THOR Lite
A free, fast, and flexible multi-platform IOC and YARA scanner for Windows, Linux, and macOS.
A free, fast, and flexible multi-platform IOC and YARA scanner for Windows, Linux, and macOS.
Checked October 2026.
THOR Lite is a free, fast, and flexible multi-platform IOC and YARA scanner that includes file system and process scan modules, extracts 'autoruns' information, and supports custom IOCs and signatures. It offers various output formats, scan throttling, and is available for Windows, Linux, and macOS.
The scanner is written in Go, pre-compiled for all major platforms, and includes an encrypted open-source signature base. It allows for custom encrypted signatures and has improved performance compared to LOKI.
THOR Lite is a limited version of the enterprise scanner THOR, offered for free with a newsletter subscription.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about THOR Lite: features, pricing and alternatives.
THOR Lite is a product in the Detection Engineering category. It covers IOC, Scanner and YARA.
THOR Lite is free. Download and setup instructions are at https://www.nextron-systems.com/thor-lite/.
Alternatives to THOR Lite listed on CybersecTools:
Compare all THOR Lite alternatives at https://cybersectools.com/alternatives/thor-lite
THOR Lite is available as on-premises software. It is listed for startups and small businesses. It is free.
Side by side: features, pricing model and the company behind each one.
A Sysmon configuration file template with detailed explanations and tutorial-like features.
A Sysmon configuration repository for customizing Microsoft Sysinternals Sysmon configurations with modular setup.
A community-driven open source project providing interactive notebooks with detection logic, adversary tradecraft, and resources organized according to MITRE ATT&CK framework for threat hunting and detection development.
Knowledge base workflow management dashboard for YARA rules and C2 artifacts.
VolatilityBot automates memory dump analysis by extracting executables, detecting code injections, and performing automated malware scanning using YARA and ClamAV.
Yara rule generator using VirusTotal code similarity feature code-similar-to.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
