reverse-skills-max/vendor-new/analyst-ai-pack/skills/extracting-iocs-from-analysis-output/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
extracting-iocs-from-analysis-output	Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. Activates for requests to extract IOCs from analysis output, pull indicators from a report, or harvest atomic indicators.	cybersecurity	lab-foundations	lab-foundations ioc extraction parsing automation	1.0.0	analyst-ai-pack	Apache-2.0	T1071 T1583	D3-DA	MITRE ATT&CK — https://attack.mitre.org/ IOC types and indicator extraction patterns — https://github.com/InQuest/python-iocextract

Extracting IOCs from Analysis Output

When to Use

• You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic indicators out of it.
• You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection.
• You are building the indicator section of a report from analysis artifacts.

Do not use naive substring matching that produces noise — validate indicator shapes and filter obvious false positives (version strings that look like IPs, library domains).

Prerequisites

• The analysis artifacts as text/JSON; the defanging skill for safe output.

Workflow

Step 1: Gather the artifacts

Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into text the extractor can scan.

Step 2: Extract by pattern

Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the format allows.

python scripts/analyst.py extract analysis.txt

Step 3: Filter and deduplicate

Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate; keep a record of what was filtered and why.

Step 4: Type and hand off

Tag each indicator with its type and pass the set to enrichment/defanging for reporting.

Validation

• Extracted indicators match valid shapes (no malformed IPs/hashes).
• The set is deduplicated and obvious benign noise is filtered with a rationale.
• Each indicator is typed and ready for enrichment/defanging.

Pitfalls

• Capturing version numbers as IPs or library hostnames as C2.
• Missing indicators split across lines or encoded (base64) in the artifacts.
• Not recording what was filtered, losing analyst auditability.

References

• See references/api-reference.md for the IOC extractor.
• MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).