IOC Extractor

Indicators of compromise (IOCs) are forensic artefacts that show a system may have been breached: an IP address that served malware, a domain used for command and control, the hash of a dropper, a phishing sender. In IOC cybersecurity work, analysts share IOCs in reports, STIX bundles and MISP events so other teams can search their logs and block the same infrastructure.

IOCs are reactive and short-lived: attackers change IPs and domains cheaply. Hashes are precise but break with a one-byte change. Treat a match as a lead to investigate, and age out network indicators after a few weeks unless they are re-observed.

Indicators of attack (IOAs) describe behaviour rather than artefacts: an Office process spawning PowerShell, credential dumping from LSASS, a burst of failed logins followed by a success. IOAs survive infrastructure changes because they target what the attacker must do, not what they used.

A mature IOC security programme uses both: IOCs for fast blocking and retro-hunting, IOAs for detection rules that catch the next campaign. The KQL & SPL Query Builder on this site turns extracted IOCs into hunting queries for Sentinel and Splunk.

Each category uses a tuned regular expression, followed by validation that removes false positives. The IP address regex accepts only octets from 0 to 255, so version numbers like 10.2.300.4 are discarded. Domains must end in a plausible top-level domain, so file names like invoice.pdf and config.json are not reported as hosts. Hash patterns require word boundaries and exact lengths: 32 hex digits for MD5, 64 for SHA-256.

Before matching, the text is refanged internally: [.], (.), [dot], hxxp, [:] and [@] are normalised so defanged reports extract cleanly. Results are deduplicated case-insensitively for domains and hashes.

• IPv4 regex used: \b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b.
• CVE IDs follow CVE-YYYY-NNNN with four or more digits in the sequence number.
• Private and reserved IPs are tagged so you can drop internal addresses before sharing.

Defanging makes an indicator non-clickable and non-resolvable: https://evil.example/payload becomes hxxps://evil[.]example/payload. Defang every URL, domain and IP before pasting into tickets, chat or email; mail clients and chat apps auto-link and pre-fetch URLs, which can alert the attacker or infect a reader. Refang only inside tools that need the live value, such as a blocklist import.

Exports keep the category of every indicator. CSV output has type,value rows that import cleanly into spreadsheets, firewall object lists and EDR custom-indicator uploads. JSON output groups values by type, which suits scripts, SOAR playbooks and threat-intelligence platforms. Both exports respect the defang toggle, so you can produce a safe copy for a report and a live copy for a blocklist from the same extraction.