Python-Iocextract：高级入侵威胁标识符IoC提取工具

127[.]0[.]0[.]1

sudo apt-get install python-dev

pip install iocextract

pip install regex-2018.06.21-cp27-none-win_amd64.whl

>>>content = """... Ireally love example[.]com!...All the bots are on hxxp://example.com/bad/url these days....C2: tcp://example[.]com:8989/bad...""">>>import iocextract>>>for url in iocextract.extract_urls(content):...     print url...hxxp://example.com/bad/urltcp://example[.]com:8989/badexample[.]comtcp://example[.]com:8989/bad

>>>for url in iocextract.extract_urls(content, refang=True):...     print url...http://example.com/bad/urlhttp://example.com:8989/badhttp://example.comhttp://example.com:8989/bad

你甚至还可以提取并解码十六进制编码或Base64编码的URL地址：

>>>content ='612062756e6368206f6620776f72647320687474703a2f2f6578616d706c652e636f6d2f70617468206d6f726520776f726473'>>>for url in iocextract.extract_urls(content):...     print url...687474703a2f2f6578616d706c652e636f6d2f70617468>>>for url in iocextract.extract_urls(content, refang=True):...     print url...http://example.com/path

>>>list(iocextract.extract_urls(content))['hxxp://example.com/bad/url','tcp://example[.]com:8989/bad', 'example[.]com','tcp://example[.]com:8989/bad']

命令行工具还包括：

$iocextract -husage:iocextract [-h] [--input INPUT] [--output OUTPUT] [--extract-emails]              [--extract-ips] [--extract-ipv4s][--extract-ipv6s]              [--extract-urls] [--extract-yara-rules][--extract-hashes]              [--custom-regex REGEX_FILE][--refang] [--strip-urls]              [--wide] AdvancedIndicator of Compromise (IOC) extractor. If no arguments arespecified,the default behavior is to extract all IOCs. optional arguments:  -h, --help            show this help message and exit  --input INPUT         default: stdin  --output OUTPUT       default: stdout  --extract-emails  --extract-ips  --extract-ipv4s  --extract-ipv6s  --extract-urls  --extract-yara-rules  --extract-hashes  --custom-regex REGEX_FILE                        file with custom regexstrings, one per line, with one                        capture group each  --refang              default: no  --strip-urls          remove possible garbage from the endof urls. default:                        no  --wide                preprocess input to allowwide-encoded character                        matches. default: no

目前，该工具只支持恢复URL、电子邮件以及IPv4地址。