Free threat hunting toolkit for small teams

You do not need a six-figure platform to start hunting. This is a practical map of free tools a two-person team can run, grouped by job, with the licence and one concrete hunt for each. It pairs with our Hunt Lab (opens in a new tab) Sigma, KQL and SPL packs, and with the Hunt Lab README (opens in a new tab) for how each folder’s Sigma, KQL and SPL are laid out.

Every URL and licence below was checked against the project’s official site or repository on 28 October 2026 (Europe/London). Prefer those sources over third-party write-ups. Nothing here authorises scanning or collecting from systems you do not own or are not authorised to test.

Endpoint collection and response

Velociraptor (opens in a new tab) is an open-source endpoint visibility and DFIR platform. You run a server, deploy clients, and hunt with VQL artefacts across live hosts or offline collections. Reach for it when you need to ask a fleet a precise question (process trees, prefetch, EVTX pulls, NTFS artefacts) without buying per-seat EDR. Licence: GNU Affero General Public License v3 (LICENSE on GitHub (opens in a new tab)). Rapid7 offers commercial packaging on top of the AGPL project; the open-source build stays free (see Friday’s review). Official docs: docs.velociraptor.app (opens in a new tab); source: github.com/Velocidex/velociraptor (opens in a new tab).

Concrete hunt: run a hunt for recently created executables under user-writable paths, then pull matching EVTX and prefetch for the outliers. For the deeper product read, see Friday Jones’s Velociraptor review (Velociraptor DFIR review: open-source hunts and VQL). This guide does not repeat that review.

Host telemetry

Sysmon (opens in a new tab) (Sysinternals) adds high-value Windows process, network and file events that the default Security log does not give you. Reach for it when your hunts need Image, CommandLine, ParentImage and hash fields. Licence: Microsoft Sysinternals Software License Terms (licence terms (opens in a new tab)). It is free to download; it is not open source. Pair it with a maintained community config: SwiftOnSecurity/sysmon-config (opens in a new tab) (no licence file in the repository when checked; read the README and confirm redistribution before you fork widely) or olafhartong/sysmon-modular (opens in a new tab) (MIT).

Concrete hunt: after a suspicious email click, filter Sysmon Event ID 1 for Office spawning cmd.exe, powershell.exe or wscript.exe, then pivot on the parent’s hash.

osquery (opens in a new tab) exposes the host as SQL tables (processes, listening ports, scheduled tasks, chrome extensions). Reach for it for scheduled inventory and low-frequency differential hunts across Linux, macOS and Windows. Licence: Apache-2.0 OR GPL-2.0-only (LICENSE (opens in a new tab)). Official site: osquery.io (opens in a new tab); source: github.com/osquery/osquery (opens in a new tab).

Concrete hunt: daily query for new crontab/launchd/scheduled_tasks rows that point at user-writable paths.

Detection content and testing

Sigma (opens in a new tab) is a vendor-neutral detection rule format. Convert with sigma-cli (opens in a new tab) / pySigma (opens in a new tab) (both LGPL-2.1) into KQL, SPL, EQL and more. SigmaHQ rules use the Detection Rule License (DRL) 1.1; the specification is public domain (repo LICENSE (opens in a new tab)). Our Hunt Lab packs ship Sigma as the source of truth.

Chainsaw (opens in a new tab) (GPL-3.0) and Hayabusa (opens in a new tab) (AGPL-3.0) run Sigma against exported Windows EVTX offline. Reach for them when you have a disk image or a triage zip and no SIEM yet. Chainsaw needs a mapping file (for example --mapping mappings/sigma-event-logs-all.yml). Both are Windows-log oriented; Linux hunts stay out of scope for them.

YARA (opens in a new tab) (BSD-3-Clause, VirusTotal/yara (opens in a new tab)) matches byte and string patterns in files and memory. Reach for it once you have a sample or a webshell family signature. Atomic Red Team (opens in a new tab) (MIT; site atomicredteam.io (opens in a new tab)) gives small, documented ATT&CK tests so you can prove a Sigma rule or Sysmon config actually fires.

Concrete hunt: convert a Hunt Lab rule.yml with sigma-cli, run it in Chainsaw or Hayabusa against a week of EVTX, then validate the true-positive path with one Atomic test on a lab host you control.

