Any tips for doing a living off the land threat hunt on your own computer?

I'm a threat hunter by day where my my company uses MDR software on clients' computers. This allows us to directly query the device to perform threat hunts to search for newly created files, open sockets, logon events, persistence, etc. I've been doing this for a little bit but it recently occurred to me that I'd have no idea how to do this on a computer without our software installed on it.

So any tips for doing this manually or …

blueteamsec clients computer computers device doing etc events files hunt hunter living off the land logon mdr own persistence query search sockets software threat tips