// the take
LOKI is a classic IOC/YARA scanner for incident response: it walks the filesystem and running processes looking for matches against YARA rules, known-bad hashes, filename patterns, and C2 IPs. It's aimed at DFIR folks doing a quick triage sweep on a potentially compromised Windows (or Linux/Mac) host.
Combines four independent detection methods (YARA, hash, filename regex, C2 connection matching) in one pass instead of making you run separate tools. Signatures live in a separate `signature-base` submodule, so you can update IOCs without touching code or recompiling. The exclude.cfg regex-based path exclusion and per-run flags (`--intense`, `--maxworkingset`, `--scriptanalysis`) give real control over scan scope and noise on production systems.
Officially deprecated by the author in favor of the closed/freemium THOR Lite and an incomplete Rust rewrite (LOKI2) with no stated timeline for feature parity — if you adopt this today you're building on a dead end. Maintenance is bug-fix-only, so new evasion techniques or file formats won't get coverage. The compiled PyInstaller EXE is flagged by AV engines itself, which is a bad first experience for a tool whose entire job is trust during an incident. No test suite visible beyond a couple of fixture files, so regressions in detection logic for a security-critical tool rely entirely on manual review of PRs.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →