ioc-extract

What this skill does

Automatically extracts Indicators of Compromise (IOCs) from text, log files, or URLs. Identifies IP addresses, domains, URLs, email addresses, and file hashes (MD5/SHA1/SHA256), then outputs a structured, defanged IOC list for safe sharing.

When to use

• Identifying malicious infrastructure during incident response
• Extracting IOCs from threat intelligence reports or emails
• Collecting attacker indicators by analyzing log files
• Preparing an IOC list for ingestion into a SIEM or TIP

Prerequisites

• Python 3.6 or higher
• (optional) ioc-finder library: pip install ioc-finder
• Input source: pasted text, local file path, or URL

Inputs

Item	Description	Example
INPUT_SOURCE	Direct text, file path, or URL	/var/log/apache2/access.log
OUTPUT_FORMAT	Output format (text/json/csv)	json

Workflow

Step 1: Confirm input source and collect text

# Read text from a file
INPUT_FILE="/path/to/log.txt"
if [ -f "$INPUT_FILE" ]; then
    TEXT=$(cat "$INPUT_FILE")
elif echo "$INPUT_FILE" | grep -qE '^https?://'; then
    TEXT=$(curl -sL "$INPUT_FILE")
else
    echo "Paste text and press Ctrl+D when done:"
    TEXT=$(cat)
fi
echo "$TEXT" > /tmp/ioc_input.txt
echo "[+] Input collected: $(wc -c < /tmp/ioc_input.txt) bytes"

Step 2: Extract IOCs with ioc-finder (recommended)

# Check for ioc-finder installation and use it
if python3 -c "import ioc_finder" 2>/dev/null; then
    python3 - <<'PYEOF'
from ioc_finder import find_iocs
import json, sys

with open('/tmp/ioc_input.txt', 'r', errors='replace') as f:
    text = f.read()

iocs = find_iocs(text)

# Filter and clean results
result = {
    'ipv4': list(iocs.get('ipv4s', [])),
    'ipv6': list(iocs.get('ipv6s', [])),
    'domains': list(iocs.get('domains', [])),
    'urls': list(iocs.get('urls', [])),
    'emails': list(iocs.get('email_addresses', [])),
    'md5': list(iocs.get('md5s', [])),
    'sha1': list(iocs.get('sha1s', [])),
    'sha256': list(iocs.get('sha256s', [])),
}

total = sum(len(v) for v in result.values())
print(f"[+] Total {total} IOCs extracted")
with open('/tmp/ioc_raw.json', 'w') as f:
    json.dump(result, f, indent=2)
PYEOF
else
    echo "[!] ioc-finder not installed. Run pip install ioc-finder and retry."
    echo "[*] Falling back to regex-based extraction."
fi