ioc-extraction

What problem does it solve?

This Skill automates the tedious and error-prone process of manually identifying and cataloging Indicators of Compromise (IOCs) from various digital investigation artifacts.

Core Features & Use Cases

• Comprehensive Extraction: Identifies and extracts a wide range of IOCs including IP addresses, domain names, file hashes, URLs, email addresses, file paths, and registry keys.
• Intelligent Classification & Deduplication: Automatically classifies each IOC by type and removes duplicates, ensuring a clean and actionable dataset.
• STIX 2.1 Mapping: Generates a STIX 2.1 observable bundle, enabling seamless integration with threat intelligence platforms and SIEMs.
• Use Case: After a security incident, use this skill to quickly process log files and memory dumps to generate a STIX report of all identified malicious indicators, ready for ingestion into your threat hunting tools.

Quick Start

Use the ioc-extraction skill to extract indicators from all files under the .aiwg/forensics directory.