Neo23x0/Loki

Features

• YARA-Based Scanning - Utilizes a specialized YARA rule engine to scan files and process memory for malicious byte sequences and strings.
• Artifact Analyzers - Inspects disk images, memory dumps, and event logs to find traces of stealthy implants.
• Threat Intelligence - Matches filenames, hashes, and signatures against multi-source threat intelligence feeds.
• YARA Rule Execution - Executes YARA rules against files and process memory to identify malicious patterns.
• Persistence Analysis - Extracts autorun entries and registry hives to identify malicious persistence mechanisms across different operating system architectures.
• Persistence Mechanisms - Extracts autorun information to identify unauthorized programs configured for automatic startup.
• Malicious Artifact Identification - Identifies web shells, renamed administration tools, and credential dumpers via behavioral and structural characteristics.
• Compromise Assessments - Scans remote systems and local endpoints for persistence mechanisms, web shells, and unauthorized administrative tools.
• Endpoint Detection and Response - Functions as a scanner for identifying malicious persistence mechanisms and unauthorized tools across remote systems.
• File Hash Verification - Identifies known malicious files by comparing calculated file checksums against threat intelligence databases.
• In-Memory Implant Detectors - Scans for malicious mutexes and named pipes to detect stealthy memory-resident implants.
• Cross-Platform Evidence Scanning - Analyzes disk images, memory dumps, and registry hives to find indicators of compromise.
• Memory Scanners - Inspects active process memory and mutexes to find malicious implants that do not exist as files on disk.
• Remote Endpoint Triage - Deploys scanning logic and gathers evidence from multiple remote systems from a single controller using privileged access.
• Remote Security Scanning - Executes security scans on multiple remote endpoints from a single privileged workstation.
• Digital Forensics and Analysis - Examines disk images, memory dumps, and registry hives to find evidence of attacker tools and stealthy implants.
• System Forensic Analysis - Inspects the filesystem for attacker toolsets and cloaked executables using signatures and hashes.
• System Binary Analysis - Inspects system files for suspicious executable packers and signature issuers to identify hidden threats.
• File Content Signature Matching - Searches the filesystem and active processes for known malware signatures and byte sequences.
• Threat Hunting Workflows - Searches files, memory, and logs for known indicators of compromise and malicious patterns to identify active breaches.
• Threat Intelligence Scanners - Matches system artifacts against known threat feeds to identify malware and hacking tools.
• Forensic - Analyzes process memory and filesystem structures to detect rootkits and other forensic anomalies.
• Raw Registry Hive Parsing - Parses registry hives to detect malicious persistence and unauthorized configuration changes.
• Threat Intelligence Feeds - Imports and applies custom threat feeds and signature sets to detect current and emerging security threats.
• Threat Intelligence Signatures - Enables the loading and integration of user-defined indicators of compromise and encrypted signature sets from threat feeds.
• Compatibility Cache Forensics - Audits the application compatibility cache to find evidence of suspicious programs deleted from disk.
• Threat Indicator Aggregators - Aggregates detection rules from local files, encrypted sets, and remote threat feeds into a unified scanning engine.
• Active Connection Monitors - Monitors active network connections to detect communication with command-and-control servers.
• Endpoint Resource Throttling - Monitors CPU and memory usage in real-time to dynamically limit scan intensity and maintain system stability.
• System Resource Monitors - Tracks real-time memory and hardware usage to dynamically throttle scan execution.
• CPU Usage Limiters - Caps maximum processor usage during scans to prevent system instability and resource contention.
• Windows Event Log Analyzers - Parses Windows event logs to detect malicious activity and known filename indicators.
• Detection and Classification - Host-based scanner for detecting known IOCs.
• Development And Analysis Tools - Python-based IOC and YARA scanner.
• Endpoint Protection - Scanner for indicators of compromise and incident response.
• Forensics - Scanner for indicators of compromise.
• IOC and Malware Scanning - Scanner for incident response and indicator detection.
• Scanner Tools - Endpoint scanner using YARA rules and other indicators.

Star history