Question 1

What is WraithSec?

Accepted Answer

WraithSec is an open-source security project from OpenSource-For-Freedom. It builds free tools that cover different parts of a defender's surface: WRAITH for Windows threat hunting and triage, Legion for host monitoring on Linux and Windows, and Legion Runner, a GitHub Action that hardens CI/CD pipelines. It also runs threat research tools, KNORR and Git Warden, that hunt malware across container registries and public repositories. Everything is open source and free to run.

Question 2

Why are the tools free?

Accepted Answer

Because capable security shouldn't be rationed by budget. Enterprise detection and response sits behind pricing that locks out the people most exposed: small teams, nonprofits, independent defenders, and under-resourced public institutions. WraithSec exists to put that capability in their hands at no cost, in the open.

Question 3

How is everything licensed?

Accepted Answer

MIT. You can download, run, read, modify, and redistribute any of the tools. Check the LICENSE file in each repository for the exact terms.

Question 4

Do the tools collect telemetry or require an account?

Accepted Answer

No accounts, no telemetry, no analytics. Each tool runs locally on your machine. The only outbound calls are for things you'd expect: pulling public threat-intel feeds for correlation, checking GitHub for updates, and any integrations you explicitly configure. Nothing about your host or your findings is sent to WraithSec.

Question 5

Who is WraithSec for?

Accepted Answer

Individuals, small teams, NGOs and nonprofits, public-sector and national defenders, and anyone who enjoys open-source development. If you need security capability but can't justify enterprise tooling costs, this is built for you.

Question 6

Which tool should I start with?

Accepted Answer

Use WRAITH to hunt and triage on a Windows endpoint, Legion to continuously monitor a Linux or Windows host (packages, connections, files, and drift), and Legion Runner to lock down a GitHub Actions pipeline. For supply-chain threat research, KNORR hunts malicious containers and Git Warden hunts malicious repositories. They're independent, so pick the ones that fit your surface.

Question 7

How do I contribute or report a bug?

Accepted Answer

Everything is on GitHub at github.com/OpenSource-For-Freedom. Open an issue on the relevant repository or send a pull request. Contributions are welcome.

Question 8

What is WRAITH?

Accepted Answer

WRAITH is an open-source Windows threat-hunting and triage tool. You run it on a Windows machine and 18 scan modules sweep the host for the artifacts that matter during an investigation (processes, persistence, YARA hits, rootkits, vulnerable drivers, supply-chain risks, OSINT threat-intel and more), surfacing them in one dashboard ranked by severity, with every finding tagged to its MITRE ATT&CK technique. Beyond detection, it can act: kill live processes, auto-quarantine confirmed threats, and push alerts to your SOC. It runs alongside Windows Defender, not in place of it.

Question 9

What does WRAITH actually do?

Accepted Answer

WRAITH runs 18 scan modules across the host: YARA signatures, behavioral heuristics, persistence mechanisms, process analysis, network connections, event logs, CISA KEV correlation, npm/.NET supply-chain checks, Windows security posture, rootkit indicators, NTFS alternate data streams, credential anomalies, browser artifacts, Defender integration, vulnerable-driver (BYOVD) detection, Tor exit-node correlation, OSINT threat-intel correlation, and a Nessus-style local vulnerability assessment. Findings stream into one dark-themed dashboard ranked by severity, each tagged with its MITRE ATT&CK technique.

Question 10

Can WRAITH take action on threats, or just report them?

Accepted Answer

It can act. Select any finding tied to a live process and hit Kill Process. WRAITH confirms the PID and name before terminating, so there are no silent kills. It also has an auto-quarantine engine that evaluates every finding against a two-gate trust system before any containment: trusted paths (e.g. C:\Windows, Program Files) and files signed by a trusted publisher are always skipped, even at Critical severity.

Question 11

Can it alert my team or SIEM?

Accepted Answer

Yes. WRAITH can push SOC alerts to a Slack or Discord webhook from the running machine, formatted as clean ASCII tables for notification channels. It can also feed Microsoft Sentinel with true-positive event sources, and it runs alongside Windows Defender rather than replacing it.

