

# <url-free> content/vql_reference/misc/_index.md
LogScale
logscale
apibaseurl


# content/announcements/2023-velocon/_index.md
Andreas
Aon
EDRs
Flamino
Güneysu
IMPERUM
Ilioukevitch
Kostya
Kulkarni
Leeuwen
PSA
Paluch
Phalgun
SIDR
Semanur
Shellbags
UAL
UserAssist
WinSCP
extensibility
masse
transformative
Uncompress

# content/docs/_index.md
InsightIDR
XSS

# content/docs/vql/_index.md
unsimplified

# content/blog/2023/2023-11-15-sigma_in_velociraptor/_index.md
Hayabusa
SIEMs
backend's
backends
ruleset
schemas
taskscheduler

# content/blog/2023/2023-11-15-release-notes-0.7.1/_index.md
Templated
decrypted

# content/vql_reference/event/watch_etw/_index.md
TdhGetEventMapInformation
MapInfo

# content/docs/deployment/security/_index.md
mTLS
unencrypted

# content/docs/deployment/troubleshooting/_index.md
DataDog
Grafana

# content/docs/deployment/clients/_index.md
Winget
autoupdate
denylist
winget

# content/vql_reference/misc/xattr/_index.md
xattr


# content/vql_reference/basic/humanize/_index.md
MiB
ibytes

# content/blog/2024/2024-03-10-release-notes-0.72/_index.md
CloudFlare
EWF
TCT
Websocket
balancers
decompile
dyndns
sortable
topologies
uploaders
virtualize
websocket
websockets

# content/vql_reference/plugin/upload_s3/_index.md
kms
serverside

# content/vql_reference/misc/host/_index.md
AXFR
CNAME
DNSKEY
SOA

# content/vql_reference/plugin/yara/_index.md
yarac

# content/docs/forensic/filesystem/accessors/_index.md
ewf
rebase
seekable
snapshotting
unicode
unmapped
vss

# content/docs/vql/join/_index.md
Alfreds
Anders
ContactName
CustomerID
CustomerName
Emparedados
Futterkiste
OrderDate
OrderID
Taquería
helados

# content/blog/2024/2024-04-12-registry-hunter/_index.md
EulaCheck
eulacheck
specilized

walkthrough


<url-free> content/blog/2024/2024-05-09-detection-engineering/_index.md
--------------------------------------------------------------------------------
ChainSaw
SigmaHQ
Winlogbeats
architecting
executable's

desc
rr

<url-free> content/knowledge_base/tips/deleting_old_data.md
DeleteManyFlows
DeleteMonitoringData

<url-free> content/blog/2024/2024-07-22-how-to-use-your-own-certificates/_index.md
--------------------------------------------------------------------------------
DigiCert
reliancecyber
vvv
wsarecv
OpenSSL
journald
lang


<url-free> content/vql_reference/accessors/_index.md
--------------------------------------------------------------------------------
MSCFB
idx
mscfb
vhdx
vmdk
--------------------------------------------------------------------------------

<url-free> content/blog/2024/2024-09-10-release-notes-0.73/_index.md
--------------------------------------------------------------------------------
Paginator
SUID
Timesketch
errored
timesketch
vmdk
--------------------------------------------------------------------------------

<url-free> content/blog/2024/2024-09-12-timelines/_index.md
--------------------------------------------------------------------------------
Timelining
timelining
CLI
Plaso
TimesketchUpload
Misje

del
typeof
CRUU
KIE
ds
AES

<url-free> content/vql_reference/misc/ebpf_events/_index.md
--------------------------------------------------------------------------------
ebpf

<url-free> content/vql_reference/misc/watch_ebpf/_index.md
--------------------------------------------------------------------------------
eBPF
tracee

<url-free> content/vql_reference/basic/now/_index.md
--------------------------------------------------------------------------------
datetime

<url-free> content/docs/deployment/clients/_index.md
--------------------------------------------------------------------------------
AutoUpdate
FreeBSD
Glibc
Intune
Jamf
MDM
macOS
OpenRC
Romanitho
SysVinit
Toolset
WiX
XP
configs
dmg
init
subcommand
toolset
toolsets
wix

FileSystem
autocompletion
checkboxes
dropdown
freeform
recency
unlabelled
IPSec
QuarantineMonitor
nftables

<url-free> content/knowledge_base/tips/setup_keycloak.md
--------------------------------------------------------------------------------
Authentik
Keycloak
Keycloak's
OpenID
Zitadel
acknowledgement
multifactor
themeable

<url-free> content/vql_reference/other/serialize/_index.md
--------------------------------------------------------------------------------
SearchFilesGlobTable
tlist

<url-free> content/vql_reference/parsers/yara_lint/_index.md
--------------------------------------------------------------------------------
prefilter

<url-free> content/docs/clients/interrogation/_index.md
--------------------------------------------------------------------------------
ScheduleHunt
YouTube

<url-free> content/docs/artifacts/parameters/_index.md
--------------------------------------------------------------------------------
artifactset
multichoice
unparsed

<url-free> content/knowledge_base/tips/automating_labels.md
--------------------------------------------------------------------------------
CuratedSigma
EICAR
Labelling
labelled
realworld

<url-free> content/blog/2022/2022-03-22-deaddisk/_index.md
--------------------------------------------------------------------------------
VMware
xmount

forwading
triages

<url-free> content/docs/deployment/security/_index.md
--------------------------------------------------------------------------------
CRL
FolderPath
pst
io
prem

<url-free> content/blog/2025/2025-02-23-release-notes-0.74/_index.md
--------------------------------------------------------------------------------
Fibratus
Verifier
presumbit