extracting-iocs-from-malware-samples

You can extract network IOCs like IPs, domains, and URLs by applying the analysis to PCAPs and sandbox reports. The Skill aggregates these network indicators alongside host artifacts and exports them as structured CSV files and STIX 2.1 bundles.

Yes, the Skill optionally validates extracted IOCs with VirusTotal to ensure credibility. It also defangs indicators during processing to ensure safe sharing of STIX 2.1 bundles and CSV files across threat intelligence platforms.

Yes, the IOC extraction tool requires pefile for PE file analysis and yara-python for rule matching. It also uses requests to optionally validate the extracted file hashes, network indicators, and host artifacts with external threat intelligence sources.

The best way to export malware threat intelligence as a STIX 2.1 bundle is to run the IOC extraction on a malware sample path. The Skill collects hashes, network IOCs, and host artifacts, automatically generating defanged STIX 2.1 and CSV outputs.

You extract file hashes and Imphash from PE files by processing the malware sample through the Skill. It computes MD5, SHA-1, and SHA-256 hashes alongside PE import hashes, adding them to your structured CSV and STIX 2.1 threat intelligence artifacts.