signature-base

Signature-Base Signature-Base is the YARA signature and IOC database for our scanners LOKI and THOR Lite Focus of Signature-Base 1. High quality YARA rules and IOCs with minimal false positives 2. Clear structure 3. Consistent rule format Directory Structure iocs - Simple IOC files CSV yara - YAR...

odin

Odin Odin is a central IoC scanner based on Loki Table of Contents General Info Requirements Fetching Deploying Loki Collecting Parsing General Info This application Loki latest version and download it on all machines using a powershell script and run it then this app receives the respose from al...

Fenrir

Fenrir Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Dave Spencer, david dot spencer at nccgroup dot com http://www.github.com/nccgroup/Fenrir Released under AGPL see LICENSE for more information Description Fenrir was created to prove that it is possible to...

cowrie

.. SPDX-FileCopyrightText: 2014 Upi Tamminen [email protected] .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof [email protected] .. .. SPDX-License-Identifier: BSD-3-Clause Cowrie What is Cowrie Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

loki-parse

loki-parse A python script that can detect and parse loki-bot malware related network traffic between a compromised host and a C2 server. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc... This scrip...

Loki

I wrote a new Open Source YARA scanner called LOKI RS Rust. LOKI Python is now officially deprecated. Important Note This project is now in inactive maintenance mode. This means that while I merge pull requests for bug fixes and straightforward issues, I currently lack the time to add new feature...

CVE-2021-43798

usage: grafana-exploit.py -h -H/--host HOST grafana-exploit.py: error: the following arguments are required: -H/--host example: python3 grafana-exploit.py --host if successfuly read arbitary-file situation show the request URL and curl command +RequestURL...

Sleipnir

Sleipnir Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Dave Spencer, david dot spencer at nccgroup dot com http://www.github.com/nccgroup/Sleipnir Released under AGPL see LICENSE for more information Description Sleipnir is a small executable designed for quick...

loki

Loki: like Prometheus, but for logs. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate. It does not index the contents of the logs, but rather a set of labels for each log...

Loki

Loki Loki is a simple R emote A ccess T ool. Loki uses RSA-2048 with AES-256 to keep your communication with infected machines secure. Disclaimer THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

CLEANSTART-2026-JZ17446 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the loki package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-JQ31239 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-PT29716 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the loki package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-GD74689 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the loki package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-VJ29076 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-9703

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-9703

Both Grafana OSS and Grafana Enterprise are affected by a vulnerability in the data source proxy where role-based access control (RBAC) is not correctly applied to write requests for Loki data sources . An authenticated user with only the Viewer role can exploit this to send POST, PUT, and DELETE...