bokamba / iocex / docs

$ iocex --help

IOC Extractor reference

What the IOC Extractor detects, and how it recovers defanged indicators. Everything runs client-side — paste a threat report, log, or advisory and pull out every indicator, deduped and honestly flagged. Nothing is uploaded.

Indicator types

The engine detects 15 indicator types. 3 of them (registry key, file path and Bitcoin address) are inherently ambiguous, so they carry a heuristic badge — labelled best-effort, never authoritative. Nothing is ever dropped without a visible reason.

type what it matches notes
IPv4 Dotted-quad addresses, e.g. 185.220.101.45 Private / loopback / doc-range / reserved ranges are kept but flagged.
IPv6 Full and :: compressed addresses, e.g. 2001:db8::1 Same range flags as IPv4 (loopback ::1, doc-range 2001:db8::/32, link-local fe80::/10, multicast ff00::/8).
Domain Registrable hostnames, e.g. malicious.top Domains on a curated allowlist are flagged “benign”.
URL http/https/ftp URLs, e.g. http://malicious.top/gate.php Defanged schemes (hxxp, meow://, fxp://) are refanged first.
Email Well-formed addresses, e.g. [email protected] Bracketed at-sign ([@], (@)) is refanged before detection.
MD5 32 hex characters Classified by length; validated as hexadecimal.
SHA-1 40 hex characters Classified by length; validated as hexadecimal.
SHA-256 64 hex characters Classified by length; validated as hexadecimal.
SHA-512 128 hex characters Classified by length; validated as hexadecimal.
CVE CVE-YYYY-NNNN identifiers (any case) Normalized to the canonical upper-case form.
MAC address Six colon- or hyphen-separated hex octets, e.g. 00:1b:44:11:3a:b7 Hardware / interface addresses.
UUID RFC 4122 UUIDs, e.g. 550e8400-e29b-41d4-a716-446655440000 Case-insensitive; normalized to lower case.
Registry key heuristic Windows registry paths, e.g. HKLM\Software\Run Heuristic — labelled, never authoritative.
File path heuristic Windows / UNC file paths, e.g. C:\Windows\Temp\a.exe Heuristic — labelled, never authoritative.
Bitcoin address heuristic Base58 / bech32 BTC addresses, e.g. 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa Heuristic — labelled, never authoritative.

Defang & refang styles

Analysts defang indicators so they can't be clicked or resolved by accident — writing hxxp://malicious[.]top instead of a live URL. Before detection, the extractor refangs the whole input, so a neutralized indicator is recovered as its real value and flagged was defanged. Every style below round-trips refang(defanged) === real.

style defanged refanged
bracket-dot [.] .
paren-dot (.) .
brace-dot {.} .
word-dot-bracket [dot] .
word-dot-paren (dot) .
bracket-colon [:] :
bracket-scheme-sep [://] ://
bracket-at [@] @
paren-at (@) @
hxxp-scheme hxxp:// http://
hXXp-scheme hXXp:// http://
hstar-scheme h**p:// http://
hxxps-scheme hxxps:// https://
meow-scheme meow:// http://
fxp-scheme fxp:// ftp://

Note: the backslash-escaped dot (\.) is deliberately NOT refanged — it collides with regex, Sigma and YARA rules a SOC analyst commonly pastes (\.top, \d+\.\d+), and refanging it would corrupt the rule. Scheme neuters (hxxp, h**p, meow://) are only refanged at a scheme position, so a host or word merely containing the substring is left untouched.

Extract a specific type

Worked examples per indicator type — each runs a real sample through the engine at build time, defanged indicators included:

Open the extractor

Paste any threat report, advisory, or log and pull out every indicator — deduped, counted, and honestly flagged. Free, no account, 100% in your browser.

Open the IOC Extractor →