Network

Zeek (opens in a new tab) is a network analysis framework that writes structured logs (conn, dns, http, ssl) rather than only alerts. Licence: BSD-style terms in the project COPYING (opens in a new tab). Suricata (opens in a new tab) (GPL-2.0, OISF/suricata (opens in a new tab)) is an IDS/IPS and NSM engine with signature and emerging-threat style rules. Reach for Zeek when you want rich protocol logs to hunt in; reach for Suricata when you also want signature alerts on the same wire.

RITA (opens in a new tab) (Real Intelligence Threat Analytics, GPL-3.0) from Active Countermeasures ingests Zeek logs and scores beaconing, long connections and DNS tunnelling. The GitHub repository is the place to start: it has the install guide and releases.

Concrete hunt: import a day of Zeek conn.log into RITA and review the highest-scoring beacons for hosts that should not phone home on a fixed interval.

Analysis and storage

You need somewhere searchable to put the telemetry. OpenSearch (opensearch.org (opens in a new tab), Apache-2.0 via opensearch-project/OpenSearch (opens in a new tab)) is a fully open-source search and analytics stack. Elasticsearch / Elastic Security self-managed builds are under the Elastic License 2.0 and/or SSPL for much of the stack (LICENSE.txt (opens in a new tab)); Elastic’s subscriptions (opens in a new tab) page describes Free/Basic feature tiers. Read the licence for the exact bits you enable before you redistribute or host multi-tenant.

Wazuh (opens in a new tab) (GPL-2.0 with OpenSSL exception, wazuh/wazuh (opens in a new tab)) bundles agent, manager and rules into an XDR/SIEM-style platform. Timesketch (opens in a new tab) (Apache-2.0, google/timesketch (opens in a new tab)) is for collaborative forensic timelines once you have Plaso or similar output. For a fuller SIEM-oriented comparison see our live piece Free SIEM for small teams: Wazuh, Elastic Security and Security Onion compared.

Concrete hunt: land Sysmon and Zeek into OpenSearch or Wazuh, then load a Hunt Lab Sigma rule converted for your backend and tune it for a week before you alert.

Intel and pivots

Keep this layer thin at first. MISP (opens in a new tab) (AGPL-3.0, MISP/MISP (opens in a new tab)) shares and correlates indicators with other trusted communities. OpenCTI (opens in a new tab) Community Edition (Apache-2.0; Enterprise is separately licensed — see the project LICENSE (opens in a new tab)) models threat actors, campaigns and observables as a knowledge graph. Reach for either when you are drowning in one-off IOCs and need structured pivots, not on day one of building the stack.

Starter stack for a two-person team

Week 1 — see the hosts. Deploy Sysmon with sysmon-modular (or SwiftOnSecurity’s template) on a pilot OU. Stand up osquery on a handful of Linux boxes. Confirm events arrive.
Week 2 — store and search. Send those events to Wazuh or OpenSearch. Convert one Hunt Lab Windows process-creation rule with sigma-cli and run it as a hunt, not an alert.
Week 3 — respond. Add Velociraptor for live follow-up on the same pilot hosts. Keep Friday Jones’s Velociraptor review next to the deploy notes.
Week 4 — the wire. Span or tap a quiet segment into Zeek; feed conn.log to RITA for beacon review. Add Suricata only if you also want signature alerts.
Ongoing — prove detections. Use Atomic Red Team on a lab VLAN you control. Keep YARA for malware and webshell triage. Add MISP or OpenCTI when indicator volume justifies the upkeep.

Skip anything you cannot patch and babysit. A quiet Sysmon + sigma-cli + Velociraptor trio beats an abandoned full stack.

What to do next

Pick one Hunt Lab folder whose README matches telemetry you already have, convert the Sigma rule, and run it as a hunt for seven days. File false positives back via a Hunt Lab issue (opens in a new tab). For the folder layout (Sigma, KQL, SPL), see the Hunt Lab README (opens in a new tab) until the SIEM wiring guide is live.

Use with care. These tools, queries, indicators and scripts are provided as-is, for defensive use on systems you own or are authorised to test. Test and tune them before you use them in production. Indicators age quickly, so check the date and source before you block on one. Nothing here authorises access to systems that aren’t yours. Doing so may be an offence under the Computer Misuse Act 1990. Full terms.

Sources

Official project pages and repository licence files checked on 28 October 2026 (Europe/London).

Follow Cyber-Threat.net RSS Feedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)