Guide
Extracting indicators of compromise from reports and logs
Incident reports, phishing e-mails and malware write-ups bury their most useful facts in paragraphs: the address a sample called home to, the hash of the dropper, the CVE it exploited. Copying them out by hand is slow and error-prone. This extractor reads any block of text and lists the indicators of compromise it contains, grouped by type and de-duplicated, ready for a blocklist, a search in your logging system or a ticket.
What it looks for
IPv4 addresses must have four parts from 0 to 255. IPv6 addresses are matched in full and compressed forms. Domains must end in a real top-level domain, so update-check.example.net counts while setup.exe and notes.md do not. URLs are recognised by their scheme, e-mail addresses by their shape. File hashes are told apart by length: 32 hexadecimal digits for MD5, 40 for SHA-1, 64 for SHA-256 and 128 for SHA-512. CVE identifiers follow the CVE-year-number pattern, and ATT&CK techniques look like T1059 or T1566.001.
A worked example
The sample is a short incident note. The page counts 15 indicators across 9 kinds: three IPv4 addresses (198.51.100.23, 203.0.113.50 and the private 10.20.30.40), one IPv6 address (2001:db8:85a3::8a2e:370:7334), two domains, two URLs, one e-mail address ([email protected]), the MD5 d41d8cd98f00b204e9800998ecf8427e, a SHA-256 beginning e3b0c442, two CVEs (CVE-2021-44228 and CVE-2023-4863) and two ATT&CK techniques (T1566.001 and T1059). Each group has its own Copy button and a count, and “Copy all as CSV” or “Download CSV” gives every row with its type.
Options
“Include private and loopback IPv4 addresses” is on by default, which is why the 10.x address appears; switch it off to leave out RFC 1918 ranges and 127.0.0.1, which are almost never useful in a blocklist. “Defang the output” rewrites the result as hxxp and [.], so you can paste it into a chat or a report without creating live links.
Edge cases
Pattern matching is fast but literal. A software version like 10.2.3.4 will pass as an address, and any 32-digit hexadecimal string, such as an identifier in a log, will pass as an MD5 hash. Text that has been split across lines by a mail client can hide an indicator. Treat the output as a first pass and read it before acting.
Limits
The page does not look anything up: it does not know whether an address belongs to a cloud provider, a CDN or an attacker. It will not find indicators that are Base64-encoded, reversed or split with extra characters. Everything is processed locally in the browser.
Working with the output
A good routine is to extract first, then sort the list into three piles: indicators that belong to the attacker, indicators that belong to you or to harmless services, and indicators you cannot yet place. Only the first pile goes into a blocklist. Save the CSV with the incident record so that later analysts can see what was found when, and re-run the extractor on new reports to compare them. Hashes are the most reliable indicators because they identify a file exactly, while addresses and domains change quickly and may be shared by innocent sites.
Related tools
- URL Defanger rewrites links so they cannot be clicked by accident.
- Hash Identifier helps when the hash type in a report is not stated.
- CVSS Calculator scores the vulnerabilities you find in the list.
- Redact Log Secrets removes credentials from logs before you share them.
Checked against the current version of the IOC Extractor on .