LOKI
A simple IOC and YARA scanner for detecting malware and security threats via file names, hashes, YARA rules, and C2 connections.
What is LOKI?
Loki is an open-source security scanner that detects Indicators of Compromise (IOCs) on computer systems. It uses multiple detection methods including YARA rules, hash matching, filename regex, and C2 connection checks to identify malware, rootkits, and other security threats. The tool is designed for quick deployment and scanning during security incidents.
Security analysts, incident responders, and forensic investigators who need a lightweight, portable tool for detecting known threats and IOCs on Windows, Linux, and macOS systems.
Developers choose Loki for its simplicity, multi-platform support, and comprehensive IOC detection capabilities without requiring complex setup. It's particularly valued for its extensible signature base and ability to run from removable media during incident response.
Overview
Loki - Simple IOC and YARA Scanner
Use Cases
Best For
- Rapid incident response scanning on potentially compromised systems
- Forensic investigations requiring YARA-based malware detection
- Checking systems against known IOCs during security audits
- Portable security scanning from USB drives or network shares
- Detecting advanced persistent threats (APTs) and rootkits
- Educational purposes for learning about IOC detection methodologies
Not Ideal For
- Organizations requiring actively maintained security tools with regular updates and new features
- Large-scale, automated security operations needing high-speed scanning and seamless SIEM integration
- Teams that prefer graphical interfaces or cloud-based threat detection platforms
Pros & Cons
Pros
Loki runs on Windows, Linux, and macOS with setup instructions provided in the README, making it versatile for diverse incident response environments.
Users can add custom YARA rules, hash IOCs, and filename regexes through the signature-base sub-repository, allowing for tailored threat detection as described in the Signature and IOCs section.
Designed to run from removable media or network shares without complex installation, Loki is ideal for quick scans during security incidents, as highlighted in the 'How-To Run' section.
Combines file name matching, YARA scanning, hash checking, and C2 connection analysis for multi-layered threat detection, detailed in the key features list.
Cons
The project is officially in inactive maintenance mode, with the README stating that no new features are added and recommending alternatives like THOR Lite, limiting long-term viability.
Compared to newer tools like THOR Lite or LOKI-RS, Loki is slower and less stable, with the author admitting THOR Lite is 'faster, more stable, and rigorously tested' in the README.
Building Loki from source requires installing multiple Python dependencies and YARA, which can be error-prone, especially on non-Windows systems, as outlined in the Requirements section.
Frequently Asked Questions
Related Projects
Detect It Easy(DiE)Program for determining types of files for Windows, Linux and MacOS.
capaThe FLARE team's open-source tool to identify capabilities in executable files.
FibratusAdversary tradecraft detection, protection, and hunting
HashCheckHashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.