Alternatives to THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
Replacements
Listings that take over the same core job as THOR Lite.
YARA
Pattern-matching engine for identifying and classifying malware samples.
YARA is the open-source BSD-3-Clause pattern engine itself, so you write or supply rules and build scanning around it rather than getting a ready IOC scanner.
YARA-X
Match files against rules describing suspicious binary patterns.
YARA-X is the open-source modern rewrite of YARA, matching files against rules but without THOR Lite's IOC, process and autorun scanning.
chkrootkit
A command-line tool that checks Unix-like systems locally for signs of a rootkit.
chkrootkit is an open-source Linux and Unix command-line checker for known rootkits and trojaned binaries, rather than a multi-platform YARA and IOC scanner.
Also worth comparing
These listings name THOR Lite as their own alternative, so the relationship runs both ways.
PE-sieve
A Windows tool that scans a running process and dumps injected or hollowed code and hooks.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures across Windows, Linux and macOS, though it is not open source.
Similar software
Related functionality, not a direct replacement.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
HollowsHunter
A Windows scanner that checks every running process for injected code, hollowing and other implants.
capa
Identify likely capabilities inside executable files.
Chainsaw
Search Windows forensic records for suspicious activity.
Hayabusa
Build investigation timelines from Windows event logs.
