메뉴
Extract, deduplicate, and classify Indicators of Compromise (IOCs) from any evidence source — files, logs, memory dumps, PCAPs, reports, or pasted text. Outputs structured IOC lists in multiple formats.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | ioc-extract |
| description | Extract, deduplicate, and classify Indicators of Compromise (IOCs) from any evidence source — files, logs, memory dumps, PCAPs, reports, or pasted text. Outputs structured IOC lists in multiple formats. |
| argument-hint | <path-to-evidence-or-paste-text> |
| allowed-tools | Bash Read Write Grep Glob |
You are extracting and classifying Indicators of Compromise from evidence. Parse all provided material, extract IOCs, deduplicate, validate, and output in structured formats.
Evidence source: $ARGUMENTS
If no file path is provided, the user may paste raw text containing IOCs directly. In that case, analyze the pasted content.
file <target> 2>/dev/null || echo "Text input mode — analyzing pasted content"
grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" <source> | sort -u | while read ip; do
# Filter out RFC1918 private ranges, localhost, broadcast
echo "$ip" | grep -vE "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.|255\.)" || true
done | sort -u
grep -oiE "([0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}" <source> | sort -u
grep -oiE "[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.[a-z]{2,}" <source> | sort -u | grep -viE "\.(png|jpg|gif|css|js|ico|svg|woff)$"
grep -oiE "https?://[^ \"'<>]+" <source> | sort -u
grep -oiE "[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}" <source> | sort -u
# MD5
grep -oiE "\b[a-f0-9]{32}\b" <source> | sort -u
# SHA1
grep -oiE "\b[a-f0-9]{40}\b" <source> | sort -u
# SHA256
grep -oiE "\b[a-f0-9]{64}\b" <source> | sort -u
grep -oiE "[a-z0-9_.-]+\.(exe|dll|ps1|bat|cmd|vbs|js|hta|scr|pif|msi|doc[xm]?|xls[xm]?|ppt[xm]?|pdf|jar|py|sh|elf|bin|iso|img|vhd)" <source> | sort -u
grep -oiE "HKEY_[A-Z_]+\\\\[^ \"']+" <source> | sort -u
grep -oE "T[0-9]{4}(\.[0-9]{3})?" <source> | sort -u
grep -oiE "CVE-[0-9]{4}-[0-9]{4,}" <source> | sort -u
grep -oiE "Mozilla/[^ ]+ \([^)]+\)[^\"]*" <source> | sort -u | head -20
# These are MD5-length but in specific context
grep -oiE "ja3[s]?=[a-f0-9]{32}" <source> | sort -u
For each extracted IOC category:
hxxp://, [.]com, [:]80)
# Re-fang common defanging patterns for analysis
sed -e 's/hxxp/http/gi' -e 's/\[.\]/./g' -e 's/\[:\]/:/g' -e 's/ dot /./gi'
For high-priority IOCs, note context:
Write to ./reports/ioc-extract-report.md:
# IOC Extraction Report
**Date**: <date>
**Source**: <evidence source>
**Analyst**: Claude Code DFIR
## Summary
- **Total unique IOCs**: <count>
- **Categories**: <list>
## IOCs by Category
### Network Indicators
#### IP Addresses (<count>)
| IP | Occurrences | Context |
|----|-------------|---------|
#### Domains (<count>)
| Domain | Occurrences | Context |
|--------|-------------|---------|
#### URLs (<count>)
| URL | Context |
|-----|---------|
### Host Indicators
#### File Hashes
| Hash Type | Hash | Associated Filename |
|-----------|------|---------------------|
#### File Names
| Filename | Context |
|----------|---------|
#### Registry Keys
| Key | Context |
|-----|---------|
### Email Addresses
| Email | Context |
|-------|---------|
### Threat Intel References
| CVE | MITRE ATT&CK | Context |
|-----|---------------|---------|
Also write to ./reports/iocs.csv:
type,value,context,source
Also write to ./reports/iocs.json:
{
"type": "bundle",
"objects": [
{
"type": "indicator",
"pattern": "[ipv4-addr:value = 'x.x.x.x']",
"valid_from": "<date>",
"description": "<context>"
}
]
}
Create the reports/ directory if it does not exist. Generate all three output formats.
SOC alert triage and investigation guidance. Paste an alert description and observables to get structured investigation steps, hypothesis generation, and recommended queries for your SIEM/EDR.
Generate a comprehensive DFIR incident report by consolidating findings from all analysis skills (memory, disk, network, log, malware, IOCs, timeline). Produces an executive and technical report.
Analyze disk images and filesystem artifacts using Sleuthkit (mmls, fls, icat), binwalk, strings, and bulk_extractor. Recover deleted files, build timelines, and examine partition structures.
Acquire and preserve digital evidence following forensic best practices. Disk imaging, memory capture, log collection, and chain of custody documentation. Inspired by SIFT workstation methodology.
Analyze system and security logs (auth.log, syslog, Windows EVTX, Apache/Nginx, JSON logs). Detect brute force, lateral movement, privilege escalation, and anomalous activity.
Perform static analysis and triage of suspicious files. Extract hashes, strings, metadata, PE headers, ELF info, embedded URLs, and indicators using strings, file, exiftool, readelf, objdump, radare2, and binwalk.