Threat Hunting Tools: 13 Picks With Working Queries (2026)

Threat hunting tools are the query languages, endpoint agents, network sensors and intel platforms you use to test a hypothesis against telemetry no alert has flagged. The 13 below cover four layers: Sigma, YARA, KQL and SPL for queries; Velociraptor, osquery and Sysmon for endpoints; Zeek, Suricata, Arkime and Wireshark for network; MISP and VirusTotal for enrichment.

Each entry was rechecked on October 5, 2026 against its own site or repository, and eight of them come with a query, rule or filter you can paste into the tool. The list is grouped by layer, and the hunt loop section near the end shows one hunt moving through all four.

How These 13 Tools Were Picked and Checked

A tool made the list if an analyst can test a hunt hypothesis with it. That leaves out the EDR suites and managed hunting services that fill most commercial "best threat hunting tools" lists, because those are platforms you buy; the consoles tier 1 analysts learn are covered in the EDR guide linked at the end. Every entry was then checked on October 5, 2026 against four questions:

1. Is it still maintained? Latest release and date, from the project's release page or download page.
2. What does it cost to run in a lab? License and free plan from the official site, including the limits in the small print.
3. Where does it sit in the hunt loop? Hypothesis, collection, pivot or encoding.
4. Can it be shown working? Every query, rule and filter below uses field names from the vendor's own documentation. Three were also executed: the Velociraptor query against public Sysmon recordings, the Sigma rule through sigma check and sigma convert, and the YARA-X command against NSA's web shell rules.

Threat Hunting Tools Compared

What Is Threat Hunting and Why Does It Need Its Own Toolkit?

Threat hunting is the practice of proactively searching through telemetry for attacker behavior that has not yet triggered an automated detection. A detection only fires on what someone already wrote a rule for, and attackers who study those rules work around them, so hunters search for behavior instead of known signatures. In most teams the tools below sit at the tier 3 end of the SOC tool stack, after the SIEM and EDR consoles that tier 1 and tier 2 work from.

The toolkit exists because hunting spans multiple data domains at once. You might start with a hypothesis about credential theft derived from a MITRE ATT&CK technique, query endpoint logs for evidence of LSASS access, pivot to network data in Zeek to see where those credentials may have been used, enrich suspicious IPs in MISP, and then encode your finding as a Sigma rule so the next instance gets caught automatically. No single tool covers that full arc. Not every credential-theft hunt starts at LSASS either. Commodity infostealers take the same prize out of browser profile stores, a different file path and a different process, so it needs its own hypothesis.

Query and Detection Layer

This layer is where hypotheses become search queries, and where findings become portable detection rules. Learn it first, because it sits at both ends of the hunt loop.

1. Sigma

Sigma is a vendor-neutral, YAML-based rule format for SIEM detections. You write a rule once and convert it with sigma-cli, which is built on the pySigma library, into Splunk SPL, KQL, Elastic queries, QRadar AQL and the other backends in the pySigma plugin directory. The old sigmac converter in legacy-sigmatools is archived, so a tutorial that still calls it will fail on current rules. The SigmaHQ repository holds more than 3,000 rules. Hunters should start in its rules-threat-hunting folder, whose rules are deliberately broader than alerting rules and meant as the opening query of a hunt.

Best for: Detection engineers, tier-2 and tier-3 analysts who want portable rules that survive platform migrations.

Skip it if: your team runs one SIEM, has no plan to leave it, and nobody reviews rules as code. Writing natively in that SIEM's language is faster.

Skill it builds: Writing platform-independent detection logic; understanding the relationship between log fields and attacker behavior.

Status on October 5, 2026: latest rule release r2026-07-01 (releases) and sigma-cli 3.1.0. The library underneath, pySigma, reached 2.0.0 on October 4, so check that your backends support it before upgrading; the conversions below ran on sigma-cli 3.1.0 with pySigma 1.5.1. The rules are under the Detection Rule License 1.1 and sigma-cli under LGPL-2.1. Free.

