ioc-hunter
IOC Hunter finds indicators of compromise (IOC). The parse_iocs function can extract IOCs from text.
The type_ioc function can determine the IOC type of a string that you pass in.
The IOCs that are recognized are:
- ssdeep
- sha256
- sha1
- md5
- ipv4_public
- ipv4_private
- ipv6_public
- ipv6_private
- filename
- domain
- url
Parse IOCs
The parse_iocs function parses IOCs in the list above from text. There is an option
to defang the IOCs that are passed back as well as an option to provide a whitelist regex.
This will also return IOCs labeled as unknown when text is found to be suspicious, but doesn't
match any of the IOC types.
from ioc_hunter import parse_iocs
text = "Your text goes here"
whitelist = r".*internaldomain\.com.*"
iocs = parse_iocs(text, defang=False, whitelist_regex=whitlist)
parse_iocs
Params:
text – A string to parse.
defang – If True, defang any IOCs we can (see DEFANGABLE). If False, return IOCs in their fanged state.
whitelist_regex – Any IOC matching this regex will be ignored
iocs_to_parse – A list of IOC types to look for (see IOC_TYPES_SEARCH_ORDER for options)
whitelist_domains – A list or CSV of domains to exclude from results. Excludes domains and URLs that match
whitelist_ip_cidr_ranges – A list or CSV of CIDR ranges to exclude from results. Excludes IPs and URLs that match
Returns:
A dictionary with the ioc type as the key and a list of iocs for each value.
Type IOC
The type_ioc function takes in text and determines if that text matches any of the IOC types.
If it does not match any, it will return unkown.
from ioc_hunter import type_ioc
suspected_ioc = "mydomain.com"
ioc_type = type_ioc(suspected_ioc)
type_ioc
Params:
ioc – The IOC to classify.
types_to_find – A list of types you want to look for.
Returns:
The type of the IOC as a string, (see IOC_TYPES_SEARCH_ORDER for options)
1 maintainer
Metadata
1 maintainer
Release files for ioc-hunter 1.4.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ioc_hunter-1.4.3.tar.gz | 3.6 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ioc_hunter-1.4.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 7.2 MB
Release files / ioc_hunter-1.4.3.tar.gz
| Download URL | ioc_hunter-1.4.3.tar.gz |
|---|---|
| Size | 3.6 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2ca466a6e26d0d69d03e833fadf706b8cb5a6f463c1242573fa4c48e6323341b
|
|
BLAKE2b-256 checksum How to use checksums |
a764fe2682e673d8f92848766ab429a6f7f838bc96ac63dedb72a5f0c0ce9428
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.9.25
|
Release files / ioc_hunter-1.4.3-py3-none-any.whl
| Download URL | ioc_hunter-1.4.3-py3-none-any.whl |
|---|---|
| Size | 3.6 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4a2dd4cf1f932c1c5d9b9bd1a997cbf9fede248aa26605a07eaeb5def8dd1a96
|
|
BLAKE2b-256 checksum How to use checksums |
68ada73280bbd7abf243af5024fe67d80ba6e95b03ca7b36ae2219f708e0b968
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.9.25
|
