Extract, classify, deduplicate, and enrich IOCs from investigation artifacts; map to STIX 2.1 observables
Scans investigation artifacts — log files, memory analysis output, findings documents, and raw captures — to extract indicators of compromise. Classifies each indicator by type, deduplicates, and produces a STIX 2.1 observable bundle alongside a flat IOC list for import into SIEMs and threat intelligence platforms.
Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):
IOCs extracted during investigation have value beyond the current case: they feed detection rules, threat intelligence platforms, and network blocklists. Raw extraction without classification and deduplication produces noise. This skill applies consistent extraction patterns and maps output to STIX 2.1 so findings integrate with standard threat intelligence tooling.
When triggered, this skill:
Identify input sources:
.aiwg/forensics/ if no path is specifiedExtract IP addresses:
\b(?:\d{1,3}\.){3}\d{1,3}\b, validate octets are 0-255Extract domain names and hostnames:
\b(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}\bExtract file hashes:
Extract URLs:
http with hxxp, . with [.] in outputExtract email addresses:
Extract file paths and registry keys:
/[a-zA-Z0-9._/-]+[A-Za-z]:\\[^\s"]+HK(LM|CU|CR|U|CC)\\[^\s"]+Classify and deduplicate:
ipv4-addr or ipv6-addrdomain-nameurlfile with hashes propertyemail-addrfilewindows-registry-keyProduce STIX 2.1 bundle:
observable-objects entries per STIX 2.1 specificationcreated and modified timestampsreport object referencing the investigation IDWrite outputs:
.aiwg/forensics/iocs/<investigation>-iocs.txt (one indicator per line, typed prefix).aiwg/forensics/iocs/<investigation>-stix.json.aiwg/forensics/iocs/<investigation>-ioc-summary.mdextract iocs
extract indicators from .aiwg/forensics/findings/webserver-01-linux.md
ioc analysis --allowlist /etc/forensics/trusted-domains.txt
.aiwg/forensics/iocs/<investigation>-iocs.txt.aiwg/forensics/iocs/<investigation>-stix.json.aiwg/forensics/iocs/<investigation>-ioc-summary.mdioc_extraction:
exclude_private_ips: true
exclude_loopback: true
exclude_multicast: true
dga_entropy_threshold: 3.5
weak_hash_algorithms:
- md5
- sha1
defang_urls: true
stix_version: "2.1"
domain_allowlist: []
ip_allowlist: []