Loki-RS is a Rust rewrite of the classic Loki scanner that combines multi-threaded YARA file and process-memory scanning with IOC matching for authorized incident response triage.
| Tool | Neo23x0/Loki-RS — high-performance, multi-threaded YARA and IOC scanner in a single Rust binary |
| Category | Defensive scanner / host-based IOC triage (DFIR) |
| Primary Use | Scanning filesystems, ZIP archives and process memory with YARA rules and IOC lists during authorized incident response |
| Safe Use | Designed for defenders: authorized incident response engagements, internal hunting on systems you own or are contracted to assess, and lab triage |
| Telemetry Note | Purely defensive: it reads files and /proc/<pid>/mem, emits JSONL logs, HTML reports and optional syslog to a collector; leaves scan artifacts on disk but touches nothing remotely |
Loki-RS is Florian Roth's rewrite of the venerable Loki scanner in Rust, packaging YARA-based detection and IOC matching into a single static binary with multi-threaded execution. The original Loki Python scanner became a staple of host triage during incident response, and this rewrite preserves that mission while addressing its two chronic pain points: startup overhead and scan throughput. The project is explicitly marked as Beta — functional but under active development — and the author is candid that it is a side project for practical triage and experimentation, with community best-effort support and no SLA. For teams that need predictable support, the README points to THOR and THOR Lite from Nextron Systems as the commercial-grade successors in the same lineage.
The detection core rests on two pillars: yara-x based YARA scanning of both files and process memory, and IOC matching against MD5, SHA1 and SHA256 hashes, filename regex patterns, and C2 indicators. Scanning is multi-threaded with a configurable thread count — the --threads flag accepts 0 for all cores, -1 for all-minus-one, and defaults to -2, a sensible choice that leaves headroom on production systems. There is also a --cpu-limit percentage cap, and the TUI even lets you adjust it mid-scan with the + and - keys, which is a thoughtful touch for responders scanning a fragile host without taking it down.
Signature sourcing is where Loki-RS shows maturity. It defaults to the YARA Forge Core rule set — high accuracy, low false positives, tuned for performance — and ships signatures with each release while acknowledging they go stale quickly. The companion loki-util update command fetches the latest Core rules, and responders can swap in the Extended or Full YARA Forge sets for broader coverage. Local custom IOC files in signatures/iocs/ remain fully supported, which is essential: almost every real engagement starts with threat-actor-specific hashes and C2 indicators that no public feed contains.
Process memory handling is documented with unusual honesty, which tells you the author has actually run this against real hosts. On Linux, the scanner skips device-backed and kernel-special process mappings before touching /proc/<pid>/mem, deliberately avoiding known instability with some driver-managed VMAs while still reading anonymous, heap/stack and regular file-backed memory. On macOS, process scanning is best-effort: without debugging entitlements or elevated privileges, most process memory is unreadable, and the README suggests --no-procs when you want to skip that phase entirely. This is exactly the kind of platform-specific edge case that plagues triage tooling, and documenting it upfront saves responders an afternoon of debugging.
The smart-filtering defaults are equally operator-minded. Out of the box, Loki-RS excludes /proc, /dev, /sys/kernel/debug, /run, and similar volatile pseudo-filesystems, plus a comprehensive list of cloud-sync directories (OneDrive, Dropbox, Google Drive, iCloud, Box, Nextcloud, MEGA, Seafile, ownCloud) and network mounts (NFS, CIFS/SMB, SSHFS, WebDAV). It also excludes its own directory to avoid recursively scanning itself — a classic YARA scanner footgun. The --scan-all-drives and --scan-all-files flags override these safeguards when an engagement demands full-coverage sweep of a mounted image or collected artifact set.
False-positive management gets first-class treatment, which matters enormously when you are triaging hundreds of endpoints under time pressure. The exclusion system operates at four levels. config/excludes.cfg accepts regex-based path exclusions (comment lines with #, patterns matched against full paths). Hash-based whitelisting works by dropping a file whose name contains both hash and falsepositive into signatures/iocs/, with entries in a HASH;description format. Filename IOCs in filename-iocs.txt support a third-column false-positive regex, so a pattern like (?i)\procdump(64)?\.(exe|zip) scored at 50 can exclude legitimate SysInternals directory hits. Finally, per-file-type and size gating (--max-file-size defaults to 64MB, --yara-timeout to 10 seconds per file or memory buffer) keeps pathological files from stalling a scan.
Output is designed for both the console operator and the SIEM. The default experience is an interactive TUI with real-time statistics, an interrupt menu, a thread overlay toggle (t), pause/resume (p) and item-skip (s) controls. Headless runs use --no-tui for plain command-line output. Machine-readable results land in a JSONL file via -j, and every scan also generates a styled HTML report — color-coded by severity, with file metadata, matched YARA strings and IOC references — sharing the base filename of the JSONL output. Remote forwarding to a syslog collector over UDP or TCP in either syslog or json format (--remote syslog-host.internal:514 --remote-proto udp) turns a fleet of standalone scans into a centralized detection pipeline.
The loki-util companion utility is more than an updater. Its html subcommand can retroactively generate reports from existing JSONL files, including a --combine mode with glob-pattern inputs that aggregates results from multiple hosts or time periods into a single report grouped by hostname. That is a quietly powerful feature for incident coordinators running the scanner across dozens of collected triage packages and needing one consolidated findings view rather than forty separate HTML files.
Scoring follows the Loki tradition of configurable thresholds rather than binary verdicts: --alert-level defaults to 80, --warning-level to 60, --notice-level to 40, and --max-reasons caps displayed match reasons per finding at two. The docs directory includes a dedicated score_calculation.md and a parity_matrix.md tracking feature parity against the original Python Loki — a signal that the rewrite is being managed deliberately rather than as a weekend clone.
Installation is refreshingly simple: pre-compiled binaries on the Releases page, extract with tar -xzvf, run ./loki-util update, then sudo ./loki. Building from source is standard cargo build --release territory requiring only a Rust toolchain, with cross-compilation covered in docs/BUILD.md. Note that sudo is expected, since reading /proc/<pid>/mem and most meaningful filesystem paths requires elevated privileges.
Where does this fit in an authorized workflow? Loki-RS is a first-pass triage tool: you suspect compromise on a host you own or are contracted to assess, you run it, and it surfaces YARA matches and IOC hits with severity scores and evidence. The common scenarios in the README map directly onto real practice — scanning a mounted image offline with --no-procs --folder ~/image1 --threads 0, throttling CPU on a production box with --cpu-limit 60 --threads 1, or forwarding findings to a central syslog during a coordinated hunt. It is a detection tool, not a removal tool; follow-up containment and forensics remain separate steps.
At 358 stars, written in Rust, licensed GPL-3.0 and tagged for dfir, incident-response, iocs, scanner and yara, Loki-RS occupies a useful niche: faster than the Python original, simpler to deploy than a full EDR, and free for teams that cannot justify THOR. The honest beta status and the author's explicit positioning relative to Nextron's commercial offerings actually increase confidence — this is tooling built by someone who knows exactly what host triage requires and where the boundaries of a community-supported project lie.
Neo23x0/Loki-RS.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.