Question 12

Does WRAITH send my data anywhere?

Accepted Answer

WRAITH does not exfiltrate your host data or phone home with the contents of a scan. It runs locally and the findings stay on your machine. It does make some outbound calls by design: the CISA KEV module queries CISA's live vulnerability catalog, the installer checks GitHub for updates, and only if you configure them, it can push alerts to Slack/Discord webhooks or feed Microsoft Sentinel. The KEV check and update check are the only outbound calls out of the box; the alerting integrations are opt-in.

Question 13

Can I run it without the GUI, and what can it export?

Accepted Answer

Yes. A standalone headless scanner, quick-scan.ps1, runs from PowerShell without building the app, handy for automation or CI (e.g. .\quick-scan.ps1 -Hours 168 -OutPath C:\report.json). From the GUI, findings export to JSON, CSV, or a self-contained HTML report, each including the rule that triggered, the file path or process image, an entropy score, status, and timestamps.

Question 14

What's on the WRAITH roadmap?

Accepted Answer

A commercial Authenticode signing certificate so Windows trusts WRAITH as a known publisher and the SmartScreen prompt goes away. A unified timeline view tying together event log entries, persistence changes, and process activity. Remote collection support for centralized triage. And expanded forensic parsers (prefetch, shimcache, and amcache) for deeper investigations.

Question 15

What Windows versions does it run on, and how do I install it?

Accepted Answer

Windows 10 and 11 (x64). Two paths, same app: for day-to-day use, download WRAITH-win-Setup.exe and run it, the only build with in-app auto-update. For USB kits, air-gapped, or forensic use, download the portable zip, extract it anywhere, and double-click WRAITH.exe. Everything is self-contained: the .NET runtime is bundled, so there's no SDK or Python to install.

Question 16

Why does Windows show a security warning?

Accepted Answer

Windows SmartScreen warns about applications that don't have a commercial code signing certificate. WRAITH doesn't have one yet, not because it's unsafe, but because purchasing a certificate costs hundreds of dollars per year and this is a community project. To run it, click "More info" and then "Run anyway." The warning only appears once for each new download.

Question 17

Why does WRAITH ask for administrator rights?

Accepted Answer

Reading some Windows artifacts requires elevated permissions. Event logs, certain registry keys, and detailed process data are restricted to admin-level access. WRAITH also uses elevation to act on threats when you choose to, such as killing a live process or quarantining a file. It asks for UAC elevation on launch for these reasons.

Question 18

My antivirus flagged WRAITH. Is it safe?

Accepted Answer

Yes. WRAITH reads and inspects the same types of system artifacts that malware sometimes touches, which causes some antivirus tools to flag it as suspicious. It's a false positive. Every line of code is public on GitHub, so you can review it yourself before running anything. If it gets quarantined, you can add an exclusion for the WRAITH folder.

Question 19

What is Legion?

Accepted Answer

Legion is an open-source local security monitor that runs on Linux and Windows. It scans installed packages for CVEs, flags connections to known-malicious IPs, catches typosquatted and vulnerable AI SDK packages, runs continuously-updated YARA rules, and models a heuristic baseline of the host so it can report drift: new processes, new outbound peers, new packages, and fresh YARA hits. It surfaces all of it through a browser dashboard, a CLI, and a terminal TUI.

Question 20

Which operating systems and architectures are supported?

Accepted Answer

Native builds for Linux (x86_64) and Windows (x86_64). It's a single Rust binary with no runtime dependencies, and SQLite is bundled. Grab the archive for your platform from the Legion page, extract, and run.

Question 21

How does Legion keep my machine safe while it runs?

Accepted Answer

By delegating access control to the OS. The web dashboard (legion-web) binds 127.0.0.1 by default, rejects non-loopback Host headers as a DNS-rebinding guard, emits no CORS, sets strict security headers, and rate-limits requests. There's no in-app login. Elevation goes through the native prompt (UAC on Windows, polkit on Linux), and the database, config, and cached rules are created owner-only (0600/0700). Sensitive actions are written to an audit log.

