defanging-and-sharing-iocs

Name: defanging-and-sharing-iocs
Author: meltedinhex

18stars5forks

How to install defanging-and-sharing-iocs?

meltedinhex/analyst-ai-pack/defanging-and-sharing-iocs

$npx -y skills add meltedinhex/analyst-ai-pack --skill defanging-and-sharing-iocs

Installs into the current project.

Summary

Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs,

Files · 1

View on GitHub

SKILL.md

1	# Defanging and Sharing IOCs
2
3	## When to Use
4
5	- You are about to put indicators in a report, ticket, chat, or email and must prevent accidental
6	clicks or resolution.
7	- You need to export indicators in a structured format for a sharing platform (MISP/STIX) or feed.
8	- You are normalizing a messy indicator list before distribution.
9
10	Do not use raw, live indicators in any document a human or tool might auto-process — a clicked
11	URL or auto-resolved domain can tip off the adversary or infect a reader.
12
13	## Prerequisites
14
15	- A list of extracted indicators (from the IOC-extraction skill) and the target sharing format.
16
17	## Workflow
18
19	### Step 1: Normalize the indicators
20
21	Deduplicate and canonicalize (lowercase domains, strip trailing dots) so the output is clean.
22
23	### Step 2: Defang for safety
24
25	Apply standard defanging: `http`→`hxxp`, `.`→`[.]`, `@`→`[at]`, `://`→`[://]`. This blocks
26	hyperlinking and casual copy-paste resolution.
27
28	```bash
29	python scripts/analyst.py defang iocs.txt
30	```
31
32	### Step 3: Classify and structure
33
34	Tag each indicator by type (url, domain, ipv4, email, hash) and emit a structured form (CSV or a
35	minimal STIX-style bundle) for the target platform.
36
37	### Step 4: Add context
38
39	Attach the source, first-seen date, confidence, and related ATT&CK technique so consumers can
40	act on the indicator.
41
42	## Validation
43
44	- No output indicator is clickable or auto-resolvable (all are defanged).
45	- Each indicator is correctly typed and deduplicated.
46	- The structured export imports cleanly into the target platform.
47
48	## Pitfalls
49
50	- Defanging inconsistently, so some indicators remain live.
51	- Sharing indicators without context (source, confidence), reducing their value.
52	- Over-defanging hashes (no need) or mangling indicators so they cannot be re-fanged for use.
53
54	## References
55
56	- See [`references/api-reference.md`](references/api-reference.md) for the defang/export helper.
57	- STIX 2.1 and MISP (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

defanging-and-sharing-iocs

18stars5forks

View on GitHub

How to install defanging-and-sharing-iocs?

meltedinhex/analyst-ai-pack/defanging-and-sharing-iocs

$npx -y skills add meltedinhex/analyst-ai-pack --skill defanging-and-sharing-iocs

Installs into the current project.

Summary

Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs,

Files · 1

View on GitHub

SKILL.md

1	# Defanging and Sharing IOCs
2
3	## When to Use
4
5	- You are about to put indicators in a report, ticket, chat, or email and must prevent accidental
6	clicks or resolution.
7	- You need to export indicators in a structured format for a sharing platform (MISP/STIX) or feed.
8	- You are normalizing a messy indicator list before distribution.
9
10	Do not use raw, live indicators in any document a human or tool might auto-process — a clicked
11	URL or auto-resolved domain can tip off the adversary or infect a reader.
12
13	## Prerequisites
14
15	- A list of extracted indicators (from the IOC-extraction skill) and the target sharing format.
16
17	## Workflow
18
19	### Step 1: Normalize the indicators
20
21	Deduplicate and canonicalize (lowercase domains, strip trailing dots) so the output is clean.
22
23	### Step 2: Defang for safety
24
25	Apply standard defanging: `http`→`hxxp`, `.`→`[.]`, `@`→`[at]`, `://`→`[://]`. This blocks
26	hyperlinking and casual copy-paste resolution.
27
28	```bash
29	python scripts/analyst.py defang iocs.txt
30	```
31
32	### Step 3: Classify and structure
33
34	Tag each indicator by type (url, domain, ipv4, email, hash) and emit a structured form (CSV or a
35	minimal STIX-style bundle) for the target platform.
36
37	### Step 4: Add context
38
39	Attach the source, first-seen date, confidence, and related ATT&CK technique so consumers can
40	act on the indicator.
41
42	## Validation
43
44	- No output indicator is clickable or auto-resolvable (all are defanged).
45	- Each indicator is correctly typed and deduplicated.
46	- The structured export imports cleanly into the target platform.
47
48	## Pitfalls
49
50	- Defanging inconsistently, so some indicators remain live.
51	- Sharing indicators without context (source, confidence), reducing their value.
52	- Over-defanging hashes (no need) or mangling indicators so they cannot be re-fanged for use.
53
54	## References
55
56	- See [`references/api-reference.md`](references/api-reference.md) for the defang/export helper.
57	- STIX 2.1 and MISP (linked in frontmatter).

People who liked this also viewed

6 picks

Type