Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
A malware analysis (static or dynamic) is complete and actionable indicators need to be extracted for defense teams
Building blocklists for firewalls, proxies, and DNS sinkholes from analyzed samples
Creating YARA rules, Snort/Suricata signatures, or SIEM detection content from malware artifacts
Contributing to threat intelligence sharing platforms (MISP, OTX, ThreatConnect)
Tracking malware campaigns by correlating IOCs across multiple samples
Do not use for IOCs from unverified sources without validation; false positives in blocklists can disrupt legitimate business operations.
Detection Gaps & Validation
The #1 miss is harvesting IOCs from a packed/still-encrypted sample. Strings pulled from a UPX/Themida-packed binary yield the packer stub's artifacts, not the C2. Unpack (dump from memory after the OEP) before extracting, or your imphash/strings describe the packer, not the family.
Config-encrypted C2 won't appear in strings. Emotet/QakBot/AgentTesla store C2 in XOR/AES/RC4 blobs or .NET resources. Run the sample in CAPE/ANY.RUN and pull C2 from the cape-parser config or decrypted memory, then cross-check against static strings.
Benign-lookalike FPs that poison blocklists: CDN/cloud IPs (AWS, Akamai, Cloudflare), telemetry domains (microsoft.com, google.com), sinkhole IPs, and User-Agent strings copied from real browsers. Validate every network IOC on VirusTotal/passive DNS for hosting context before blocking.
Sandbox-only indicators are environment artifacts, not IOCs: the analysis VM's hostname, 10.0.2.15, VirtualBox MACs, and the sandbox's own DNS resolver leak into reports — exclude them.
How to confirm: an IOC is high-confidence only when corroborated across at least two sources (static strings + dynamic PCAP/memory, or sandbox + VT). Re-detonate with full network/MITM to surface DGA fallback domains and second-stage download URLs that a single short run misses. Defang before sharing.
Prerequisites
Python 3.8+ with iocextract, pefile, yara-python libraries installed
Access to PCAP files, memory dumps, or sandbox reports from the analysis
MISP instance or STIX/TAXII server for structured IOC sharing
VirusTotal API key for IOC enrichment and validation
CyberChef for decoding obfuscated indicators
Workflow
Step 1: Extract File-Based IOCs
Compute hashes and identify file metadata indicators:
# Generate all standard hashesmd5sum malware_sample.exe
sha1sum malware_sample.exe
sha256sum malware_sample.exe
# Generate ssdeep fuzzy hash for similarity matching
ssdeep malware_sample.exe
# Generate imphash (import hash) for PE files
python3 -c "
import pefile
pe = pefile.PE('malware_sample.exe')
print(f'Imphash: {pe.get_imphash()}')
"# Generate TLSH (Trend Micro Locality Sensitive Hash)
python3 -c "
import tlsh
with open('malware_sample.exe', 'rb') as f:
h = tlsh.hash(f.read())
print(f'TLSH: {h}')
"# Compile file metadata IOCs
python3 << 'PYEOF'
import pefile
import os
import hashlib
import datetime
pe = pefile.PE("malware_sample.exe")
print("FILE IOCs:")
with open("malware_sample.exe", "rb") as f:
data = f.read()
print(f" MD5: {hashlib.md5(data).hexdigest()}")
print(f" SHA-1: {hashlib.sha1(data).hexdigest()}")
print(f" SHA-256: {hashlib.sha256(data).hexdigest()}")
print(f" File Size: {len(data)} bytes")
ts = pe.FILE_HEADER.TimeDateStamp
print(f" Compile: {datetime.datetime.utcfromtimestamp(ts)} UTC")
print(f" Imphash: {pe.get_imphash()}")
PYEOF
Step 2: Extract Network IOCs
Pull network indicators from strings, PCAP, and sandbox reports:
# Extract network IOCs from stringsimport re
withopen("malware_sample.exe", "rb") as f:
data = f.read()
# Extract ASCII and Unicode strings
ascii_strings = re.findall(b'[ -~]{4,}', data)
unicode_strings = re.findall(b'(?:[ -~]\x00){4,}', data)
all_strings = [s.decode('ascii', errors='ignore') for s in ascii_strings]
all_strings += [s.decode('utf-16-le', errors='ignore') for s in unicode_strings]
# IP addresses (excluding private ranges for C2 indicators)
ip_pattern = re.compile(r'\b(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\b')
ips = set()
for s in all_strings:
for ip in ip_pattern.findall(s):
# Filter out private/reserved ranges
octets = [int(o) for o in ip.split('.')]
