Package: iocide
iocideDefanged/Obfuscated Indicator of Compromise (IOC) Detectioniocideuses programatically-generated regular expressions to capture IOC
values that may have been defanged and/or obfuscated using a range of
techniques.Expressions for each IOC type have been tailored to the relevant specification
standard, allowing identification of values obfuscated with combinations of
defanging, alternate unicode characters, and unusual edge-case formatting.AuthorDavid Finn:dsfinn@gmail.comFeaturesDetected IOC Typesiocidecan detect multiple IOC types, including:remote URLsremote IPsremote hostnamesemail addresseshashesDocument Typesiocideautomatically detects and decodes PDF and zip files, including modern
Microsoft Office documents.
Other data will be inspected for text encoding usingchardet.This automatic decoding extends to embedded binary values in input text,
meaning thatiocideis able to detected PDF, zip/Office, and text files
encoded as text blobs to arbitrary depth.Text DeobfuscationInvokingiocidewithout the--rawparameter will cause unicode characters
in the input text to be converted to ASCII where possible usingunidecode.
IOC values will be extracted from this normalised text, neutralising
obfuscation based on unicode character substitution.Encoded Binaryiocidecan detect (and optionally refang) binary blobs encoded according toRFC 3548,
including:base16base32base64Binary-Embedded Textiocidecan automatically inspect detected binary blobs for text encodings.
Detected text can be searched for IOCs to arbitrary recursion depth.
By default, only embedded text binaries found in the top level text will be
further inspected.Installationpip install iocideCommand Line QuickstartSeeiocide -hfor parameters and subcommands.iocidereads text fromstdinand writes detected IOC values tostdout.
If invoked without arguments, it will search for all known IOC types including
binary blobs and binary-embedded text.The--refangflag (shortcut-r) will causeiocideto normalise detected
values to their 'fanged' representations if the IOC type supports refanging.By default,iocidewill normalise input text by replacing non-ASCII
characters with ASCII where possible.
This behaviour can be deactivated using the--rawflag.Finding defanged IOCs in textecho "fake1,Ħ×Xƥŝ://ÀÇÈÌÐÑ<ąŧ>ƒơő[.ƃăr.)ḅȃź{ďōţ}çøm<fake2>" | iocideOutput:HxXps://ACEIDN<at>foo[.bar.)baz
//ACEIDN<at>foo[.bar.)baz
foo[.bar.)bazRefanging detected IOCsecho "fake1,Ħ×Xƥŝ://ÀÇÈÌÐÑ<ąŧ>ƒơő[.ƃăr.)ḅȃź{ďōţ}çøm<fake2>" | iocide --refangOutput:https://ACEIDN@foo.bar.baz
//ACEIDN@foo.bar.baz
foo.bar.bazFinding a specific IOC typecat suspicious_document.txt | iocide url
cat suspicious_document.txt | iocide --refang urlFinding binary-embedded textcat suspicious_document.txt | iocide secretsFilter output for unique valuescat suspicious_document.txt | iocide | sort -uSpecify an input pathFor large input, buffering file content from stdin can be avoided by specifying
an input file using--input:iocide --input some/path.txtPython Interfaceimportiocidesome_raw_text=...# Normalise text characters to ascii where possiblesome_text=iocide.normalise(some_raw_text)# extract_all will extract all known IOC typesfordefanged_iociniocide.extract_all(text=some_text,refang=False):...forrefanged_iociniocide.extract_all(text=some_text,refang=True):...# Use the appropriate submodule to extract a specific IOC type# e.g. for url:fordefanged_urliniocide.url.extract(text=some_text,refang=False):...forrefanged_urliniocide.url.extract(text=some_text,refang=True):...# To find all text contents of data including encoded text embedded as binary# blobs to an arbitrary depth of recursion:withopen('some/file')asdata_file:fortextiniocide.blobs.extract_text(data=data_file,depth=None):...# To exclude text from the top level of encoding, use blobs.extract_text with# `embedded_only=True`:withopen('some/file')asdata_file:forsecretiniocide.blobs.extract_text(data=data_file,embedded_only=True,depth=3):...To facilitate advanced use of detected IOC values, generated values are
instances of appropriate built-in Python types.
For example, URL values are instances ofurllib.parse.ParseResult.Some IOC types don't correspond to a built-in Python type (such as hashes),
and are generated asstrobjects.All generated values can be converted to strings by calling thestrconstructor:str(defanged_url)str(refanged_url)Custom subclasses have been used to faciliatestrconstruction and defanged
text preservation where necessary.
These subclasses can be inspected in the relevant module.