Scanner for Simple Indicators of Compromise
Detection is based on four detection methods:
Additional Checks:
The Windows binary is compiled with PyInstaller 2.1 and should run as x86 application on both x86 and x64 based systems.
Download the latest version of LOKI from the releases section.
Since version 0.21.0 LOKI includes a separate updater tool named loki-upgrader.exe or loki-upgrader.py.
usage: loki-upgrader.py [-h] [-l log-file] [--sigsonly] [--progonly] [--nolog]
[--debug]
Loki - Upgrader
optional arguments:
-h, --help show this help message and exit
-l log-file Log file
--sigsonly Update the signatures only
--progonly Update the program files only
--nolog Don't write a local log file
--debug Debug outputIt allows to update the compiled loki.exe for Windows and the signature-base sources.
When running loki.exe --update it will create an new upgrader process and exits LOKI in order to replace the loki.exe with the newer one, which would be locked otherwise.
usage: loki.exe [-h] [-p path] [-s kilobyte] [-l log-file] [-r remote-loghost]
[-a alert-level] [-w warning-level] [-n notice-level]
[--printAll] [--allreasons] [--noprocscan] [--nofilescan]
[--scriptanalysis] [--rootkit] [--noindicator] [--reginfs]
[--dontwait] [--intense] [--csv] [--onlyrelevant] [--nolog]
[--update] [--debug]
Loki - Simple IOC Scanner
optional arguments:
-h, --help show this help message and exit
-p path Path to scan
-s kilobyte Maximum file size to check in KB (default 5000 KB)
-l log-file Log file
-r remote-loghost Remote syslog system
-a alert-level Alert score
-w warning-level Warning score
-n notice-level Notice score
--printAll Print all files that are scanned
--allreasons Print all reasons that caused the score
--noprocscan Skip the process scan
--nofilescan Skip the file scan
--scriptanalysis Activate script analysis (beta)
--rootkit Skip the rootkit check
--noindicator Do not show a progress indicator
--reginfs Do check for Regin virtual file system
--dontwait Do not wait on exit
--intense Intense scan mode (also scan unknown file types and all
extensions)
--csv Write CSV log format to STDOUT (machine prcoessing)
--onlyrelevant Only print warnings or alerts
--nolog Don't write a local log file
--update Update the signatures from the "signature-base" sub
repository
--debug Debug outputNo requirements if you use the pre-compiled executables in the release section of this repo.
If you want to build LOKI yourself:
c:\Python27[-x64]\python.exe -m pip install --upgrade pip
pip.exe install psutil netaddr wmi colorama pylzma pycrypto yara-python pywin32 rfc5424-logging-handler setuptools==19.2 pyinstaller==2.1LOKI can be packaged with a custom encrypted rule set, which is embedded in the pyinstaller package.
In order to include your own rules place them in a directory named private-signatures in the LOKI directory and execute build.bat.
loki/
├── private-signatures/ <-- YARA rules places in here will by added to loki.exe
├── signature-base/ <-- clear text and still required (retrieved by loki-upgrader.exe)
│ ├── iocs/
│ ├── yara/In order to successfully run the build script, you need to install PyInstaller. We use PyInstaller 2.1 due the problem that Packages build with PyInstaller 3 don't run on Windows 2003 and XP based systems. (yes, we need that in incident response - there are even productive systems out there running Windows 2000 or Windows NT)
The easiest way to do install PyInstaller is:
pip install pyinstaller==2.1After that, you can just run the build script.
build.batYou can verify whether the signature set is valid by calling loki-package-builder.py manually.
C:\Python27[-x64]\python.exe loki-package-builder.py --ruledir signatures --target rulesThe usage of this tool is:
usage: loki-package-builder.py [-h] --ruledir RULEDIR --target TARGET
Package builder for Loki
optional arguments:
-h, --help show this help message and exit
--ruledir RULEDIR directory containing the rules to build into Loki
--target TARGET target where to store the compiled rulesetSince version 0.15 the Yara signatures reside in the sub-repository signature-base. You can just download the LOKI release ZIP archive and run LOKI once to download the 'signature-base' sub repository with all the signatures. Since version 0.21.0 a separate updater is provided as loki-upgrader.exe or loki-upgrader.py. LOKI expects the IOCs and signatures of the signature-base repo in a subfolder named signature-base.
The IOC files for hashes and filenames are stored in the './signature-base/iocs' folder. All '.yar' files placed in the './signature-base/yara' folder will be initialized together with the rule set that is already included. Use the 'score' value to define the level of the message upon a signature match.
You can add hash, c2 and filename IOCs by adding files to the './signature-base/iocs' subfolder. All hash IOCs and filename IOC files must be in the format used by LOKI (see the default files). The files must have the strings "hash", "filename" or "c2" in their name to get pulled during initialization.