if octets[0] notin [10, 127, 0] andnot (octets[0] == 172and16 <= octets[1] <= 31) andnot (octets[0] == 192and octets[1] == 168):
ips.add(ip)
# Domain names
domain_pattern = re.compile(r'\b[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z]{2,})+\b')
domains = set()
for s in all_strings:
for d in domain_pattern.findall(s):
ifnot d.endswith(('.dll', '.exe', '.sys', '.com.au')):
domains.add(d)
# URLs
url_pattern = re.compile(r'https?://[^\s<>"{}|\\^`\[\]]+')
urls = set()
for s in all_strings:
for u in url_pattern.findall(s):
urls.add(u)
print("NETWORK IOCs:")
print(f" IPs: {ips}")
print(f" Domains: {domains}")
print(f" URLs: {urls}")
Step 3: Extract Host-Based IOCs
Identify file paths, registry keys, mutexes, and services:
# Extract host-based IOCs from sandbox reportimport json
withopen("cuckoo_report.json") as f:
report = json.load(f)
print("HOST IOCs:")
# File paths created or modifiedprint("\nFile Paths:")
for f in report["behavior"]["summary"].get("files", []):
ifany(p in f.lower() for p in ["temp", "appdata", "system32", "programdata"]):
print(f" [DROPPED] {f}")
# Registry keys for persistenceprint("\nRegistry Keys:")
for key in report["behavior"]["summary"].get("write_keys", []):
ifany(p in key.lower() for p in ["run", "service", "startup", "shell"]):
print(f" [PERSIST] {key}")
# Mutexes (unique to malware family)print("\nMutexes:")
for mutex in report["behavior"]["summary"].get("mutexes", []):
if mutex notin ["Local\\!IETld!Mutex", "RasPbFile"]: # Filter known Windows mutexesprint(f" [MUTEX] {mutex}")
# Created servicesprint("\nServices:")
for svc in report["behavior"]["summary"].get("started_services", []):
print(f" [SERVICE] {svc}")
Defang indicators for safe sharing and validate against threat intelligence:
# Defang IOCs for safe sharingdefdefang_ip(ip):
return ip.replace(".", "[.]")
defdefang_url(url):
return url.replace("http", "hxxp").replace(".", "[.]")
defdefang_domain(domain):
return domain.replace(".", "[.]")
# Validate IOCs against VirusTotalimport requests
VT_API_KEY = "your_api_key"defcheck_vt_ip(ip):
resp = requests.get(f"https://www.virustotal.com/api/v3/ip_addresses/{ip}",
headers={"x-apikey": VT_API_KEY})
data = resp.json()
stats = data["data"]["attributes"]["last_analysis_stats"]
return stats["malicious"]
defcheck_vt_domain(domain):
resp = requests.get(f"https://www.virustotal.com/api/v3/domains/{domain}",
headers={"x-apikey": VT_API_KEY})
data = resp.json()
stats = data["data"]["attributes"]["last_analysis_stats"]
return stats["malicious"]
# Validate each IOCfor ip in ips:
detections = check_vt_ip(ip)
print(f" {defang_ip(ip)} - VT: {detections} detections")
Step 6: Export IOCs in Standard Formats
Generate structured IOC outputs for sharing and ingestion:
# Export as STIX 2.1 bundlefrom stix2 import Indicator, Bundle, Malware, Relationship
import datetime
indicators = []
# File hash indicator
indicators.append(Indicator(
name="Malware SHA-256 Hash",
pattern=f"[file:hashes.'SHA-256' = '{sha256_hash}']",
pattern_type="stix",
valid_from=datetime.datetime.now(datetime.timezone.utc),
labels=["malicious-activity"]
))
# IP indicatorfor ip in ips:
indicators.append(Indicator(
name=f"C2 IP Address {ip}",
pattern=f"[ipv4-addr:value = '{ip}']",
pattern_type="stix",
valid_from=datetime.datetime.now(datetime.timezone.utc),
labels=["malicious-activity"]
))
# Domain indicatorfor domain in domains:
indicators.append(Indicator(
name=f"C2 Domain {domain}",
pattern=f"[domain-name:value = '{domain}']",
pattern_type="stix",
valid_from=datetime.datetime.now(datetime.timezone.utc),
labels=["malicious-activity"]
