Loki alternatives

Looking for an alternative tool to replace Loki? During the review of Loki we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. LMD (malware detection tool)
  2. Malice (VirusTotal clone)
  3. Malscan (malware scanner for web servers)

These tools are ranked as the best alternatives to Loki.

Alternatives (by score)

74

LMD

Introduction

LMD uses MD5 file hashes and HEX pattern matches to define the malware signatures. These are used to detect malware.

Project details

LMD is written in shell script.

Strengths and weaknesses

  • + The source code of this software is available

    Typical usage

    • Malware scanning

    LMD review

    60

    Malice

    Introduction

    Malice is a malware analysis that wants to provide a free and open source version of VirusTotal. The goal of Malice is to make it usable by both independent researchers up to fortune 500 companies.

    Malice is useful for those that do malware analysis or deal with user-generated files that may contain malware. The framework allows scanning files and directories to see if they are infected.

    Project details

    Malice is written in Golang.

    Strengths and weaknesses

    • + More than 500 GitHub stars
    • + The source code of this software is available

      Typical usage

      • Malware analysis
      • Malware detection
      • Malware research
      • Malware scanning

      Malice review

      74

      Malscan

      Introduction

      Malscan is a tool to scan for malicious software (malware) such as viruses, worms, and backdoors. Its goal is to extend ClamAV with more scanning modes and signatures. It targets web servers running Linux, but can also be used on mail servers and desktops.

      Project details

      Malscan is written in shell script.

      Strengths and weaknesses

      • + Used language is shell script
      • + The source code of this software is available

        Typical usage

        • Malware protection
        • Malware scanning

        Malscan review

        85

        Maltrail

        Introduction

        Maltrail monitors for traffic on the network that might indicate system compromise or other bad behavior. It is great for intrusion detection and monitoring.

        Project details

        Maltrail is written in Python.

        Strengths and weaknesses

        • + More than 10 contributors
        • + More than 3000 GitHub stars
        • + The source code of this software is available

          Typical usage

          • Intrusion detection
          • Network analysis
          • Security monitoring

          Maltrail review

          60

          MultiScanner

          Introduction

          MultiScanner helps malware analysts by providing a toolkit to perform both automated and manual analysis. The data extracted from the analysis can be easily stored together, including the relevant metadata and samples. It allows enriching the data further by retrieving information from external resources.

          Project details

          Strengths and weaknesses

          • + More than 10 contributors
          • + The source code of this software is available

            Typical usage

            • Malware analysis
            • Malware detection
            • Malware scanning

            MultiScanner review

            59

            Rootkit Hunter (rkhunter)

            Introduction

            Rootkit Hunter is a small utility to find suspicious rootkit components. Other known backdoors or malicious software can also be discovered, especially if it has the goal to hide.

            The tool uses different ways to hunt, like using predefined directory locations and comparing the output of system utilities. Another method is by requesting a specific output and see if this output is altered, therefore tricking rootkits to reveal themselves.

            Project details

            Rootkit Hunter is written in shell script.

            Strengths and weaknesses

            • + Used language is shell script
            • + Project is mature (10+ years)
            • + The source code of this software is available

              Typical usage

              • Malware detection
              • Malware scanning

              Rootkit Hunter review

              64

              rastrea2r

              Introduction

              Rastrea2r is a threat hunting utility for indicators of compromise (IOC). It is named after the Spanish word rastreador, which means hunter. This multi-platform open source tool helps incident responders and SOC analysts to triage suspected systems. The hunt for IOCs can be achieved in just a matter of a few minutes.

              Project details

              100

              ClamAV

              Introduction

              ClamAV is a popular tool to detect malicious software or malware. While it calls itself an antivirus engine, it probably won't encounter many viruses, as they have become rare. It is more likely to find other forms of malware like worms, backdoors, and ransomware. ClamAV can be used in a few ways, from doing an occasional scan up to scanning in batch. ClamAV does not do on-access scanning but can be combined with other tools to obtain similar functionality. ClamAV is often used to support scanning incoming emails for malicious content.

              Project details

              ClamAV is written in C.

              Strengths and weaknesses

              • + Many maintainers
              • + The source code of this software is available

                Typical usage

                • Malware analysis
                • Malware detection
                • Malware scanning

                ClamAV review

                96

                YARA

                Introduction

                YARA is a tool to identify and classify malware samples. It uses textual or binary patterns to match data, combined with a boolean expression to define a match. YARA is multi-platform, can be used via a command-line interface or via Python scripts using the yara-python extension.

