IOC Extractor (Indicators of Compromise from Text)

Extract indicators from a report

Paste a vendor advisory, a SIEM alert, an email header or a sandbox log. Indicators are listed under one heading per type with a count, each one once, in the order it first appears, and written in defanged form, ready to paste into a ticket, a chat or a blocklist request.

Defanged in, defanged out

Reports arrive defanged and tooling wants them clean. The input is refanged first, so hxxps://evil[.]com/a and evil[.]com are matched as the real URL and domain, then every network indicator is defanged again on the way out:

• https://evil.com/a.php becomes hxxps://evil[.]com/a.php
• 198.51.100.7 becomes 198[.]51[.]100[.]7
• 2001:db8::1 becomes 2001[:]db8[:][:]1

Checks before listing

Domains and URL hosts must end in a real top-level domain, IPv4 octets must be 0-255, IPv6 must parse, and hashes must be exactly 32, 40, 64 or 128 hex characters. Bare names ending in file extensions that double as top-level domains, such as dropper.zip or stage2.sh, are treated as files, which keeps payload names out of the domain list.

Raw lists

For undefanged output, CSV with line numbers or JSON for a script, open the full Text Pattern Extractor with the same types selected.