Here is a rule for PowerShell started with an encoded command or with remoting cmdlets, two things a hunter wants to see on any host where they are not routine:

title: PowerShell Started With Encoded Command or Remoting Cmdlets
id: c6c8cc48-2eb9-4bc1-9b25-807b066f25e4
status: experimental
description: Detects powershell.exe or pwsh.exe started with an encoded command or with remoting cmdlets on the command line
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - ' -enc'
            - ' -ec '
            - 'New-PSSession'
            - 'Enter-PSSession'
    condition: all of selection_*
falsepositives:
    - Administrative remoting and management agents that pass encoded commands
level: medium
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006

sigma check passes it with no rule or condition errors. sigma convert -t splunk -p splunk_windows turns it into this SPL:

Image IN ("*\\powershell.exe", "*\\pwsh.exe") CommandLine IN ("* -enc*", "* -ec *", "*New-PSSession*", "*Enter-PSSession*")

and sigma convert -t kusto -p microsoft_xdr into KQL for Defender's DeviceProcessEvents table:

DeviceProcessEvents
| where (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains " -enc" or ProcessCommandLine contains " -ec " or ProcessCommandLine contains "New-PSSession" or ProcessCommandLine contains "Enter-PSSession")

The -enc string matches the full -EncodedCommand as well as its short form. PowerShell 7 also documents -e as an alias (about_Pwsh), which the rule leaves out because -e matches too many legitimate command lines. That gap is one more reason not to stop at process creation.

The rule catches the wrapper. -EncodedCommand sits on the command line and the script it carries does not, so the decoded form lands in Event 4104 instead. PowerShell flags script blocks matching its built-in suspicious-construct list at Warning level even where the logging policy was never enabled, which makes a 4104 sweep filtered to LevelDisplayName Warning a cheap opening move across a fleet with uneven coverage.

If you can write Sigma, any hunt can end as a detection that keeps running after you close the ticket, instead of a one-off investigation nobody repeats.

2. YARA and YARA-X

YARA is a pattern-matching engine for identifying and classifying malware files and memory regions. It answers the question "does any file here match the structure of this malware family?" The project is now in maintenance mode: since YARA-X 1.0 was declared stable in June 2025, the original YARA gets bug fixes and security patches only, and new features land in YARA-X, a Rust rewrite with a command-line tool called yr. The YARA documentation still covers the rule syntax both engines share. Community rule sets from Malpedia and YARA-Rules on GitHub (last updated April 2022) are a starting point, not a finished ruleset.

The classic blue-team sweep is a web root: NSA and ASD ship a core and extended ruleset in nsacyber/Mitigating-Web-Shells built specifically to find web shell implants, with the core set tuned for few false positives and the extended set documented as noisy. A hit on the web root only opens the investigation. The access log for the file you just found settles it, because a shell nobody has requested yet is a very different ticket from one with a week of POSTs behind it.

The repository's own example uses classic YARA (yara -r extended.yara.bin /var/www/html/). The same scan with YARA-X and the core rules in source form:

yr scan --recursive core.webshell_detection.yara /var/www/html/

In a check on October 5, 2026, YARA-X 1.21.0 compiled the core ruleset with style warnings and no errors. Point yr at the source .yara file: in the same check it rejected the compiled core.yara.bin as "not a YARA-X compiled rules file", because that file is in classic YARA's format.

Best for: Hunting for specific malware families across disk and memory during endpoint triage; enriching EDR telemetry with file-level pattern matching.

Skip it if: you have no way to reach the files or memory you want to scan. YARA needs the bytes; it cannot work from logs alone.

Skill it builds: Malware structural analysis; understanding file format internals; writing pattern-based signatures from threat reports.

Status on October 5, 2026: YARA 4.5.8 and YARA-X 1.21.0 (YARA-X releases), both BSD-3-Clause and free. New rule projects should target YARA-X.

3. KQL (Microsoft Sentinel / Defender)

KQL (Kusto Query Language) is the query language for Microsoft Sentinel, Defender XDR advanced hunting, and Azure Data Explorer. If your organization runs on Microsoft security tooling, it is the language every hunt there is written in. The official KQL reference covers the operators, and Microsoft's hunting queries repository held 1,425 YAML query files on October 5, 2026. Our KQL tutorial for SOC analysts walks through the operators you use most.

