skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

collecting-indicators-of-compromise

Collects, enriches, and distributes indicators of compromise using STIX/TAXII and threat intelligence platforms.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat intelligence#ioc enrichment#misp#stix taxii#ioc collection#threat indicators
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill collecting-indicators-of-compromise
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: collecting-indicators-of-compromise
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/collecting-indicators-of-compromise
Command: npx skills add https://github.com/xalgord/xalgorix --skill collecting-indicators-of-compromise

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During and after a security incident, analysts must turn raw evidence into actionable indicators of compromise, but ad-hoc collection misses artifact categories, produces unenriched or false-positive IOCs, and risks leaking internal data when sharing with partners.

Core Features & Use Cases

  • Systematic IOC Extraction: Collects network, host, and email indicators from SIEM logs, memory forensics, disk images, and malware sandbox reports.
  • Enrichment and Scoring: Correlates indicators with VirusTotal, Shodan, and MISP data, then assigns confidence scores and TLP classifications.
  • STIX 2.1 Distribution: Packages validated IOCs as STIX bundles for MISP, TAXII feeds, and ISAC sharing, plus pushes them to firewalls, EDR, DNS, and email gateways for blocking.
  • Use Case: After a Qakbot infection leading to Cobalt Strike deployment, compile all observed C2 IPs, hashes, registry keys, and phishing artifacts, enrich them, and export a TLP:AMBER STIX bundle to FS-ISAC.

Quick Start

Collect and enrich all indicators of compromise from this incident's evidence and export them as a STIX 2.1 bundle for MISP sharing.

Frequently Asked Questions about collecting-indicators-of-compromise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect indicators of compromise during incident response?▼

Extract indicators across network, host, and email categories from SIEM logs, memory dumps, disk images, and sandbox reports. Then enrich each IOC with threat intelligence, assign confidence scores, and distribute them to firewalls, EDR, and DNS for blocking.

How to export IOCs in STIX 2.1 format for threat intelligence sharing?▼

Package each validated indicator as a STIX 2.1 indicator object with pattern, confidence, labels, and TLP marking definitions. Submit the bundle to MISP, an ISAC portal, or a TAXII server according to your sharing agreements.

What tools are used for IOC enrichment and management?▼

MISP and OpenCTI manage and share IOCs, while VirusTotal, AlienVault OTX, Shodan, and DomainTools provide enrichment context. Volatility handles memory forensics extraction and CyberChef assists with decoding and defanging indicators.

Why do IP and hash-based IOCs fail to stop attackers?▼

Atomic indicators like IPs, domains, and hashes decay quickly because attackers rotate infrastructure and recompile malware. Durable indicators such as registry Run keys, scheduled task names, mutexes, and named pipes provide longer-lasting detection value.

What mistakes should I avoid when sharing IOCs with partners?▼

Avoid including internal IP addresses or hostnames, sharing at the wrong TLP level, and failing to defang URLs in human-readable reports. Also validate that each indicator was directly observed in your incident rather than inherited from third-party reports.

Related Skills

Explore More Software Engineering Skills→
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
MHaggisMHaggis
471

threat-report-parser

Parse threat reports and generate SIEM-specific detection rules mapped to MITRE ATT&CK.

Community
Advanced