(Feature) MD5/SHA1/SHA256 whitelist for false alarm files

Neo23x0 / Loki

Loki - Simple IOC and YARA Scanner

https://www.nextron-systems.com/compare-our-scanners/

GNU General Public License v3.0

3.37k stars 581 forks source link

(Feature) MD5/SHA1/SHA256 whitelist for false alarm files #252

Open windhamwong opened 5 months ago

windhamwong commented 5 months ago

I observed that the excluding config can whitelist certain folders/files but I wonder how to whitelist the MD5/SHA1/SHA256 instead of the file? This could be very useful for web server scanning, especially files are most likely identical but false alarm raised due to syntax or function calls. The hash whitelist would be helpful for checking if the files are being modified or not.

windhamwong commented 5 months ago

I observed that #204 is there but closed without reason. May I ask for the reason?