# Loki

Loki - Simple IOC and YARA Scanner

Repository: https://github.com/Neo23x0/Loki
Canonical: https://ross.abutalabs.com/products/loki
Homepage: https://www.nextron-systems.com/compare-our-scanners/
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: python, yara, signature, scanner, ioc, otx, antivirus, hash, yara-rules, dfir
Last push: 2026-01-12T08:00:47+00:00
Link (homepage): https://www.nextron-systems.com/compare-our-scanners/
Link (site_page): https://www.nextron-systems.com/thor/integrations
Link (site_page): https://www.nextron-systems.com/about

## Health v2 (maintenance only)
Score: 51/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 62, release rhythm 8, longevity 100
- inputs: {"age_days": 4245, "days_push": 233, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3783, forks 614 (observed 2026-08-28T04:08:18.531732+00:00)

## What it is
LOKI is a free, open-source IOC and YARA scanner written in Python for triaging compromised systems. It detects indicators of compromise via filename regexes, YARA rule matches on files and process memory, known malicious hashes, and C2 back-connect checks.

## Use cases
- scan a windows host for indicators of compromise
- run yara rules against files and process memory during incident response
- check files against known malicious md5 sha1 sha256 hashes
- triage a suspect endpoint for apt malware
- detect c2 back connections from running processes
- scan a system from removable media without installing software

## When to choose
- you need a free, portable IOC/YARA triage scanner for DFIR work
- you want to scan offline systems from removable media
- you rely on the open-source signature set of ~4,000 YARA rules

## When to avoid
- you want an actively developed tool - LOKI is deprecated in favor of LOKI RS (Rust) and THOR Lite
- you need eventlog, registry, or autoruns analysis modules
- you require commercial support, JSON output, or syslog integration

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, vulnerability-scanning, search-engine
- domain: security, developer-tools
- platform: windows, python, cli
- tags: yara, ioc-scanner, dfir, incident-response, threat-hunting, compromise-assessment, deprecated, malware-detection, command-line, linux, macos

## Member repositories
- Neo23x0/Loki (main) score 51
- Neo23x0/signature-base (plugin) score 66

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:18.531732+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:27:42.650393+00:00, confidence not recorded.
  - readme: https://github.com/Neo23x0/Loki (fetched 2026-08-28T04:08:18.531732+00:00, sha a529f70e6b54)
  - homepage: https://www.nextron-systems.com/compare-our-scanners/ (fetched 2026-08-29T09:22:25.751890+00:00, sha 776ddf4099e1)
  - site_page: https://www.nextron-systems.com/about (fetched 2026-08-29T09:22:25.761185+00:00, sha 42bb13ed9b16)
  - site_page: https://www.nextron-systems.com/thor/integrations (fetched 2026-08-29T09:22:25.762901+00:00, sha e7a7d160d3e9)
- Data as of 2026-08-30T08:39:29.467469+00:00.