Loki

Health v2 · maintenance only

Adoption not part of the score

3783 stars · 614 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

LOKI is a free, open-source IOC and YARA scanner written in Python for triaging compromised systems. It detects indicators of compromise via filename regexes, YARA rule matches on files and process memory, known malicious hashes, and C2 back-connect checks.

Use cases

• scan a windows host for indicators of compromise
• run yara rules against files and process memory during incident response
• check files against known malicious md5 sha1 sha256 hashes
• triage a suspect endpoint for apt malware
• detect c2 back connections from running processes
• scan a system from removable media without installing software

When to choose

• you need a free, portable IOC/YARA triage scanner for DFIR work
• you want to scan offline systems from removable media
• you rely on the open-source signature set of ~4,000 YARA rules

When to avoid

• you want an actively developed tool - LOKI is deprecated in favor of LOKI RS (Rust) and THOR Lite
• you need eventlog, registry, or autoruns analysis modules
• you require commercial support, JSON output, or syslog integration

Facets

cli-tool · maturity maintenance

security vulnerability-scanning search-engine security developer-tools windows python cli yara ioc-scanner dfir incident-response threat-hunting compromise-assessment deprecated malware-detection command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Neo23x0/Loki")