ioc-extract

/ioc-extract

Extract, categorize, and format indicators of compromise from analysis notes, sandbox reports, or raw data into structured, actionable intelligence.

Trigger

Use after completing malware analysis (static or dynamic) or when processing threat intelligence reports, incident response notes, or any unstructured data that contains indicators of compromise. Also useful for converting informal analyst notes into structured IOC formats suitable for SIEM ingestion, threat intel platforms, or information sharing.

Input

Provide any of the following:

• Analysis notes from static or dynamic malware analysis sessions
• Sandbox reports (full text or key sections from ANY.RUN, Joe Sandbox, Cuckoo, etc.)
• Network captures or Zeek/Suricata logs showing suspicious traffic
• Incident response notes with observed artifacts
• Threat intelligence reports containing IOCs mixed with narrative
• Raw data (log entries, PCAP summaries, forensic artifacts)

The input can be messy and unstructured -- the command's purpose is to extract and organize.

Process

1. Indicator extraction -- Scan the input for all indicator types:

   Network indicators:

   • IPv4 and IPv6 addresses (excluding RFC 1918 private ranges and known-good infrastructure unless flagged)
   • Domain names and subdomains (defang format accepted: hxxps://, [.]com)
   • Full URLs including paths and parameters
   • Email addresses (sender and recipient in phishing contexts)
   • JA3/JA3S TLS fingerprint hashes
   • JARM fingerprints
   • SSL certificate hashes and subject strings
   • User-Agent strings

   Host indicators:

   • File hashes (MD5, SHA-1, SHA-256) -- validate format and length
   • File names and paths (with OS context)
   • Registry key paths and values (Windows)
   • Mutex / named pipe names
   • Scheduled task names and configurations
   • Service names and descriptions
   • WMI event subscription details

   Behavioral indicators:

   • Process creation command lines
   • API call sequences that indicate specific techniques
   • MITRE ATT&CK technique IDs and descriptions