security enabled verified medium v1.0.0

loki

IOC (Indicator of Compromise) scanner that checks files and systems against threat intelligence feeds and YARA rules for malware detection.

📋 Live Preview

python3 loki.py {flag-yara} {flag-rules} {flag-ioc} {flag-score} {flag-output} {flag-format} {flag-nobeeps} {flag-no-progress} {flag-verbose} -p {path}

📎 flag-yara 📎 flag-rules 📎 flag-ioc 📎 flag-score 📎 flag-output 📎 flag-format 📎 flag-nobeeps 📎 flag-no-progress 📎 flag-verbose 📎 path

python3 loki.py {flag-yara} {flag-rules} {flag-ioc} {flag-score} {flag-output} {flag-format} {flag-nobeeps} {flag-no-progress} {flag-verbose} -p {path}

Sandbox: execFile · Timeout: 600s

Capabilities

ioc.scan.file

ioc.scan.system

ioc.detect.malware

ioc.yara.match

ioc.threat-intel

Parameters

Name	Type	Required	Default	Description	Aliases
`path`	string	Yes	-	Path to scan (file or directory)	`-p`, `--path`
`flag-rules`	string	No	-	Path to custom rules directory	`-r`, `--rules`
`flag-yara`	string	No	-	YARA rule file or directory	`-y`, `--yara-rules`
`flag-ioc`	string	No	-	IOC checkbox file	`--ioc`
`flag-score`	integer	No	-	Minimum score threshold	`-s`, `--score`
`flag-output`	string	No	-	Output file path	`-o`, `--output`
`flag-format`	string	No	-	Output format (text, json, syslog)	`-f`, `--format`
`flag-nobeeps`	boolean	No	-	Disable beep on alert	`--nobeeps`
`flag-no-progress`	boolean	No	-	Disable progress bar	`--no-progress`
`flag-verbose`	boolean	No	-	Verbose output	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`ioc.scan.report`	IOC scan results	text/plain	-	verified
`ioc.scan.json`	JSON format scan results	application/json	-	verified

Contract

Inputs

file.path

Path to scan (file or directory)

ioc.rules

Path to IOC rules or YARA rules

Outputs

ioc.scan.report

Scan results with matched IOCs

ioc.scan.json

JSON format findings

Side effects:

Workflow Edges

Produces

ioc.scan.reportioc.scan.json

Consumes

file.pathioc.rules

Resource Profile

Resource	Value
CPU	medium
Memory	256 MB
Network	low
Disk I/O	medium

Examples

Basic scan with default rules

python3 loki.py -p /path/to/scan

Scan with custom YARA rules

python3 loki.py -p /path/to/scan -y rules.yar

Scan with custom IOC rules

python3 loki.py -p /path/to/scan -r /path/to/ioc-rules

JSON output with score threshold

python3 loki.py -p /path/to/scan -s 100 -f json -o results.json

Documentation

Loki — IOC Scanner

Loki is an IOC (Indicator of Compromise) scanner that checks files and systems against threat intelligence feeds, YARA rules, and other IOC sources. It's designed for incident response and malware detection.

Usage

# Basic scan
python3 loki.py -p /path/to/scan

# With custom YARA rules
python3 loki.py -p /path/to/scan -y rules.yar

# With custom IOC rules directory
python3 loki.py -p /path/to/scan -r /path/to/ioc-rules

# JSON output with minimum score
python3 loki.py -p /path/to/scan -s 100 -f json -o results.json

Dependencies

python3

Related Tools

yaragrepthreatstream

References

Loki IOC Scanner GitHub