A lightweight Bash script for scanning Linux/Unix/OSX systems for Indicators of Compromise (IOCs) without installation.
Fenrir is a lightweight Bash script designed to scan Linux, Unix, and OSX systems for Indicators of Compromise (IOCs) such as malicious hashes, filenames, strings, and C2 server connections. It solves the problem of performing security scans on diverse systems without installing additional software or agents, using only common system tools.
Security professionals, incident responders, and system administrators who need a portable, dependency-free tool for IOC scanning across multiple Unix-like systems.
Developers choose Fenrir for its zero-installation approach, minimal footprint, and compatibility with any Bash-enabled system, making it ideal for rapid deployment in heterogeneous environments where traditional scanners like THOR or LOKI have dependency issues.
Simple Bash IOC Scanner
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Runs as a standalone Bash script without any pre-installed dependencies, leveraging common system tools like grep and md5sum for immediate use on any Bash-enabled system.
Works on any Linux, Unix, or OSX environment with Bash, ensuring compatibility across diverse systems without the need for agent deployment or software installation.
Implements smart exclusions for directories, file sizes, and extensions to speed up scans by skipping irrelevant files, reducing scan time and resource usage.
Includes an Ansible playbook for remote deployment using RAM drives, minimizing footprint on target systems during scans, as highlighted in the README for automation workflows.
Only supports basic IOC types like hashes and strings, lacking advanced features such as YARA signature support, which limits effectiveness against complex malware variants.
Relies on system utilities like 'stat' which can have varying output across Unix flavors, leading to potential inaccuracies in time-based analysis, as noted in the README's stat issue screenshot.
As a simple Bash script, it may not handle edge cases robustly, and errors might be cryptic, requiring manual troubleshooting, especially since it's marked as 'testing' in the README.