reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/extracting-iocs-from-analysis-output/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: extracting-iocs-from-analysis-output
+description: 'Extracts indicators of compromise from raw analysis artifacts: parsing strings
+  dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and
+  file paths, then deduplicating and typing them. Activates for requests to extract IOCs from
+  analysis output, pull indicators from a report, or harvest atomic indicators.'
+domain: cybersecurity
+subdomain: lab-foundations
+tags:
+  - lab-foundations
+  - ioc
+  - extraction
+  - parsing
+  - automation
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1071
+  - T1583
+d3fend:
+  - D3-DA
+references:
+  - 'MITRE ATT&CK — https://attack.mitre.org/'
+  - 'IOC types and indicator extraction patterns — https://github.com/InQuest/python-iocextract'
+---
+
+# Extracting IOCs from Analysis Output
+
+## When to Use
+
+- You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic
+  indicators out of it.
+- You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection.
+- You are building the indicator section of a report from analysis artifacts.
+
+**Do not use** naive substring matching that produces noise — validate indicator shapes and
+filter obvious false positives (version strings that look like IPs, library domains).
+
+## Prerequisites
+
+- The analysis artifacts as text/JSON; the defanging skill for safe output.
+
+## Workflow
+
+### Step 1: Gather the artifacts
+
+Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into
+text the extractor can scan.
+
+### Step 2: Extract by pattern
+
+Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with
+validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the
+format allows.
+
+```bash
+python scripts/analyst.py extract analysis.txt
+```
+
+### Step 3: Filter and deduplicate
+
+Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate;
+keep a record of what was filtered and why.
+
+### Step 4: Type and hand off
+
+Tag each indicator with its type and pass the set to enrichment/defanging for reporting.
+
+## Validation
+
+- Extracted indicators match valid shapes (no malformed IPs/hashes).
+- The set is deduplicated and obvious benign noise is filtered with a rationale.
+- Each indicator is typed and ready for enrichment/defanging.
+
+## Pitfalls
+
+- Capturing version numbers as IPs or library hostnames as C2.
+- Missing indicators split across lines or encoded (base64) in the artifacts.
+- Not recording what was filtered, losing analyst auditability.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the IOC extractor.
+- MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).