Question 22

Does Legion send data anywhere?

Accepted Answer

No accounts and no telemetry. Legion runs locally and pulls public, no-API-key threat-intel feeds (CISA KEV, ThreatFox, and AbuseIPDB) which it caches and correlates against on the host. Your data stays on your machine.

Question 23

What is Legion Runner?

Accepted Answer

Legion Runner is an open-source GitHub Action that hardens CI/CD runners, both GitHub-hosted and self-hosted. It audits or blocks outbound network traffic, uses an eBPF agent to attribute connections to the exact process that opened them, detects tampering of sensitive files (~/.ssh, ~/.npmrc, .git configs, your source), and supports dynamic DNS-based allowlisting so rotating CDN and cloud endpoints work without hardcoding IPs.

Question 24

How do I add it to a workflow?

Accepted Answer

Drop it in as the first step, before checkout, so the controls are live for the rest of the job. For example: uses: Wraith-security/legion_runner@v1 with egress-policy: block and allowed-presets: cargo. Pinning to the v1 major tag gets you automatic patch updates.

Question 25

What inputs does it take?

Accepted Answer

egress-policy (audit to monitor, or block for deny-by-default), allowed-endpoints (host/port entries permitted in block mode), allowed-presets (curated ecosystem allowlists like npm, pip, cargo), file-integrity (tamper detection for sensitive files), and ebpf (socket-layer capture via the Rust/aya agent). Audit and auto modes are the defaults.

Question 26

What runners does it support?

Accepted Answer

Linux runners with systemd, GitHub-hosted or self-hosted. The action core is pure Node.js with no vendored packages; the eBPF and file-integrity capture agents are Rust binaries fetched on demand, so there are no external services to stand up.

Question 27

What is WraithSec threat research?

Accepted Answer

Two static-analysis tools that hunt malware in the open-source supply chain and never execute it. KNORR is malicious container intelligence for Docker Hub, GHCR, and pre-publish Dockerfiles on GitHub. Git Warden discovers and catalogs malicious GitHub repositories. Both confirm findings on the code's own evidence and can feed OpenSourceMalware.

Question 28

What does KNORR do?

Accepted Answer

KNORR hunts malicious container images across Docker Hub and GHCR in three passes. Discovery sweeps by miner family, campaign signature, and typosquat, and pivots on known-bad publishers. A Tier-1 screen scores an image from its manifest and config alone, with no layer pull. A Tier-2 pass pulls layers and runs Trivy over the SBOM only for the strongest leads. One confirmed image becomes a full owner audit, and nothing is ever executed.

Question 29

What does Git Warden do?

Accepted Answer

Git Warden is a defensive threat-intelligence engine that discovers and confirms malicious GitHub repositories on their own static evidence. Provenance feeds (MITRE ATT&CK, CISA, Google News, and OpenSourceMalware) seed what to hunt. A two-tier static scan, a name and README guard followed by a clone-and-scan with GuardDog and YARA, confirms malice. A confidence tier decides what auto-submits versus what waits for a human, and confirmed repos land on a public Wall of Shame.

Question 30

Are these tools safe to run?

Accepted Answer

Yes. Both are static-analysis only and never execute a target. They read code and metadata, score the signals, and record what is true. They are open source, so you can read exactly what they do before running them.

Question 31

How do they relate to OpenSourceMalware?

Accepted Answer

OpenSourceMalware seeds both tools with targets to check, and high-confidence findings can be submitted back to it, the community threat-intelligence feed, with a human in the loop. See the Sponsors page for more on OpenSourceMalware.

Frequently Asked Questions

About WraithSec

WRAITH: Windows Threat Hunting

WRAITH: Install & Windows Security

Legion: Host Security Monitor

Legion Runner: CI/CD Hardening

Threat Research: KNORR & Git Warden