ioc-extract

name	ioc-extract
description	Extract, deduplicate, and classify Indicators of Compromise (IOCs) from any evidence source — files, logs, memory dumps, PCAPs, reports, or pasted text. Outputs structured IOC lists in multiple formats.
argument-hint	<path-to-evidence-or-paste-text>
allowed-tools	Bash Read Write Grep Glob

IOC Extraction

You are extracting and classifying Indicators of Compromise from evidence. Parse all provided material, extract IOCs, deduplicate, validate, and output in structured formats.

Target

Evidence source: $ARGUMENTS

If no file path is provided, the user may paste raw text containing IOCs directly. In that case, analyze the pasted content.

Extraction Procedure

Step 1: Determine Source Type

file <target> 2>/dev/null || echo "Text input mode — analyzing pasted content"

Step 2: Extract IOCs by Category

IPv4 Addresses

grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" <source> | sort -u | while read ip; do
  # Filter out RFC1918 private ranges, localhost, broadcast
  echo "$ip" | grep -vE "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.|255\.)" || true
done | sort -u

IPv6 Addresses

grep -oiE "([0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}" <source> | sort -u

Domains

grep -oiE "[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.[a-z]{2,}" <source> | sort -u | grep -viE "\.(png|jpg|gif|css|js|ico|svg|woff)$"

URLs

grep -oiE "https?://[^ \"'<>]+" <source> | sort -u

Email Addresses

grep -oiE "[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}" <source> | sort -u

File Hashes

# MD5
grep -oiE "\b[a-f0-9]{32}\b" <source> | sort -u
# SHA1
grep -oiE "\b[a-f0-9]{40}\b" <source> | sort -u
# SHA256
grep -oiE "\b[a-f0-9]{64}\b" <source> | sort -u

File Names / Paths

grep -oiE "[a-z0-9_.-]+\.(exe|dll|ps1|bat|cmd|vbs|js|hta|scr|pif|msi|doc[xm]?|xls[xm]?|ppt[xm]?|pdf|jar|py|sh|elf|bin|iso|img|vhd)" <source> | sort -u

Registry Keys (Windows)

grep -oiE "HKEY_[A-Z_]+\\\\[^ \"']+" <source> | sort -u

MITRE ATT&CK Technique IDs

grep -oE "T[0-9]{4}(\.[0-9]{3})?" <source> | sort -u

CVE IDs

grep -oiE "CVE-[0-9]{4}-[0-9]{4,}" <source> | sort -u

User Agents

grep -oiE "Mozilla/[^ ]+ \([^)]+\)[^\"]*" <source> | sort -u | head -20

JA3/JA3S Hashes

# These are MD5-length but in specific context
grep -oiE "ja3[s]?=[a-f0-9]{32}" <source> | sort -u

Step 3: Validation & Deduplication

For each extracted IOC category:

1. Deduplicate: Remove exact duplicates
2. Defang check: Handle defanged IOCs (e.g., hxxp://, [.]com, [:]80)

   # Re-fang common defanging patterns for analysis
   sed -e 's/hxxp/http/gi' -e 's/\[.\]/./g' -e 's/\[:\]/:/g' -e 's/ dot /./gi'
   

3. False positive filtering:
   • Remove private/reserved IPs (10.x, 172.16-31.x, 192.168.x, 127.x)
   • Remove common benign domains (microsoft.com, google.com, etc.) — unless contextually relevant
   • Remove hash-like strings that are clearly not hashes (e.g., CSS color codes in context)
4. Validate format: Ensure IPs have valid octets (0-255), domains have valid TLD, hashes are correct length

Step 4: Enrichment (if possible)

For high-priority IOCs, note context:

• Where in the evidence was this IOC found?
• How many times does it appear?
• Is it associated with a specific process, user, or timeframe?

Output Formats

Format 1: Structured Report (default)

Write to ./reports/ioc-extract-report.md:

# IOC Extraction Report

**Date**: <date>
**Source**: <evidence source>
**Analyst**: Claude Code DFIR

## Summary
- **Total unique IOCs**: <count>
- **Categories**: <list>

## IOCs by Category

### Network Indicators
#### IP Addresses (<count>)
| IP | Occurrences | Context |
|----|-------------|---------|

#### Domains (<count>)
| Domain | Occurrences | Context |
|--------|-------------|---------|

#### URLs (<count>)
| URL | Context |
|-----|---------|

### Host Indicators
#### File Hashes
| Hash Type | Hash | Associated Filename |
|-----------|------|---------------------|

#### File Names
| Filename | Context |
|----------|---------|

#### Registry Keys
| Key | Context |
|-----|---------|

### Email Addresses
| Email | Context |
|-------|---------|

### Threat Intel References
| CVE | MITRE ATT&CK | Context |
|-----|---------------|---------|

Format 2: CSV (for SIEM import)

Also write to ./reports/iocs.csv:

type,value,context,source

Format 3: STIX-compatible JSON (simplified)

Also write to ./reports/iocs.json:

{
  "type": "bundle",
  "objects": [
    {
      "type": "indicator",
      "pattern": "[ipv4-addr:value = 'x.x.x.x']",
      "valid_from": "<date>",
      "description": "<context>"
    }
  ]
}

Create the reports/ directory if it does not exist. Generate all three output formats.