After March 31, 2027, Microsoft Sentinel will only be available in the Microsoft Defender portal, so build new hunting habits there rather than in the Azure portal.

Best for: Hunting across Defender XDR, Sentinel, and Azure logs in environments with a Microsoft-first security stack.

Skip it if: your logs live in Splunk, Elastic or another SIEM. The concepts transfer, but KQL only runs on Microsoft platforms.

Skill it builds: Time-series analysis; behavioral baselining; correlating events across multiple Microsoft data sources in a single query.

Status on October 5, 2026: the language is free to learn. Sentinel and Defender are paid products, but a free Azure Data Explorer cluster needs only a Microsoft account, with no Azure subscription or credit card.

Here is a KQL snippet hunting for source IPs with an unusual spike in failed sign-ins across many accounts, a pattern consistent with password spraying:

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != "0"
| summarize FailedAttempts = count(), DistinctUsers = dcount(UserPrincipalName)
    by IPAddress, bin(TimeGenerated, 1h)
| where FailedAttempts > 50 and DistinctUsers > 10
| order by FailedAttempts desc

ResultType is a string column in the SigninLogs schema, which is why the comparison is against "0" and not the number.

4. Splunk SPL

SPL (Search Processing Language) is the query language for Splunk, and the skill transfers directly to detection engineering, hunting, and incident response work on that platform. Splunk has been part of Cisco since the acquisition closed in March 2024. The old Splunk Fundamentals courses were retired, and Splunk now points newcomers to two free courses, Intro to Splunk and Using Fields, in that order.

Best for: Enterprises running Splunk; analysts who want the most direct path to commercial SIEM familiarity.

Skip it if: you need to ingest more than 500 MB a day in a lab. The free license stops there.

Skill it builds: Log search, statistical analysis, and correlation in a production-scale SIEM; building dashboards and saved searches; writing detection SPL that feeds automated alerting.

Status on October 5, 2026: the Splunk Enterprise 10.6.0.5 download indexes up to 500 MB a day; after 60 days you convert it to a perpetual free license or buy a license to keep the extra features. The SPL in this guide is the Sigma output above and the Sysmon hunt in entry 7.

Endpoint Visibility Layer

Much of the attacker behavior worth hunting happens on the endpoint. These three tools give you process-level, file-level, and system-event-level visibility that SIEM log forwarding alone cannot provide.

5. Velociraptor

Velociraptor is an open source endpoint visibility and digital forensics platform built for hunting at scale. Instead of waiting for telemetry to arrive, Velociraptor lets you send the same VQL (Velociraptor Query Language) question to every enrolled endpoint and collect the answers centrally. A hunt also queues the collection for endpoints that are offline and runs it when they come back, and by default it expires after a week. The official documentation covers VQL; the project is maintained by the Velocidex team.

Best for: Hunting campaigns that need to ask the same question across an entire endpoint fleet; live forensic collection without physically touching machines.

Skip it if: nobody on the team can own a server and an agent rollout.

Skill it builds: Fleet-wide endpoint querying; live forensic artifact collection; building hunt notebooks that other analysts can reuse.

Status on October 5, 2026: version 0.77.3, released the same day (releases), AGPL-3.0, free.

Here is a VQL hunt for processes that opened a handle to LSASS, read straight from the Sysmon log on each host. Sysmon's Event ID 10 is a good candidate for reading on the host instead of forwarding, because Microsoft warns it can generate significant amounts of logging. Velociraptor reads it where it sits:

LET SysmonLog = "C:/Windows/System32/WinEvt/Logs/Microsoft-Windows-Sysmon%4Operational.evtx"
 
SELECT System.TimeCreated.SystemTime AS Time,
       System.Computer AS Host,
       EventData.SourceImage AS SourceImage,
       EventData.GrantedAccess AS GrantedAccess,
       EventData.CallTrace =~ '''dbghelp|dbgcore|comsvcs''' AS DumpDllInStack
FROM parse_evtx(filename=SysmonLog)
WHERE System.EventID.Value = 10
  AND EventData.TargetImage =~ '''\\lsass\.exe$'''
  AND NOT EventData.SourceImage =~ '''\\(MsMpEng|svchost|wmiprvse|csrss|wininit)\.exe$'''

The System.EventID.Value filter and the EventData columns follow the parse_evtx reference, and the log path is the one Velociraptor's own Elastic.EventLogs.Sysmon artifact uses. Triple-quoted strings are raw, so the regex backslashes need no extra escaping, and =~ matches case-insensitively. Test it in a notebook against one client, then save it as a client artifact and launch it as a hunt.

