FastFinder is an incident response tool designed for threat hunting, live forensics and endpoint triage. It helps security investigators locate suspicious files and identify indicators of compromise across Linux and Windows systems.
The software uses configurable search criteria to identify potentially malicious content. Investigators can combine file paths, checksums, string matching and YARA rules to look for known threats or unusual activity.
FastFinder is intended for targeted security investigations rather than conventional antivirus protection. Its scanning and reporting capabilities are useful when examining compromised systems, collecting evidence or performing routine security checks.
This is free and open source software.
Key Features
- Search files using filename and path patterns, including wildcard and regular expression matching.
- Identify suspicious files using MD5, SHA-1 and SHA-256 checksums.
- Search file contents for specified strings and complex conditions using YARA rules.
- Inspect process memory for suspicious content associated with running applications.
- Configurable scans of local storage, removable devices and mounted network drives.
- Continuous monitoring mode for ongoing threat detection and forensic triage.
- YAML configuration files for specifying detection criteria, scanning options and output behaviour.
- Copy matching files into a designated directory for subsequent investigation.
- Optional base64 encoding of collected file content.
- Create standalone executables containing embedded scanning configurations on supported architectures.
- Export application events in JSON Lines format with configurable file rotation and retention.
- Forward security events to external systems using HTTP POST requests.
- Filter forwarded events by severity or event type.
- Control logging verbosity and run scans in silent mode.
- Support for scanning limits to manage resource consumption when examining large files.
- Cross-platform support – runs on Linux and Windows.
Website: github.com/codeyourweb/fastfinder
Support:
Developer: Jean-Pierre Garnier
License: GNU Affero General Public License v3.0
FastFinder is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Anti-Malware Tools | |
|---|---|
| ClamAV | Antivirus engine for detecting trojans, viruses, malware and other threats |
| YARA-X | Re-incarnation of YARA |
| YARA | Pattern matching swiss knife for malware researchers |
| Maltrail | Malicious traffic detection system |
| ClamTk | Graphical frontend for ClamAV |
| LMD | Malware scanner focusing on threats faced in shared hosted environments |
| phpMussel | PHP-based anti-virus anti-trojan anti-malware solution |
| Raspirus | Lightweight signature-based malware scanner |
| FastFinder | Fast suspicious file finder |
| chkrootkit | Locally checks for signs of a rootkit |
| Unhide | Forensic tool to find hidden processes and TCP/UDP ports |
| Atomdrift Scan | Malware and supply chain scanner for software security |
| paranoya | Malware scanner using indicators of compromise and YARA rules |
| decloaker | Security tool for revealing objects concealed by malware |
| Lenspect | Lightweight security threat scanner |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.