IOC Extractor
Stays in this tab
Text in, indicators out
Paste strings output, a memory-dump extract, a proxy log or an email header block, and pull the addresses, domains, mailboxes and file hashes out of it as distinct lists.
IOC Extractor
Paste text, logs, or strings output below to extract potential Indicators of Compromise.
Working With Extracted Indicators
- Patterns, not verdicts: A match means the text looks like an indicator. Confirm the context before you call it malicious.
- Hashes: MD5, SHA1 and SHA256 are matched by length, so a 32-character fragment of a longer value will appear as an MD5.
- False positives: Domains, version strings and build identifiers share the same shape. Sort by which source produced the match, not by count alone.
- Pivoting: Feed the hashes to a reputation service, then the domains and IPs to passive DNS and certificate transparency.
- Sharing: Defang what you export before it goes into a report or a ticket, so a link cannot be clicked by accident.
- Provenance: Record which artefact each list came from. An indicator with no source is a rumour.
Related Topics
IOC Analysis
Turning extracted indicators into a defensible assessment.
IOC Fang / Defang
Neutralise the URLs and domains you pull out here.
YARA Rules
Write detection for the samples these indicators came from.
DFIR: Memory Forensics
Where a memory-dump extract such as netscan output comes from.
Static Analysis
The triage pass that produces the strings these indicators live in.