extracting-iocs-from-analysis-output

Name: extracting-iocs-from-analysis-output
Author: meltedinhex

18stars5forks

How to install extracting-iocs-from-analysis-output?

meltedinhex/analyst-ai-pack/extracting-iocs-from-analysis-output

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-iocs-from-analysis-output

Installs into the current project.

Summary

Extracts indicators of compromise from raw analysis artifacts: parsing strings

Files · 1

View on GitHub

SKILL.md

1	# Extracting IOCs from Analysis Output
2
3	## When to Use
4
5	- You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic
6	indicators out of it.
7	- You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection.
8	- You are building the indicator section of a report from analysis artifacts.
9
10	Do not use naive substring matching that produces noise — validate indicator shapes and
11	filter obvious false positives (version strings that look like IPs, library domains).
12
13	## Prerequisites
14
15	- The analysis artifacts as text/JSON; the defanging skill for safe output.
16
17	## Workflow
18
19	### Step 1: Gather the artifacts
20
21	Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into
22	text the extractor can scan.
23
24	### Step 2: Extract by pattern
25
26	Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with
27	validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the
28	format allows.
29
30	```bash
31	python scripts/analyst.py extract analysis.txt
32	```
33
34	### Step 3: Filter and deduplicate
35
36	Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate;
37	keep a record of what was filtered and why.
38
39	### Step 4: Type and hand off
40
41	Tag each indicator with its type and pass the set to enrichment/defanging for reporting.
42
43	## Validation
44
45	- Extracted indicators match valid shapes (no malformed IPs/hashes).
46	- The set is deduplicated and obvious benign noise is filtered with a rationale.
47	- Each indicator is typed and ready for enrichment/defanging.
48
49	## Pitfalls
50
51	- Capturing version numbers as IPs or library hostnames as C2.
52	- Missing indicators split across lines or encoded (base64) in the artifacts.
53	- Not recording what was filtered, losing analyst auditability.
54
55	## References
56
57	- See [`references/api-reference.md`](references/api-reference.md) for the IOC extractor.
58	- MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

extracting-iocs-from-analysis-output

18stars5forks

View on GitHub

How to install extracting-iocs-from-analysis-output?

meltedinhex/analyst-ai-pack/extracting-iocs-from-analysis-output

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-iocs-from-analysis-output

Installs into the current project.

Summary

Extracts indicators of compromise from raw analysis artifacts: parsing strings

Files · 1

View on GitHub

SKILL.md

1	# Extracting IOCs from Analysis Output
2
3	## When to Use
4
5	- You have raw analysis output (strings, sandbox JSON, PCAP notes, logs) and need the atomic
6	indicators out of it.
7	- You want a deduplicated, typed indicator set to feed enrichment, defanging, or detection.
8	- You are building the indicator section of a report from analysis artifacts.
9
10	Do not use naive substring matching that produces noise — validate indicator shapes and
11	filter obvious false positives (version strings that look like IPs, library domains).
12
13	## Prerequisites
14
15	- The analysis artifacts as text/JSON; the defanging skill for safe output.
16
17	## Workflow
18
19	### Step 1: Gather the artifacts
20
21	Collect strings output, sandbox report fields, network summaries, and relevant log excerpts into
22	text the extractor can scan.
23
24	### Step 2: Extract by pattern
25
26	Pull URLs, domains, IPv4 addresses, email addresses, and hashes (MD5/SHA-1/SHA-256) with
27	validated patterns; also capture host artifacts (mutexes, registry keys, file paths) where the
28	format allows.
29
30	```bash
31	python scripts/analyst.py extract analysis.txt
32	```
33
34	### Step 3: Filter and deduplicate
35
36	Drop benign noise (Microsoft/CDN domains, localhost, RFC1918 where irrelevant) and deduplicate;
37	keep a record of what was filtered and why.
38
39	### Step 4: Type and hand off
40
41	Tag each indicator with its type and pass the set to enrichment/defanging for reporting.
42
43	## Validation
44
45	- Extracted indicators match valid shapes (no malformed IPs/hashes).
46	- The set is deduplicated and obvious benign noise is filtered with a rationale.
47	- Each indicator is typed and ready for enrichment/defanging.
48
49	## Pitfalls
50
51	- Capturing version numbers as IPs or library hostnames as C2.
52	- Missing indicators split across lines or encoded (base64) in the artifacts.
53	- Not recording what was filtered, losing analyst auditability.
54
55	## References
56
57	- See [`references/api-reference.md`](references/api-reference.md) for the IOC extractor.
58	- MITRE ATT&CK and indicator-extraction patterns (linked in frontmatter).

People who liked this also viewed

6 picks

Type