SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
extracting-iocs-from-analysis-output
0
Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. Activates for requests to extract IOCs from analysis output, pull indicators from a report, or harvest atomic indicators.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Extracting IOCs from Analysis Output ## When to Use - You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic indicators out of it. - You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection. - You are building the indicator section of a report from analysis artifacts. **Do not use** naive substring matching that produces noise — validate indicator shapes and filter obvious false positives (version strings that look like IPs, library domains). ## Prerequisites - The analysis artifacts as text/JSON; the defanging skill for safe output. ## Workflow ### Step 1: Gather the artifacts Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into text the extractor can scan. ### Step 2: Extract by pattern Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the format allows. ```bash python scripts/analyst.py extract analysis.txt ``` ### Step 3: Filter and deduplicate Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate; keep a record of what was filtered and why. ### Step 4: Type and hand off Tag each indicator with its type and pass the set to enrichment/defanging for reporting. ## Validation - Extracted indicators match valid shapes (no malformed IPs/hashes). - The set is deduplicated and obvious benign noise is filtered with a rationale. - Each indicator is typed and ready for enrichment/defanging. ## Pitfalls - Capturing version numbers as IPs or library hostnames as C2. - Missing indicators split across lines or encoded (base64) in the artifacts. - Not recording what was filtered, losing analyst auditability. ## References - See [`references/api-reference.md`](references/api-reference.md) for the IOC extractor. - MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).