How does it identify potential Domain Generation Algorithms (DGA)?

It calculates Shannon entropy for domain labels; high-entropy names are flagged as potential DGA indicators for further investigator review.

How does it handle malicious URLs safely?

The skill automatically 'defangs' URLs by replacing protocols and dots (e.g., hxxp://example[.]com) to prevent accidental execution while preserving the indicator for analysis.

Does it support both IPv4 and IPv6 extraction?

Yes, it extracts both IPv4 (validating octets 0-255) and IPv6 (including full and compressed forms) while filtering out private and loopback ranges.

What file types does this skill support for IOC extraction?

The skill supports a wide range of formats including plain text, Markdown, JSON, JSONL, CSV, and various raw log file formats.

Can I integrate the output with my existing SIEM?

Yes, it produces both a flat IOC text list for easy ingestion and a standardized STIX 2.1 JSON bundle for threat intelligence platforms.

Forensic IOC Extraction & STIX Mapping

Name: Forensic IOC Extraction & STIX Mapping
Author: jmagly

byjmagly

•

102

•

Security & Testing

Automates the extraction, classification, and deduplication of Indicators of Compromise (IOCs) from forensic artifacts into STIX 2.1 compliant bundles.

The ioc-extraction skill streamlines incident response and digital forensics by automatically scanning logs, memory dumps, and investigation notes for critical threat indicators. It identifies IP addresses, domains, file hashes, URLs, and registry keys while performing essential pre-processing tasks like deduplication, URL defanging, and DGA detection. By mapping these findings directly to STIX 2.1 observables, it ensures that security findings are immediately ready for ingestion into SIEMs, threat intelligence platforms, and automated blocklists, significantly reducing the manual overhead of threat intelligence gathering during active investigations.

Key Features

01URL defanging for secure storage and information sharing

02Automatic exclusion of private infrastructure and known-good domains

03Advanced DGA detection via Shannon entropy analysis

04Deduplication and classification into STIX 2.1 observable objects

05102 GitHub stars

06Automated extraction of IPs, domains, hashes, URLs, and registry keys

Use Cases

01Converting raw incident logs into actionable threat intelligence feeds

02Rapidly identifying malicious indicators in large-scale forensic captures

03Generating standardized STIX bundles for sharing findings across security teams

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jmagly/aiwg ioc-extraction

For use in Claude.ai and ChatGPT