For Hash IOCs (divided by newline; hash type is detected automatically)
Hash;Description [Reference]For Filename IOCs (divided by newline)
# Description [Reference]
Regex;Score;False Positive RegexYou can user the following external variables in the YARA rules that your provide LOKI
filename - e.g. condition: $s1 and not filename == 'nmap.exe'
filepatch - e.g. condition: filepath == 'C:\Windows\cmd.exe'
extension - e.g. condition: uint32(0) == 0x5a4d and extension == ".txt"
filetype - eg. condition: extension == ".txt" and filetype == "EXE"
(see file-type-signatures.cfg in signature-base repo for all detected file types)
md5 - legacy valueSince version v0.16.2 LOKI supports the definition of user-defined excludes via "excludes.cfg" in the new "./config" folder. Each line represents a regular expression thats gets applied to the full file path during the directory walk. This way you can exclude certain directories regardless of their drive name, file extensions in certain folders and all files and directories that belong to a product that is sensitive to antivirus scanning.
The '''exclude.cfg''' looks like this:
# Excluded directories
#
# - add directories you want to exclude from the scan
# - double escape back slashes
# - values are case-insensitive
# - remember to use back slashes on Windows and slashes on Linux / Unix / OSX
# - each line contains a regex that matches somewhere in the full path (case insensitive)
# e.g.:
# Regex: \\System32\\
# Matches C:\Windows\System32\cmd.exe
#
# Regex: /var/log/[^/]+\.log
# Matches: /var/log/test.log
# Not Matches: /var/log/test.gz
#
# Useful examples
\\Ntfrs\\
\\Ntds\\
\\EDB[^\.]+\.log
Sysvol\\Staging\\Nntfrs_cmp
\\System Volume Information\\DFSRSince version 0.26 LOKI integrates @hasherezade's great tool PE-Sieve to detect process anomalies.
The tool is initialized if LOKI finds it in the ./tools sub folder during startup.
Since version v0.10 LOKI includes various threat intel receivers using the public APIs of these services to retrieve and store the IOCs in a format that LOKI understands. It is no problem if these indicators overlap with the ones already included. Loki uses a filename regex or hash only once. (no preformance impact)
The threat intel receivers have also been moved to the signature-base sub repository with version 0.15 and can be found in "./signature-base/threatintel".
Provide your API key via -k APIKEY or set it in the script header.
It's a simple script that downloads your subscribed events/iocs from Alienvault OTX and stores them in the correct format in the './iocs' subfolder. The script is located in the "./threatintel" folder and is named "get-otx-iocs.py". (see requirements above)
usage: get-otx-iocs.py [-h] [-k APIKEY] [-o dir] [--verifycert] [--debug]
OTX IOC Receiver
optional arguments:
-h, --help show this help message and exit
-k APIKEY OTX API key
-o dir Output directory
--verifycert Verify the server certificate
--debug Debug outputA simple script that downloads your subscribed events/iocs from a custom MISP instance and stores them in the correct format in the './iocs' subfolder. YARA rules stored in MISP will be written to the './iocs/yara' subfolder and automatically initialized during startup. The script is located in the "./threatintel" folder and is named "get-misp-iocs.py". (see requirements above)
usage: get-misp-iocs.py [-h] [-u URL] [-k APIKEY] [-l tframe] [-o dir]
[-y yara-dir] [--verifycert] [--debug]
MISP IOC Receiver
optional arguments:
-h, --help show this help message and exit
-u URL MISP URL
-k APIKEY MISP API key
-l tframe Time frame (e.g. 2d, 12h - default=30d)
-o dir Output directory
-y yara-dir YARA rule output directory
--verifycert Verify the server certificate
--debug Debug outputLoki Scan
Command Line Scan Output
Hash based IOCs
File Name based IOCs
Generated log file
LOKI scanner on our company homepage https://www.nextron-systems.com/loki/
Twitter @cyb3rOps @thor_scanner
If you are interested in a corporate solution for APT scanning, check out Loki's big brother THOR.
Download PyInstaller v2.1, switch to the pyinstaller program directory and execute:
python ./pyinstaller.py -F C:\path\to\loki.pyThis will create a loki.exe in the subfolder ./loki/dist.
To include the msvcr100.dll to improve the target os compatibility change the line in the file ./loki/loki.spec that contains a.bianries, to the following:
a.binaries + [('msvcr100.dll', 'C:\Windows\System32\msvcr100.dll', 'BINARY')],yara-pythonpython setup.py installsudo pip install colorama gitpython, netaddr, pylzma etc...While LOKI is the only open source scanner in our scanner line up and a purely private project, you may also be interested in our new free scanner SPARK Core, which isn't open source but pre-compiled for Windows, Linux and macOS.
The compiled scanner may be detected by antivirus engines. This is caused by the fact that the scanner is a compiled python script that implement some file system and process scanning features that are also used in compiled malware code.
If you don't trust the compiled executable, please compile it yourself.
Loki - Simple IOC Scanner Copyright (c) 2015 Florian Roth
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/
Please note that all signatures and IOC files in the signature-base repository, except the YARA rules created by 3rd parties, are licensed under the Creative Commons Attribution-NonCommercial 4.0 International License.