Threat Hunting on a Budget: A Starter Kit for Small Teams

Threat hunting sounds like something only a funded security team does. It is not. Hunting is a method: you look at a machine, ask a few pointed questions, and follow the answers. The method is free. The tools that answer the questions can be free too.

You do not need a security operations center or a stack of licenses to begin. You need a routine and a short list of tools. Here is a starter kit that a team of one can run.

The four questions

A good hunt on a single host comes down to four questions. Answer them in order and you will surface most of what matters.

• What is running right now? Unexpected processes, odd parent and child relationships, binaries executing from strange paths.
• What is set to persist? Registry run keys, scheduled tasks, services, and startup entries that survive a reboot.
• What changed on this host? New outbound connections, new packages, new files where they should not be.
• What deserves attention first? Rank by severity so you spend your time on the two findings that matter, not the two hundred that do not.

The free toolkit

• WRAITH on Windows.It answers all four questions in one pass. Eighteen scan modules cover processes, persistence, event logs, YARA, rootkits, and more, then rank findings from critical to informational and tag each with its MITRE ATT&CK technique. That last part matters: it turns a raw finding into something you can look up and reason about.
• Legion on Linux and Windows. It captures a baseline of a host and reports drift on later runs, so you can see what is new since last week. It also checks packages for known vulnerabilities and flags connections to known-bad addresses.
• Public threat intel. Both tools correlate against free feeds like the CISA Known Exploited Vulnerabilities catalog and abuse.ch ThreatFox, so a finding can be checked against what the wider community already knows is bad.

A starter workflow

1. Baseline first. Run the tools on a host you believe is clean. This teaches you what normal looks like, so anomalies stand out later.
2. Scan. Run a full sweep. On Windows, WRAITH collects everything in one go.
3. Triage by severity. Start at the top. A critical YARA hit or a process making an unexpected outbound connection is where you look first.
4. Pivot. When something looks wrong, follow it. Which process opened that connection? What put that scheduled task there?
5. Act and record. Kill or quarantine what is confirmed bad, and export the findings so you have a record and a starting point next time.

Make it a habit

The single most valuable thing you can do is turn this into a routine. A short hunt once a week, on your most important machines, will catch more than an expensive platform that nobody logs into. Consistency beats capability here. Free tools plus a standing habit is a real program.

The goal is not to look busy. It is to know, quickly, whether a machine can be trusted. That is a skill, and it starts with one scan.