Kali Linux

Odin : Central IoC Scanner Based On Loki

Odin is a central IoC scanner based on Loki.

General Info

This application Loki latest version and download it on all machines using a powershell script and run it then this app receives the respose from all machines and parse the feed in CSV form.

Requirements

  • Python +3.5
  • PyQT5
  • psutil
  • pyparsing
  • zipfile

Fetch

Odin download and extract the latest version on Loki and start HTTP server to deliver the executable (Loki) to all machines.

Deploy Loki

This step has ti be done manually using powershell script on a DC machine or suing domain admin account which the script deliver loki to all machines and start updating. The script is in Configurations tab and you can modiy the scipt as needed.

Collecting

Start the listener then from the powershell script start Loki to search for IoCs and results will be sent from Loki to Odin

Parsing

Collected logs will be parsed and can be exported as CSV file to be handled with something else like ELK.

R K

Recent Posts

What Is a Data Protection Platform and Why Your Organization Needs One

A data protection platform is a unified system that helps organizations discover, classify, monitor, and…

10 hours ago

How Swiss Privacy Rules Affect AI Companies Under GDPR

AI companies operating in or around Switzerland face a compliance challenge that most legal teams…

2 days ago

Swiss FADP vs EU GDPR: Key Differences for AI and Data Privacy

Two major data privacy laws now govern how organizations handle personal data across Europe; the…

3 days ago

Kali Linux Commands Cheat Sheet: Complete Quick Reference

This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…

1 month ago

What I Wish I Knew Before Learning Malware Analysis and Reverse Engineering

When I first started learning malware analysis and reverse engineering, I thought the hardest part…

1 month ago

git fetch vs git pull: How They Work and When to Use Each

Both git fetch and git pull talk to a remote repository, but they do very different things to your…

2 months ago