                Project details

                YARA is written in C.

                Strengths and weaknesses

                • + More than 50 contributors
                • + More than 2000 GitHub stars
                • + The source code of this software is available

                  Typical usage

                  • Malware analysis
                  • Malware detection
                  • Malware scanning

                  YARA review

                  59

                  chkrootkit

                  Introduction

                  The chkrootkit tool consists of multiple parts that may detect the presence of rootkit parts of rootkit behavior on a system.

                  Some areas that are checked include:

                  • interface in promiscuous mode
                  • lastlog deletions
                  • wtmp deletions
                  • wtmpx deletions
                  • signs of LKM trojans
                  • utmp deletions

                  Project details

                  chkrootkit is written in C, shell script.

                  Strengths and weaknesses

                  • + Used language is shell script
                  • + Project is mature (10+ years)
                  • - Long time between releases

                  Typical usage

                  • Malware detection
                  • Malware scanning

                  chkrootkit review

                  93

                  GRR Rapid Response

                  Introduction

                  The goal of the GRR tooling is to support digital forensics and investigations. By using a fast and scalable model, analysts can quickly perform their analysis. One of the main features is the ability to search for particular information or details. This process is called hunting.

                  Project details

                  GRR Rapid Response is written in Python.

                  Strengths and weaknesses

                  • + More than 25 contributors
                  • + More than 3000 GitHub stars
                  • + The source code of this software is available
                  • + Supported by a large company

                    Typical usage

                    • Digital forensics
                    • Intrusion detection
                    • Threat hunting

                    GRR Rapid Response review

                    60

                    Dagda

                    Introduction

                    The main reasons to use Dagda is the detection of vulnerable or malicious components within your containerized environment.

                    Project details

                    Dagda is written in Python.

                    Strengths and weaknesses

                    • + The source code of this software is available

                      Typical usage

                      • Malware detection
                      • Malware scanning
                      • Vulnerability management
                      • Vulnerability scanning

                      Dagda review

                      64

                      Bitscout

                      Introduction

                      Bitscout contains a set of popular tools to acquire and analyze disk images onsite. It saves engineers from traveling to the physical location. In other words, it is providing the option to do remote forensics. The project claims that everything is correctly implemented when it comes to digital forensics. One of these requirements is that no data is altered. For example, the remote security professional can obtain a disk image clone, but not alter the machine state.

                      Project details

                      Bitscout is written in shell script.

                      Strengths and weaknesses

                      • + Used language is shell script
                      • + The source code of this software is available

                        Typical usage

                        • Digital forensics

                        Bitscout review

                        85

                        FIR (Fast Incident Response)

                        Introduction

                        FIR is an incident response tool written in the Django framework. It provides a web interface to deal with the creation and management of security-related incidents.

                        Project details

                        Strengths and weaknesses

                        • + More than 10 contributors
                        • + The source code of this software is available

                          Typical usage

                          • Incident response
                          • Security monitoring

                          FIR review

                          60

                          LogonTracer

                          Introduction

                          LogonTracer is a tool to investigate malicious logins from Windows event logs with visualization capabilities.

                          Project details

                          LogonTracer is written in Python.

                          Strengths and weaknesses

                          • + More than 500 contributors
                          • + The source code of this software is available

                            Typical usage

                            • Criminal investigations
                            • Digital forensics
                            • Learning

                            LogonTracer review

                            74

                            MIG (Mozilla InvestiGator)

                            Introduction

                            MIG provides a platform to perform investigative analysis on remote systems. By using the right queries, information can be obtained from these systems. This all happens in parallel, making intrusion detection, investigation, and follow-up easier.

                            Project details

                            Strengths and weaknesses

                            • + More than 25 contributors
                            • + More than 1000 GitHub stars
                            • + The source code of this software is available
                            • + Supported by a large company

                              Typical usage

                              • Digital forensics
                              • Intrusion detection

                              MIG review

                              74

                              The Sleuth Kit

                              Introduction

                              The Sleuth Kit is a forensics tool to analyze volume and file system data on disk images. With its modular design, it can be used to carve out the right data, find evidence, and use it for digital forensics.

                              Project details

                              The Sleuth Kit is written in C.

