THOR is a compromise-assessment scanner from Nextron Systems GmbH. On Windows, Linux and macOS systems it looks for traces of attacks using YARA signatures, Sigma rules, IOCs and anomaly checks. According to the vendor, THOR needs no installation: you copy it to a system or run it from a network share or USB stick, and receive findings as a text log, syslog messages or an HTML report. For continuous scanning, THOR can be controlled through agents of the ASGARD Management Center, Nextron's central console. You can add your own IOCs and YARA rules.
Nextron Systems GmbH is a German company with an office in Frankfurt am Main and a US subsidiary, Nextron Systems LLC in Miami. No parent company is named. THOR runs locally on the systems being examined, and Nextron says its solutions can be deployed fully on-premises, so scan results can stay within your own environment. A free scanner for IOCs and YARA rules, THOR Lite, is also offered. For European organisations that want control over forensic data, this local operation is the relevant point.