analyzing-indicators-of-compromise

name	analyzing-indicators-of-compromise
description	Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
domain	cybersecurity
tags	["IOC","VirusTotal","AbuseIPDB","MalwareBazaar","MISP","threat-intelligence","STIX","NIST-CSF"]
subdomain	threat-intelligence
version	1.0.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0052"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Analyzing Indicators Of Compromise

Overview

Cybersecurity skill for analyzing indicators of compromise. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing indicators of compromise"
• "A phishing email or alert generates IOCs (URLs, IP addresses, file hashes) requi"
• "Automated feeds deliver bulk IOCs that need confidence scoring before ingestion"
• "An incident investigation requires contextual enrichment of observed network art"

Use this skill when:

• A phishing email or alert generates IOCs (URLs, IP addresses, file hashes) requiring rapid triage
• Automated feeds deliver bulk IOCs that need confidence scoring before ingestion into blocking controls
• An incident investigation requires contextual enrichment of observed network artifacts

Do not use this skill in isolation for high-stakes blocking decisions — always combine automated enrichment with analyst judgment, especially for shared infrastructure (CDNs, cloud providers).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• VirusTotal API key (free or Enterprise) for multi-AV and sandbox lookup
• AbuseIPDB API key for IP reputation checks
• MISP instance or TIP for cross-referencing against known campaigns
• Python with requests and vt-py libraries, or SOAR platform with pre-built connectors

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}