skills.rest
jmagly
jmaglyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ioc-extraction

Extracts and classifies ICOs from investigatorial source files, mapping them to STIX 2.1 objects.

175|26|Updated Aug 14, 2025
Search Tags:#cybersecurity#threat intelligence#forensics#ioc#stix#indicator extraction
One-click install
npx skills add https://github.com/jmagly/aiwg --skill ioc-extraction-jmagly
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ioc-extraction
Source: https://github.com/jmagly/aiwg/tree/main/agentic/code/frameworks/forensics-complete/skills/ioc-extraction
Command: npx skills add https://github.com/jmagly/aiwg --skill ioc-extraction-jmagly

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the tedious and error-prone process of manually identifying and cataloging Indicators of Compromise (IOCs) from various digital investigation artifacts.

Core Features & Use Cases

  • Comprehensive Extraction: Identifies and extracts a wide range of IOCs including IP addresses, domain names, file hashes, URLs, email addresses, file paths, and registry keys.
  • Intelligent Classification & Deduplication: Automatically classifies each IOC by type and removes duplicates, ensuring a clean and actionable dataset.
  • STIX 2.1 Mapping: Generates a STIX 2.1 observable bundle, enabling seamless integration with threat intelligence platforms and SIEMs.
  • Use Case: After a security incident, use this skill to quickly process log files and memory dumps to generate a STIX report of all identified malicious indicators, ready for ingestion into your threat hunting tools.

Quick Start

Use the ioc-extraction skill to extract indicators from all files under the .aiwg/forensics directory.

Frequently Asked Questions about ioc-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract Indicators of Compromise from log files and memory analysis output?▼

IOC extraction automates identifying and cataloging indicators like IP addresses, file hashes, URLs, and registry keys from investigation artifacts such as log files and memory dumps. It processes various input formats to generate a clean, actionable dataset of threats.

Can I convert extracted IOCs into STIX 2.1 format for threat intelligence platforms?▼

STIX 2.1 mapping converts extracted and classified IOCs into a STIX observable bundle, enabling seamless integration with threat intelligence platforms and SIEMs. This standardizes your incident data for immediate ingestion into threat hunting tools.

What is the best way to deduplicate and classify threat intelligence indicators from findings documents?▼

Intelligent classification and deduplication automatically categorizes each IOC by type and removes duplicates during extraction. This ensures the resulting dataset from your findings documents is clean, classified, and actionable without manual review.

Does IOC extraction support registry keys and file paths from forensic artifacts?▼

Comprehensive IOC extraction supports a wide range of indicators including file paths, registry keys, IP addresses, domain names, file hashes, URLs, and email addresses. It processes these directly from digital investigation artifacts.

How do I generate a STIX report of malicious indicators after a security incident?▼

Processing your post-incident log files and memory dumps through IOC extraction generates a STIX 2.1 report of all identified malicious indicators. This report is ready for ingestion into your threat hunting and intelligence tools.

Related Skills

Explore More Software Engineering Skills→
georgekhananaevgeorgekhananaev
27

pdf

Extract PDF text and tables into CSV/JSON formats using Python libraries.

Community
Advanced
Liberty91LTDLiberty91LTD
15

stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

Official
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
dreadnodedreadnode
11

spyware-hunt

Correlate STIX indicators with iOS system artifacts to detect mercenary spyware.

Official
Advanced