Run with Velociraptor 0.77.3 against four public Sysmon recordings from EVTX-ATTACK-SAMPLES, it returned three rows and correctly skipped a TeamViewer handle and a notepad.exe target:

Read the access masks against Microsoft's process access rights. 0x1fffff is full access, the request a tool makes before writing a dump file, and the dump DLLs show up in the call trace. 0x1010 is PROCESS_QUERY_LIMITED_INFORMATION plus PROCESS_VM_READ: just enough to read memory, which is what mimikatz does live, and its call trace has no dump DLL at all. A hunt that only looks for dbghelp in the stack misses that row. Do not filter out taskmgr.exe because it is signed by Microsoft either: ATT&CK records APT5 using the Task Manager process against LSASS memory.

6. osquery

osquery is a tool that exposes the operating system as a relational database, letting you query running processes, network connections, loaded modules, and file integrity using SQL. Originally built at Facebook, it is now a Linux Foundation project with its own foundation charter. It runs as an agent with scheduled queries and event subscriptions, and a fleet can be managed with Fleet or osctrl. ATT&CK Navigator overlays are a good source of hypotheses to turn into osquery SQL queries. Its table list also covers ground a process-centric hunt misses. chrome_extensions and firefox_addons enumerate what is loaded in every browser across the fleet, which is the practical way to hunt malicious browser extensions at scale: the payload is JavaScript inside the browser's own signed process, so there is no binary for a process rule to catch.

Best for: Lightweight endpoint telemetry collection when a full EDR is not deployed; custom data collection for specific hunt hypotheses; open source environments.

Skip it if: you need forensic collection (memory, raw files, event logs) more than live state. Velociraptor covers that side better.

Skill it builds: SQL-based endpoint querying; understanding OS internals through a structured lens; integrating endpoint data with SIEM pipelines.

Status on October 5, 2026: version 5.23.1 (releases), dual-licensed Apache-2.0 or GPL-2.0, free.

Here is an osquery SQL example hunting for processes that have established outbound network connections to non-standard ports, a common command-and-control pattern. The columns come from the process_open_sockets table spec:

SELECT p.name, p.pid, p.path, p.cmdline, p.parent,
       c.local_address, c.remote_address, c.remote_port, c.state
FROM processes p
JOIN process_open_sockets c ON p.pid = c.pid
WHERE c.state = 'ESTABLISHED'
  AND c.remote_port NOT IN (80, 443, 53, 25, 22)
  AND c.remote_address NOT LIKE '10.%'
  AND c.remote_address NOT LIKE '192.168.%'
ORDER BY p.name;

The private-range filter is deliberately short. Add 172.16.0.0/12 and your own address plan before running it across a fleet, or internal traffic will bury the results.

7. Sysmon

Sysmon (System Monitor) is a Windows system service that logs detailed process creation, network connection, and file creation events to the Windows event log. Event ID 1 carries the parent image and the command line, which is what lets you write a rule for an Office process spawning cmd.exe at all. The Microsoft Sysinternals documentation covers installation and every event ID.

Windows 11 and Windows Server 2025 now include built-in Sysmon as an optional Windows feature, updated through regular Windows updates. It cannot run alongside the standalone Sysinternals version, so uninstall one before enabling the other. Built-in Sysmon also localizes the rendered message text, while the XML event data stays the same in every language, so parse the XML fields rather than the message.

Best for: Enriching Windows endpoint telemetry sent to a SIEM; providing the process-creation, parent-child relationships, and hash data that detection rules depend on.

Skip it if: your EDR already records process, network and file events with parent context and lets you query them. Running both adds volume for little new signal.

Skill it builds: Windows event log architecture; understanding what telemetry is available before writing a detection that depends on it; tuning log volume without losing signal.

