# THOR Lite

THOR Lite is a Detection Engineering product. It runs on-premises. Pricing is free.

A free, fast, and flexible multi-platform IOC and YARA scanner for Windows, Linux, and macOS.

Checked October 2026.

## What is THOR Lite?

THOR Lite is a free, fast, and flexible multi-platform IOC and YARA scanner that includes file system and process scan modules, extracts 'autoruns' information, and supports custom IOCs and signatures. It offers various output formats, scan throttling, and is available for Windows, Linux, and macOS.

The scanner is written in Go, pre-compiled for all major platforms, and includes an encrypted open-source signature base. It allows for custom encrypted signatures and has improved performance compared to LOKI.

THOR Lite is a limited version of the enterprise scanner THOR, offered for free with a newsletter subscription.

Tags: IOC, Scanner, YARA

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.
- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Detection Engineering](https://cybersectools.com/categories/detection-engineering)
- Deployment: On-Premises
- Company size fit: Startup, SMB
- Pricing model: Free
- Website: nextron-systems.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## THOR Lite FAQ

### What is THOR Lite?

THOR Lite is a product in the Detection Engineering category. It covers IOC, Scanner and YARA.

### What is the pricing for THOR Lite?

THOR Lite is free. Download and setup instructions are at https://www.nextron-systems.com/thor-lite/.

### What are alternatives to THOR Lite?

Alternatives to THOR Lite listed on CybersecTools:

1. [FireEye Mandiant SunBurst Countermeasures](https://cybersectools.com/tools/fireeye-mandiant-sunburst-countermeasures) - FireEye Mandiant SunBurst Countermeasures: freely available rules for detecting malicious files and activity (Free)
2. [Axur AI-Powered Cyber Threat Intelligence](https://cybersectools.com/tools/axur-ai-powered-cyber-threat-intelligence) - AI-powered cyber threat intelligence platform with real-time monitoring (Commercial)
3. [Sublime Security Sublime Rules](https://cybersectools.com/tools/sublime-security-sublime-rules) - Open-source detection rules for email attacks like BEC, phishing, and malware (Free)
4. [Hunters Next-Gen SIEM](https://cybersectools.com/tools/hunters-next-gen-siem) - Next-gen SIEM with AI-powered triage, automated investigation & detection (Commercial)
5. [SOC Prime Uncoder AI](https://cybersectools.com/tools/soc-prime-uncoder-ai) - IDE for detection engineering with cross-platform translation for 65+ SIEM/EDR/XDR (Commercial)

Compare all THOR Lite alternatives at [https://cybersectools.com/alternatives/thor-lite](https://cybersectools.com/alternatives/thor-lite)

### What deployment and organization size does THOR Lite fit?

THOR Lite is available as on-premises software. It is listed for startups and small businesses. It is free.

## Compare THOR Lite with similar solutions

- [THOR Lite vs FireEye Mandiant SunBurst Countermeasures](https://cybersectools.com/compare/fireeye-mandiant-sunburst-countermeasures-vs-thor-lite)
- [THOR Lite vs Axur AI-Powered Cyber Threat Intelligence](https://cybersectools.com/compare/axur-ai-powered-cyber-threat-intelligence-vs-thor-lite)
- [THOR Lite vs Sublime Security Sublime Rules](https://cybersectools.com/compare/sublime-security-sublime-rules-vs-thor-lite)

All alternatives to THOR Lite: [/alternatives/thor-lite](https://cybersectools.com/alternatives/thor-lite)

---

Source: https://cybersectools.com/tools/thor-lite

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on THOR Lite: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md