Fenrir
A lightweight Bash script for scanning Linux/Unix/OSX systems for Indicators of Compromise (IOCs) without installation.
What is Fenrir?
Fenrir is a lightweight Bash script designed to scan Linux, Unix, and OSX systems for Indicators of Compromise (IOCs) such as malicious hashes, filenames, strings, and C2 server connections. It solves the problem of performing security scans on diverse systems without installing additional software or agents, using only common system tools.
Security professionals, incident responders, and system administrators who need a portable, dependency-free tool for IOC scanning across multiple Unix-like systems.
Developers choose Fenrir for its zero-installation approach, minimal footprint, and compatibility with any Bash-enabled system, making it ideal for rapid deployment in heterogeneous environments where traditional scanners like THOR or LOKI have dependency issues.
Overview
Simple Bash IOC Scanner
Use Cases
Best For
- Scanning multiple Linux servers without installing agents
- Incident response on systems with restricted software installations
- Lightweight malware detection using hash and string IOCs
- Identifying C2 server connections via lsof analysis
- Forensic investigations with time-based file creation analysis
- Integrating IOC scanning into Ansible-based automation workflows
Not Ideal For
- Environments requiring real-time, continuous IOC monitoring with automated alerting
- Forensic investigations that need detailed evidence logging and chain-of-custody reports
- Teams relying on advanced malware detection using YARA signatures for complex patterns
- Organizations that prefer GUI-based tools or extensive support for non-technical users
Pros & Cons
Pros
Runs as a standalone Bash script without any pre-installed dependencies, leveraging common system tools like grep and md5sum for immediate use on any Bash-enabled system.
Works on any Linux, Unix, or OSX environment with Bash, ensuring compatibility across diverse systems without the need for agent deployment or software installation.
Implements smart exclusions for directories, file sizes, and extensions to speed up scans by skipping irrelevant files, reducing scan time and resource usage.
Includes an Ansible playbook for remote deployment using RAM drives, minimizing footprint on target systems during scans, as highlighted in the README for automation workflows.
Cons
Only supports basic IOC types like hashes and strings, lacking advanced features such as YARA signature support, which limits effectiveness against complex malware variants.
Relies on system utilities like 'stat' which can have varying output across Unix flavors, leading to potential inaccuracies in time-based analysis, as noted in the README's stat issue screenshot.
As a simple Bash script, it may not handle edge cases robustly, and errors might be cryptic, requiring manual troubleshooting, especially since it's marked as 'testing' in the README.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.