# Thor Lite

> THOR Lite Skill

- Skill: `nextronsystems/thor-lite` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add nextronsystems/thor-lite`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nextronsystems/thor-lite/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NextronSystems (https://skillmd.com/u/nextronsystems)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nextronsystems/thor-lite

---

# THOR Lite Skill

THOR Lite is a free scanner with reduced features compared to full THOR. This skill handles Lite-specific guidance, limitations, and workarounds.

## When to Use This Skill

- User is running THOR Lite (binary name contains "lite")
- User asks why a feature is missing or disabled
- User expects "full THOR" behavior from Lite
- User wants lab-like scanning with Lite
- User asks about Lite vs full THOR differences

## How to Identify THOR Lite

Check for these indicators in scan output:

1. **Binary name**: `thor64-lite.exe`, `thor-lite-linux-64`, `thor-lite-macos`
2. **Version header**: Shows "THOR Lite" or "Lite" in the banner
3. **Startup messages**:
   - "Some modules and features are not available in Lite version and will be disabled"
   - "Disabled components ... REASON: Component is not available in THOR Lite"
   - "REASON: License restrictions"

If unclear, ask the user for the first ~50 lines of their THOR output.

## Binary Names

| Platform | Scanner | Utility |
|----------|---------|---------|
| Windows | `thor64-lite.exe` | `thor-lite-util.exe` |
| Linux | `thor-lite-linux-64` | `thor-lite-util` |
| macOS | `thor-lite-macos` | `thor-lite-util` |

## Key Limitations

| Feature | Available in Lite? |
|---------|-------------------|
| Lab mode (`--lab`) | No |
| Sigma rules | No |
| Audit trail | No |
| THOR Lens integration | No |
| Full module set (~31) | No (~5 modules) |
| Private signatures (30k+) | No (~4k open source) |
| Commercial use | No |

## Lab-Like Scanning Workaround

Since `--lab` is not available, use this flag combination for intensive scanning:

```bash
# Windows
thor64-lite.exe -a Filescan --intense --norescontrol --cross-platform -p <path>

# Linux
./thor-lite-linux-64 -a Filescan --intense --norescontrol --cross-platform -p <path>

# macOS
./thor-lite-macos -a Filescan --intense --norescontrol --cross-platform -p <path>
```

Be explicit: this provides **similar behavior, not equal** to full lab scanning.

## Setting Expectations

When users run THOR Lite:

1. **Fewer detections expected** – Open source signatures only (~4k vs 30k+ YARA rules)
2. **Modules are limited** – Many persistence and analysis modules are disabled
3. **No Sigma** – Event log analysis with Sigma rules requires full THOR
4. **No Lens** – Audit trail output requires full THOR v11
5. **Scan may seem quiet** – This is normal for Lite's reduced module set

## When to Suggest Full THOR

Recommend upgrading when user needs:
- Sigma/event log scanning
- Audit trail for THOR Lens
- Broader detection coverage
- Full module set
- Commercial/paid engagement use

Keep recommendations factual, not promotional.

## Rules

1. **Identify Lite early** – Check binary name and startup output before troubleshooting missing features
2. **Set expectations** – Lite is for triage; missing detections are expected
3. **Provide workarounds** – Use the lab-like flag combo when appropriate
4. **Don't promise full features** – Workarounds approximate but don't equal full THOR
5. **Note license restrictions** – Commercial use requires full THOR

## References

- [THOR Lite Limitations](reference/limitations.md) – Full feature comparison and workarounds

## Cross-References

- [Environment Detection](../thor-scan/reference/env-detection.md) – Binary detection and identification
- [Lab Mode](../thor-scan/reference/lab-mode.md) – Full THOR lab mode documentation
- [THOR Lens](../thor-lens/SKILL.md) – Requires full THOR v11 (not compatible with Lite)