LOKI - Free IOC Scanner

[upnorth]

LOKI is a free and simple IOC scanner, a complete rewrite of main analysis modules of our full featured APT Scanner THOR. IOC stands for " Indicators of Compromise “. These indicators can be derived from published incident reports, forensic analyses or malware sample collections in your Lab. LOKI offers a simple way to scan your systems for known IOCs.

We decided to integrate a lot of webshell rules as even the best Antivirus engines fail to detect most of them. We put almost half of our hacktool rule set into the rule base as well. The IOC signature database is not encrypted or stored in a proprietary format.You can edit the signature database yourself and add your own IOCs. Be advised that attackers may also get access to these rules on the target systems if you use the scanner and leave the package on a compromised system.

GitHub - Neo23x0/Loki: Loki - Simple IOC and YARA Scanner

Loki - Simple IOC and YARA Scanner. Contribute to Neo23x0/Loki development by creating an account on GitHub.

www.nextron-systems.com

GitHub - Neo23x0/Loki: Loki - Simple IOC and YARA Scanner

Loki - Simple IOC and YARA Scanner. Contribute to Neo23x0/Loki development by creating an account on GitHub.

github.com

Support
Professional support is not included.

Please use the issues section on the Github project page to submit bug reports. If you need a professional tool with professional support, choose our APT Scanner THOR.

Disclaimer
You use LOKI on your own risk.

LOKI does not support throttling and no feature to adapt the performance to the actual system resources as our APT Scanner THOR. LOKI does not support AES256 encrypted signature files. Make sure that you completely remove the package from the target system in order to avoid that attackers gain knowledge of the indicators with which you are trying to detect them.

Nextron’s roots go back to the year 2012 when the THOR scanner was created by BSK Consulting GmbH and HvS Consulting AG. In April 2017 both companies decided to concentrate development of THOR along with the development of software for central scan control, remediation and analysis in a joint enterprise named Nextron Systems GmbH.

About Us - Nextron Systems

www.nextron-systems.com

Not to be confused with the Danish company Heimdal Securitys Thor products.

 

[upnorth]

LOKI version 0.30.6

• Upgrade PE-Sieve to v0.2.5

Releases · Neo23x0/Loki

Loki - Simple IOC and YARA Scanner. Contribute to Neo23x0/Loki development by creating an account on GitHub.

github.com

 

[upnorth]

LOKI version 0.31.0

• Integration of YARA rules provided by Reversing Labs
• PE-Sieve upgrade to version 0.2.7.1

Release LOKI version 0.31.0 · Neo23x0/Loki

Integration of YARA rules provided by Reversing Labs PE-Sieve upgrade to version 0.2.7.1

github.com

 

[upnorth]

LOKI version 0.41.0

• build with YARA 4.1.0
• performance improvements (20-35%)
• lower memory usage

Release LOKI version 0.41.0 · Neo23x0/Loki

build with YARA 4.1.0 performance improvements (20-35%) lower memory usage

github.com

 

[upnorth]

LOKI version 0.42.3

• refactor: making the vulnerability check optional

Release LOKI version 0.42.3 · Neo23x0/Loki

refactor: making the vulnerability check optional

github.com

 

[upnorth]

LOKI version 0.44.0

• new command line flags --allhds and --alldrives allow scanning all local hard drives or all drives in general including removable drives and network drives
• You can use --force to force scan a directory that has been excluded by default (e.g. /dev, /media, /mnt etc.)
• The usage description in the README has been updated

Release LOKI version 0.44.0 · Neo23x0/Loki

new command line flags --allhds and --alldrives allow scanning all local hard drives or all drives in general including removable drives and network drives You can use --force to force scan a direc...

github.com

 

[upnorth]

LOKI version 0.45.0

• build with YARA 4.1.3
• PESieve update to v0.3.4

Release LOKI version 0.45.0 · Neo23x0/Loki

build with YARA 4.1.3 PESieve update to v0.3.4

github.com