Loki (IOC scanner)

loki.exe -p <path>

Scans a Windows host with Neo23x0's IOC scanner: YARA rules, hashes, and filenames from known APT campaigns.

Run it in the first pass of an IR or during periodic review of suspicious hosts: Loki combines thousands of YARA rules, malware hashes, and filename-based detection against the system (processes, services, startup directories, files), and reports matches with the campaign reference. It's the most widely used open-source IOC scanner — the standard first step when a host 'might be compromised' and you don't know where to start. No installation required: download, run with -p on the path, and in minutes you have the preliminary verdict.

Don't use it as a final verdict: Loki detects known IOCs — an actor with custom or modified tools won't match anything, and the host may still be compromised. The absence of findings is not a clean bill of health. On hosts with lots of content, a full scan takes time and can produce false positives with legitimate software that shares names or strings; review each finding before declaring. And watch out: running the scan on a compromised host alerts the attacker (the process and file scanning are visible) — in IR with suspected active actor, first capture (memory, disks) and then scan.