Status on October 5, 2026: standalone Sysmon 15.22, published September 10, 2026, for Windows 11 and Windows Server 2019 or later. Free, but closed source. Sysmon for Linux is a separate MIT-licensed project, at version 1.5.3.

Here is an SPL hunt that joins two Sysmon events through their shared ProcessGuid: a process started by Word, Excel, PowerPoint, Outlook or OneNote (Event ID 1) that then opened a network connection (Event ID 3). Sysmon's documentation notes that each network event is linked to its process through ProcessId and ProcessGuid, and the GUID survives the PID reuse that breaks joins on ProcessId:

index=main source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=3) earliest=-7d
| stats values(ParentImage) AS parent values(CommandLine) AS command_line
        values(DestinationIp) AS dest_ip values(DestinationPort) AS dest_port
        BY host ProcessGuid Image
| where isnotnull(dest_ip) AND match(lower(parent), "(winword|excel|powerpnt|outlook|onenote)[.]exe$")

The source matches the WinEventLog://Microsoft-Windows-Sysmon/Operational input of the Splunk Add-on for Sysmon, which uses the XmlWinEventLog source type; change index=main to wherever your Sysmon data lands. Field names are Sysmon's own, the same raw fields Splunk's security content searches on. Event ID 3 is disabled by default, so check your configuration: SwiftOnSecurity's sysmon-config logs network connections for cmd.exe, powershell.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe and regsvr32.exe, the children this hunt cares about. That config has not changed since 2021 (its header says version 74, dated 2021-07-08); sysmon-modular was updated in September 2026 if you want a baseline that moves faster.

Simulated example generated by SOCSimulator Research. A hit looks like this (documentation IP range, reserved .example domain):

host          fin-ws-031
ProcessGuid   {6d1e2b3a-7c41-6702-1a00-000000003f00}
Image         C:\Windows\System32\mshta.exe
parent        C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
command_line  "C:\Windows\System32\mshta.exe" https://cdn-update.example/q.hta
dest_ip       198.51.100.24
dest_port     443

Word starting mshta.exe, and that same process reaching the internet over 443, is a full macro-dropper chain in one row. The next pivot is the destination in your proxy or DNS logs, then a sweep for the same .hta URL on other hosts.

Network Analysis Layer

Endpoint telemetry shows what happened on a machine. Network telemetry shows where that machine talked, for how long, and what it sent. Lateral movement, data exfiltration, and command-and-control activity are often most visible at the network layer.

Often, but not always, and the exception is what tells you which log to open. When an attacker replicates a bucket or shares a disk snapshot into a second account on the same cloud provider, the data never touches a wire you have a sensor on, and ATT&CK gives that its own entry as transfer data to cloud account. That hunt runs against the provider's control-plane log rather than its data-access log, and the field that decides it is who owns the receiving account, which is not something Zeek or Arkime can hand you.

8. Zeek

Zeek (formerly Bro) is an open source network analysis framework that turns raw traffic into structured log files: conn.log for connection metadata, dns.log for DNS queries, http.log for HTTP sessions, and many more. The Zeek project counts more than 70 log files in a default install. With connection records in columns, you spot beaconing and lateral movement by sorting and stacking them instead of reading packets. Security Onion ships Zeek alongside Suricata and the Elastic Stack.

Best for: Network behavior analysis; building baselines for DNS, HTTP, and connection patterns; detecting anomalous protocols and beaconing.

Skip it if: you have no sensor position that sees the traffic you care about, such as east-west traffic inside a flat network or cloud-to-cloud transfers.

Skill it builds: Network protocol analysis; log-based traffic analysis; writing Zeek scripts for custom protocol detection.

Status on October 5, 2026: Zeek 9.0.0 is the current LTS release (get Zeek), BSD-licensed, free.

9. Suricata

Suricata is a high-performance open source intrusion detection and prevention engine maintained by the Open Information Security Foundation (OISF). It speaks the same signature format as Snort, supports the Emerging Threats ruleset, and can operate in inline IPS mode or passive IDS mode from packet captures. Suricata's protocol parsers extract application-layer metadata from TLS, HTTP, DNS, and dozens of other protocols. That metadata is the whole game once a channel is wrapped in TLS, which by now is most of them. You read the handshake instead of the payload, and the fields that survive it, the SNI, the certificate subject and issuer, the JA3 or JA4 fingerprint of the client, are what separate a beacon from a browser. Suricata rules can match a JA4 fingerprint directly with the ja4.hash keyword.

