A simple, self-contained modular host-based IOC scanner built around the YARA pattern matching engine.
Spyre is a simple, self-contained host-based IOC scanner built around the YARA pattern matching engine. It allows incident responders to scan files, processes, and system artifacts for indicators of compromise using customizable YARA rules and other scan modules. The tool is designed for easy deployment and operationalization in security investigations.
Incident responders, security analysts, and forensic investigators who need a lightweight, deployable tool for scanning hosts for signs of compromise during security incidents.
Developers choose Spyre for its simplicity, modularity, and ease of deployment—it can be bundled with rule sets into a single binary, requires minimal dependencies, and is built specifically for operational use in incident response scenarios.
simple YARA-based IOC scanner
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports flexible YARA rule integration via ZIP appending and encrypted archives, simplifying operational use in the field without complex setup.
Can be bundled with all necessary files into a single executable, eliminating dependencies and easing distribution for incident responders.
Targets 32-bit and 64-bit Linux and Windows, with documented build processes for environments like Debian and Fedora, enhancing deployability.
Includes options to lower process priority, minimizing disruption to system performance during scans, as highlighted in the configuration.
Only implements a few scanning modules (YARA-based and some Windows checks), lacking the breadth of more comprehensive forensic tools for diverse IOC detection.
Requires specific packages and setups for building, with no cross-compile support for MacOSX, adding overhead for casual users or diverse environments.
The README notes that report target configuration is likely to change in future releases, indicating potential breaking changes and instability for integrations.