                              Strengths and weaknesses

                              • + More than 50 contributors
                              • + More than 1000 GitHub stars
                              • + The source code of this software is available
                              • + Well-known tool

                                Typical usage

                                • Criminal investigations
                                • Digital forensics
                                • File system analysis

                                The Sleuth Kit review

                                74

                                Volatility

                                Introduction

                                Volatility is a well-known tool to analyze memory dumps. Interesting about this project is that the founders of this project decided to create a foundation around the project. This foundation is an independent 501(c) (3) non-profit organization that maintains and promotes open source memory forensics with The Volatility Framework.

                                Project details

                                Volatility is written in Python.

                                Strengths and weaknesses

                                • + More than 2000 GitHub stars
                                • + The source code of this software is available
                                • + Project is supported by a foundation

                                  Typical usage

                                  • Digital forensics

                                  Volatility review

                                  64

                                  dfis (Digital Forensic Investigative Scripts)

                                  Introduction

                                  This toolkit of scripts are made by Hal to help in forensic assignments. They make several parts of the job easier, like converting data to another format for further processing.

                                  Project details

                                  dfis is written in Perl.

                                  Strengths and weaknesses

                                  • + The source code of this software is available
                                  • + Well-known author
                                  • - No updates for a while

                                  Typical usage

                                  • Digital forensics

                                  dfis review

                                  60

                                  libewf

                                  Introduction

                                  The libewf toolkit is useful for those who need to create a disk image or perform disk forensics.

                                  Project details

                                  libewf is written in C.

                                  Strengths and weaknesses

                                  • + The source code of this software is available

                                    Typical usage

                                    • Digital forensics

                                    libewf review

                                    89

                                    r2frida

                                    Introduction

                                    Both Radare2 and Frida have their own area of expertise. This project combines both, to allow a more extensive analysis of files and processes.

                                    Project details

                                    r2frida is written in C, JavaScript.

                                    Strengths and weaknesses

                                    • + The source code of this software is available

                                      Typical usage

                                      • Application testing
                                      • Binary analysis
                                      • Memory analysis

                                      r2frida review

                                      78

                                      radare2

                                      Introduction

                                      Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.

                                      Project details

                                      radare2 is written in C.

                                      Strengths and weaknesses

                                      • + More than 500 contributors
                                      • + More than 8000 GitHub stars
                                      • + Many releases available
                                      • + The source code of this software is available

                                        Typical usage

                                        • Digital forensics
                                        • Reverse engineering
                                        • Software exploitation
                                        • Troubleshooting

                                        radare2 review

                                        60

                                        shellbags

                                        Introduction

                                        Typically this tool will be used to gather information from a compromised system or to track traces from a system to find evidence. Shellbags can provide some insight on browsed directories on the system via Explorer on Microsoft Windows systems.

                                        Project details

                                        shellbags is written in Python.

                                        Strengths and weaknesses

                                        • + The source code of this software is available

                                          Typical usage

                                          • Digital forensics

                                          shellbags review

                                          100

                                          TheHive

                                          Introduction

                                          TheHive is scalable and a complete platform to deal with security incidents. It allows for collaboration between those responsible for dealing with such incidents and related events. It can even use the data of the MISP project, making it easier to start analyzing from there.

                                          Project details

                                          TheHive is written in Scala.

                                          Strengths and weaknesses

                                          • + More than 10 contributors
                                          • + More than 500 GitHub stars
                                          • + The source code of this software is available

                                            Typical usage

                                            • Digital forensics
                                            • Incident response
                                            • Intrusion detection

                                            TheHive review

                                            100

                                            Acra

                                            Introduction

                                            Acra is a database encryption proxy that provides encryption and data leakage prevention to applications. It provides selective encryption, access control, database and data leak prevention, and even intrusion detection capabilities. It is focused on developers and supports most popular programming languages such as Go, PHP, Python, Ruby.

                                            Project details

                                            Acra is written in Golang, Node.js, Objective-C, PHP, Python, Ruby.

                                            Strengths and weaknesses

                                            • + Commercial support available
                                            • + The source code of this software is available

                                              Typical usage

                                              • Data encryption
                                              • Data leak prevention
                                              • Data security
                                              • Vulnerability mitigation

                                              Acra review

                                              Some relevant tool missing as an alternative to Loki? Please contact us with your suggestion.