Best for: Signature-based network threat detection; applying community rulesets to network traffic without writing every rule from scratch; network-level coverage in environments where endpoint agents are incomplete.

Skip it if: you want to explore traffic rather than match it. Suricata answers "did this known pattern occur"; Zeek is better for "what is normal here".

Skill it builds: Network intrusion detection; writing and tuning network signatures; understanding protocol behavior and evasion techniques at the packet level.

Status on October 5, 2026: version 8.0.7, released September 15, 2026 (download), GPL-2.0, free.

10. Arkime (formerly Moloch)

Arkime is an open source, large-scale, full packet capture and indexing system. While Zeek and Suricata work from metadata and parsed logs, Arkime stores the actual packet data, giving hunters the ability to reconstruct sessions, extract files from network transfers, and investigate exactly what bytes were sent across the wire. The Arkime project page covers deployment; it is often deployed alongside Zeek in a complementary stack.

Best for: Investigations that require full packet reconstruction; extracting transferred files from network captures; validating hypotheses that network metadata alone cannot confirm.

Skip it if: you cannot afford the storage. At enterprise scale, full packet retention costs far more than the free software.

Skill it builds: Full packet analysis; session reconstruction; understanding when metadata is sufficient versus when you need the raw capture.

Status on October 5, 2026: Arkime 6, at version 6.8.0 released September 30, 2026 (releases), Apache-2.0, free.

11. Wireshark

Wireshark is an open source packet analyzer with a graphical interface for capturing and inspecting network traffic at the individual frame level. Where Zeek produces structured logs and Arkime indexes full PCAP at scale, Wireshark is the analyst's scalpel: you open a specific capture file, filter to the conversation you care about, and inspect the exact bytes exchanged. The Wireshark documentation is thorough, and the project describes its dissectors as covering hundreds of protocols.

Best for: Deep packet inspection during incident response; reconstructing specific sessions from PCAP evidence; validating whether a suspected C2 beacon matches the expected protocol structure.

Skip it if: the capture is larger than you can open on a workstation. Cut it down with Zeek or Arkime first and bring only the conversation you need.

Skill it builds: Protocol-level network forensics; reading hex dumps and reassembled streams; understanding TLS handshake structure, DNS query format, and HTTP/2 framing at the wire level.

Status on October 5, 2026: stable release 4.6.9 (download), GPL-2.0, free on Windows, Linux and macOS.

A display filter for TLS Client Hellos that carry no SNI, the field a client uses to name the site it wants. Both field names are in the TLS display filter reference, which also lists tls.handshake.ja4 if you want to add the column:

tls.handshake.type == 1 && !tls.handshake.extensions_server_name

Use it as a hunt filter. Legitimate clients that connect straight to an IP address also leave SNI out, so sort what remains by destination and source process before reading anything into it.

Intel and Enrichment Layer

Enrichment answers one question about each indicator a hunt turns up: has anyone seen it used maliciously before, and alongside what?

12. MISP

MISP (Malware Information Sharing Platform) is an open source threat intelligence platform for sharing, storing, and correlating indicators of compromise, threat actors, and intelligence reports. Originally developed by CIRCL (Computer Incident Response Center Luxembourg), MISP is built to share threat intelligence under controlled trust models, and CIRCL runs trusted MISP communities that organisations, CERTs and CSIRTs, security researchers and vendors can apply to join. The MISP project documentation covers both deployment and the data model.

Best for: Organizations that share threat intel within a sector ISAC; correlating internal findings against community IOC feeds; enriching hunt hypotheses with structured attacker attribution.

Skip it if: nobody will curate it. A MISP instance fed with every free feed and never pruned produces more false matches than leads.

Skill it builds: Threat intelligence lifecycle management; IOC curation and correlation; understanding threat actor attribution methodology.

Status on October 5, 2026: version 2.5.48, released September 29, 2026 (releases), AGPL-3.0, free.

