iocextract
A Python library and CLI for extracting and refanging defanged Indicators of Compromise (IOCs) from text.
What is iocextract?
iocextract is a Python library and command-line tool for extracting Indicators of Compromise (IOCs) from text, specifically designed to handle 'defanged' IOCs that have been obfuscated to prevent accidental execution. It solves the problem of existing regex-based tools missing IOCs disguised with techniques like bracketed periods (`[.]`) or altered protocols (`hxxp://`), enabling security analysts to automatically collect and refang threat data from sources like tweets, blogs, and reports.
Security analysts, threat intelligence researchers, and incident responders who need to process unstructured text containing obfuscated IOCs, particularly those working with social media threat feeds, malware reports, or log analysis.
Developers choose iocextract for its specialized ability to accurately detect and refang a wide variety of defanging techniques out-of-the-box, its support for custom regex patterns, and its efficient iterator-based design for large datasets—making it a robust alternative to generic regex tools for security use cases.
Overview
Defanged Indicator of Compromise (IOC) Extractor.
Use Cases
Best For
- Extracting defanged URLs and IPs from Twitter or blog posts
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
