XingLo SkillSearch

恶意样本IOC指标提取

用于从恶意样本、字符串结果、分析报告和其他文本中批量提取IOC，包括文件哈希、IP、域名、URL、邮箱、互斥体、注册表键等，并支持去重、反混淆和JSON/CSV等格式输出。内置提取和校验脚本，适合把分析过程中分散的关键指标统一整理，便于案件串并、威胁情报查询和检测规则制作。

在 AI 中使用此 Skill将本页链接复制给 AI，即可让 AI 获取完整 Skill 内容并按此执行
安全提示： 本站 Skill 均经 ChatGPT 最新模型扫描，未发现恶意脚本及危险指令、未检出已知恶意行为特征，但不保证绝对安全，使用即表示接受此风险

Skill 文件

版本 20260301 · 95bbf118db79fc87b8b257ad09fdaf52

references/
scripts/
SKILL.md
---
name: ioc-extraction
description: Extract Indicators of Compromise (IOCs) from malware samples and analysis artifacts - hashes, IPs, domains, URLs, mutexes, and registry keys
---

# IOC Extraction

## Overview

This skill provides tools and guidance for extracting Indicators of Compromise (IOCs) from malware samples, memory dumps, network captures, and analysis reports. IOCs enable detection, hunting, and sharing of threat intelligence across organizations.

## When to Use

- After completing static or dynamic analysis of a malware sample
- When processing memory dumps or PCAP files for indicators
- To create detection signatures or blocklists
- When preparing threat intelligence reports for sharing
- To correlate findings with known threat campaigns

## Prerequisites

- **Python 3.10+** with `re`, `json`, `csv` (standard library)
- **VirusTotal API key** (optional): for IOC enrichment via `ioc_validator.py --enrich`
- **Input artifacts**: analysis reports, strings output, memory dumps, or PCAP files
- Familiarity with standard IOC sharing formats (STIX 2.1, OpenIOC)

## IOC Categories

| Category | Examples |
|----------|---------|
| File Hashes | MD5, SHA-1, SHA-256 of malware samples |
| Network | IP addresses, domains, URLs, email addresses |
| Host | Mutexes, registry keys, file paths, service names |
| Behavioral | Scheduled tasks, WMI persistence, named pipes |

## Step-by-Step Instructions

1. **Collect raw data** from analysis artifacts (strings, logs, PCAPs)
2. **Extract IOCs** using regex patterns for each IOC type
3. **Validate IOCs** to filter false positives and private addresses
4. **Defang IOCs** for safe sharing in reports and emails
5. **Deduplicate and normalize** extracted indicators
6. **Enrich IOCs** with context (first seen, source, confidence)
7. **Export** in standard formats (CSV, STIX, OpenIOC)

## Available Scripts

### ioc_extractor.py
Extracts IOCs from files using regex pattern matching. Supports defanging, deduplication, and multiple output formats.

```bash
python scripts/ioc_extractor.py --input analysis_report.txt --output iocs.json
python scripts/ioc_extractor.py --input strings.txt --format csv --defang
```

### ioc_validator.py
Validates extracted IOCs by filtering private/reserved IPs, checking domain validity, and optionally enriching via threat intelligence APIs.

```bash
python scripts/ioc_validator.py --input iocs.json --output validated_iocs.json
python scripts/ioc_validator.py --input iocs.json --enrich --vt-api-key YOUR_KEY
```

## Best Practices

- Always defang IOCs before sharing in documents or emails
- Include context with each IOC (confidence level, first/last seen, source)
- Use standard sharing formats (STIX 2.1, OpenIOC) for automated consumption
- Validate IOCs to remove false positives before sharing
- Track IOC provenance to maintain attribution chains

## References

- `references/ioc-types.md` - Comprehensive IOC type reference
- `references/ioc-sharing-formats.md` - Standard IOC sharing formats
- `assets/ioc-template.csv` - CSV template for IOC collection