iocextract Logo

iocextract

0
Free
Visit Website

iocextract Indicator of Compromise (IOC) extractor for some of the most commonly ingested artifacts. Overview The Problem Our Solution Example Use Case Installation Usage Library Command Line Interface Helpful Information FAQ More Details Custom Regex Related Projects Contributing Overview The iocextract package is a library and command line interface (CLI) for extracting URLs, IP addresses, MD5/SHA hashes, email addresses, and YARA rules from text corpora. It allows for you to extract encoded and "defanged" IOCs and optionally decode or refang them. The Problem It is common practice for malware analysts or endpoint software to "defang" IOCs such as URLs and IP addresses, in order to prevent accidental exposure to live malicious content. Being able to extract and aggregate these IOCs is often valuable for analysts. Unfortunately, existing "IOC extraction" tools often pass right by them, as they are not caught by standard regex. For example, the simple defanging technique of surrounding periods with brackets: 127[.]0[.]0[.]1 Existing tools that use a simple IP address regex will ignore this IOC entirely. Our Solution By combining specially crafted regex with some careful consideration of the problem, we can effectively extract these IOCs.

FEATURES

ALTERNATIVES

Falcon Sandbox is a malware analysis framework that provides in-depth static and dynamic analysis of files, offering hybrid analysis, behavior indicators, and integrations with various security tools.

Java code implementing the AutoYara algorithm for automatic Yara rule generation from input samples.

YARA is a tool for identifying and classifying malware samples based on textual or binary patterns.

An open-source binary debugger for Windows with a comprehensive plugin system for malware analysis and reverse engineering.

A file analysis framework that automates the evaluation of files by running a suite of tools and aggregating the output.

A powerful tool for detecting and identifying malware using a rule-based system.

Checksec is a bash script to check the properties of executables like PIE, RELRO, Canaries, ASLR, Fortify Source.

A GitHub repository for fuzzing and testing file formats