Lion Cipher Lab
Scan your own machine for indicators of compromise with LOKI
- Digital Forensics & IR (DFIR)
- Beginner
- ~40 min
- Free · no account required
Why it matters
When a machine is suspected of being compromised, one of the first questions a responder asks is blunt: is there anything KNOWN-bad sitting on this disk right now? Answering it by hand is impossible; answering it with a scanner that carries a library of indicators is a few minutes. LOKI is a free, open-source scanner built for exactly this triage step. It bundles a large set of community YARA rules together with IOC lists -- known-bad file hashes, filename patterns, and command-and-control markers -- and checks every file you point it at against all of them at once. That is the entry-level…
What you'll learn
- what an IOC scanner is
- installing and updating LOKI
- scanning a directory for known-bad files
- reading info / warning / alert levels
- using the EICAR test file safely
- why a clean scan is not proof of safety
Steps in this lab
- What LOKI is, and how it builds on YARA
- Get LOKI onto your machine
- Update the signatures before your first scan
- Run your first scan on a folder you control
- Read the alert levels: info, warning, alert
- See a REAL detection safely with the EICAR test file
- The honest limits: what a scan does and does not prove
- What you just learned to do