))
bundle = Bundle(objects=indicators)
withopen("iocs_stix.json", "w") as f:
f.write(bundle.serialize(pretty=True))
# Export as CSV for SIEM ingestionimport csv
withopen("iocs.csv", "w", newline="") as f:
writer = csv.writer(f)
writer.writerow(["type", "value", "context", "confidence"])
writer.writerow(["sha256", sha256_hash, "malware_sample", "high"])
for ip in ips:
writer.writerow(["ipv4", ip, "c2_server", "high"])
for domain in domains:
writer.writerow(["domain", domain, "c2_domain", "high"])
for url in urls:
writer.writerow(["url", url, "c2_url", "high"])
Key Concepts
Term
Definition
IOC (Indicator of Compromise)
Forensic artifact observed in a network or system that indicates a potential intrusion: hashes, IPs, domains, file paths, registry keys
Defanging
Modifying IOCs to prevent accidental activation (e.g., replacing dots with [.] in URLs and IPs for safe sharing in reports)
Imphash
MD5 hash of the import table functions in a PE file; samples from the same malware family often share the same imphash
STIX/TAXII
Structured Threat Information Expression / Trusted Automated Exchange; standards for encoding and transmitting threat intelligence
JA3/JA3S
TLS client/server fingerprint based on ClientHello/ServerHello parameters; identifies specific malware families by their TLS implementation
Fuzzy Hashing (ssdeep)
Context-triggered piecewise hashing that identifies similar files even with minor modifications; useful for malware variant detection
MISP
Malware Information Sharing Platform; open-source threat intelligence platform for collecting, storing, and sharing IOCs
Tools & Systems
iocextract (Python): Automated IOC extraction library supporting IPs, URLs, domains, hashes, and YARA rules from text
MISP: Open-source threat intelligence sharing platform for structured IOC management and distribution
CyberChef: Web-based tool for decoding, decrypting, and transforming data useful for deobfuscating encoded IOCs
tshark: Command-line network protocol analyzer for extracting network IOCs from PCAP files
VirusTotal: Online service for validating and enriching IOCs with community detection results and threat intelligence
Common Scenarios
Scenario: Building a Comprehensive IOC Package from a Ransomware Sample
Context: A ransomware incident requires rapid IOC extraction for blocking across the enterprise while the full investigation continues. Multiple data sources are available: the sample binary, PCAP from network monitoring, and a Cuckoo sandbox report.
Approach:
Compute all file hashes (MD5, SHA-1, SHA-256, imphash, ssdeep) for the ransomware binary and any dropped files
Extract network IOCs from strings in the binary (hardcoded C2 addresses)
Parse the PCAP for DNS queries, HTTP requests, and TLS SNI fields
Extract host IOCs from the sandbox report (file paths, registry keys, mutexes, ransom note filenames)
Validate all network IOCs against VirusTotal to confirm malicious status and check for known associations
Defang all indicators and compile into STIX 2.1 format for sharing and CSV for SIEM ingestion
Submit to MISP event for organizational and community sharing
Pitfalls:
Including IP addresses of legitimate CDNs or cloud services without validating context (e.g., AWS IPs used for hosting, not inherently malicious)
Not defanging URLs and IPs in reports, leading to accidental clicks or DNS resolution
Extracting strings from packed binaries (IOCs from packed samples are unreliable; unpack first)
Forgetting to include dropped file hashes (the initial dropper and the final payload are separate IOCs)
