Loki is a simple IOC and YARA scanner that detects indicators of compromise across files and processes using multiple detection methods.
The tool addresses the need for straightforward malware detection by combining four core detection approaches: file name IOC regex matching against full paths, YARA signature matching on file data and process memory, hash comparison against known malicious files using MD5, SHA1, and SHA256, and C2 back-connect checking that compares process connection endpoints with known command-and-control IOCs. Additional checks include Regin filesystem detection, process anomaly analysis, SWF decompressed scanning, and SAM dump verification. The scanner produces color-coded results—green, yellow, or red—to indicate detection severity levels.
Developers considering adoption should be aware that this project is officially deprecated and in inactive maintenance mode. The maintainer has shifted focus to THOR, a more advanced commercial scanner with a free THOR Lite version available that offers better performance, stability, and rigorous testing. A Rust-based successor called LOKI 2 is under development but has not yet reached feature parity with the current release. The tool remains suitable for basic IOC scanning on Windows systems and can run from removable media or network shares without installation, though administrative privileges are required for full functionality. The project includes a decision flowchart to help users determine which scanner best fits their needs.
The project receives pull requests for bug fixes and straightforward issues that are merged into the codebase. Development activity is limited to maintenance rather than feature expansion or enhancement of existing capabilities.
