---
name: ioc-extraction
description: Extract Indicators of Compromise (IOCs) from malware samples and analysis artifacts - hashes, IPs, domains, URLs, mutexes, and registry keys
---

# IOC Extraction

## Overview

This skill provides tools and guidance for extracting Indicators of Compromise (IOCs) from malware samples, memory dumps, network captures, and analysis reports. IOCs enable detection, hunting, and sharing of threat intelligence across organizations.

## When to Use

- After completing static or dynamic analysis of a malware sample
- When processing memory dumps or PCAP files for indicators
- To create detection signatures or blocklists
- When preparing threat intelligence reports for sharing
- To correlate findings with known threat campaigns

## Prerequisites

- **Python 3.10+** with `re`, `json`, `csv` (standard library)
- **VirusTotal API key** (optional): for IOC enrichment via `ioc_validator.py --enrich`
- **Input artifacts**: analysis reports, strings output, memory dumps, or PCAP files
- Familiarity with standard IOC sharing formats (STIX 2.1, OpenIOC)

## IOC Categories

| Category | Examples |
|----------|---------|
| File Hashes | MD5, SHA-1, SHA-256 of malware samples |
| Network | IP addresses, domains, URLs, email addresses |
| Host | Mutexes, registry keys, file paths, service names |
| Behavioral | Scheduled tasks, WMI persistence, named pipes |

## Step-by-Step Instructions

1. **Collect raw data** from analysis artifacts (strings, logs, PCAPs)
2. **Extract IOCs** using regex patterns for each IOC type
3. **Validate IOCs** to filter false positives and private addresses
4. **Defang IOCs** for safe sharing in reports and emails
5. **Deduplicate and normalize** extracted indicators
6. **Enrich IOCs** with context (first seen, source, confidence)
7. **Export** in standard formats (CSV, STIX, OpenIOC)

## Available Scripts

### ioc_extractor.py
Extracts IOCs from files using regex pattern matching. Supports defanging, deduplication, and multiple output formats.

```bash
python scripts/ioc_extractor.py --input analysis_report.txt --output iocs.json
python scripts/ioc_extractor.py --input strings.txt --format csv --defang
```

### ioc_validator.py
Validates extracted IOCs by filtering private/reserved IPs, checking domain validity, and optionally enriching via threat intelligence APIs.

```bash
python scripts/ioc_validator.py --input iocs.json --output validated_iocs.json
python scripts/ioc_validator.py --input iocs.json --enrich --vt-api-key YOUR_KEY
```

## Best Practices

- Always defang IOCs before sharing in documents or emails
- Include context with each IOC (confidence level, first/last seen, source)
- Use standard sharing formats (STIX 2.1, OpenIOC) for automated consumption
- Validate IOCs to remove false positives before sharing
- Track IOC provenance to maintain attribution chains

## References

- `references/ioc-types.md` - Comprehensive IOC type reference
- `references/ioc-sharing-formats.md` - Standard IOC sharing formats
- `assets/ioc-template.csv` - CSV template for IOC collection