13. VirusTotal

VirusTotal is a web-based platform that checks files, URLs, IP addresses, and domains against more than 70 antivirus scanners and URL and domain blocklisting services, plus other tools that extract signals from the content. Analysts use it for quick enrichment; threat hunters use the intelligence features for pivoting: given a malicious hash, VirusTotal can show related files, infrastructure, and behavioral indicators that expand a hunt hypothesis into a campaign map.

Best for: Quick enrichment of any indicator found during a hunt; pivoting from a single IOC to related infrastructure; correlating findings against community-observed malicious behavior.

Skip it if: the file might be internal or sensitive. Submitted files and their results are shared with VirusTotal's examining partners, so look up the hash instead of uploading the file.

Skill it builds: IOC enrichment workflows; infrastructure pivoting; reading and interpreting sandbox analysis reports.

Status on October 5, 2026: the free public API allows 500 requests a day at 4 a minute, and its terms forbid use in commercial products or in business workflows that do not contribute new files. That makes it fine for a home lab and a poor fit for automated enrichment in a corporate SOC, which needs the paid premium tier.

The Full Hunt Loop: How These Tools Work Together

The tools above form one workflow. A complete hunt looks like this:

You start with a hypothesis drawn from a threat report, a new ATT&CK technique relevant to your environment, or an anomaly your detection engineering team flagged as uncovered. You formulate a specific, falsifiable question: "Is there evidence of LSASS credential dumping that occurred outside change windows in the past 30 days?"

You query your endpoint telemetry. If Sysmon forwards Event ID 10 to your SIEM, you search it in SPL or KQL for handles opened on lsass.exe. If it does not, you push the Velociraptor query from entry 5 to every Windows host and read the event log where it sits.

You find a candidate host. You pivot to network data in Zeek's conn.log to see whether that host made unusual outbound connections in the same time window. You extract a suspicious domain and enrich it in MISP and VirusTotal to confirm whether it has documented malicious history.

You confirm the behavior is real. You encode your detection in Sigma so it runs as an automated alert going forward, and document the IOCs in MISP for sharing.

How to Build This Skillset Without a Lab Budget

What usually stops people learning these tools is infrastructure: standing up Velociraptor, Zeek, and MISP takes machines, data, and time. A few paths keep the cost low.

Security Onion provides a single deployable that bundles Zeek, Suricata, and the Elastic Stack together. Pick the node type before you size the VM: according to its hardware page, an Import install needs 2 CPU cores, 4 GB of RAM and 100 GB of disk and loads PCAP or EVTX files you already have, while a Standalone install starts at 24 GB of RAM. If you would rather compare lighter options first, our list of open source SIEM tools for a home lab covers them.

The DetectionLab project used to be the shortcut: a Windows Active Directory environment with Sysmon, osquery, and Splunk pre-configured through Vagrant. Its README says it has not been actively maintained since January 1, 2023, so expect broken boxes and outdated versions. Building a domain controller, one Windows endpoint with Sysmon, and Splunk's free license by hand takes longer but gives you a lab that matches current versions.

Velociraptor is the easiest of the endpoint tools to try: its README shows a single velociraptor gui command that starts a server, the web interface and a local client on one machine, and the public EVTX-ATTACK-SAMPLES recordings give you real attack telemetry to point the VQL above at.

For the query layer specifically, Microsoft's free Azure Data Explorer cluster takes your own exported data, and the KQL tutorials run against sample tables on Microsoft's public help cluster, which you sign in to with a Microsoft account. Splunk's Boss of the SOC v3 dataset is free to download and gives you realistic event data to build SPL queries against.

The alert triage skills that precede hunting are covered in the alert triage guide. If you are still mapping the job, what a SOC analyst does at each tier shows where hunting sits. Much of the endpoint telemetry hunts run on comes through an EDR console, so fluency with one of the best EDR tools is a practical prerequisite alongside familiarity with Windows Event IDs.

Hunting rewards analysts who already read alerts fluently. If your triage instincts are still forming, SOCSimulator's operations mode gives you the alert volume and verdict feedback that build the baseline pattern recognition hunting depends on.