Extracting iocs from analysis output

Extracting IOCs from Analysis Output

When to Use

• You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic indicators out of it.
• You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection.
• You are building the indicator section of a report from analysis artifacts.

Do not use naive substring matching that produces noise — validate indicator shapes and filter obvious false positives (version strings that look like IPs, library domains).

Prerequisites

• The analysis artifacts as text/JSON; the defanging skill for safe output.

Workflow

Step 1: Gather the artifacts

Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into text the extractor can scan.

Step 2: Extract by pattern

Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the format allows.

python scripts/analyst.py extract analysis.txt

Step 3: Filter and deduplicate

Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate; keep a record of what was filtered and why.

Step 4: Type and hand off

Tag each indicator with its type and pass the set to enrichment/defanging for reporting.

Validation

• Extracted indicators match valid shapes (no malformed IPs/hashes).
• The set is deduplicated and obvious benign noise is filtered with a rationale.
• Each indicator is typed and ready for enrichment/defanging.

Pitfalls

• Capturing version numbers as IPs or library hostnames as C2.
• Missing indicators split across lines or encoded (base64) in the artifacts.
• Not recording what was filtered, losing analyst auditability.

References

• See references/api-reference.md for the IOC extractor.
• MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).