analyzing-indicators-of-compromise

1# Analyzing Indicators of Compromise
2 
3## When to Use
4 
5Use this skill when:
6- A phishing email or alert generates IOCs (URLs, IP addresses, file hashes) requiring rapid triage
7- Automated feeds deliver bulk IOCs that need confidence scoring before ingestion into blocking controls
8- An incident investigation requires contextual enrichment of observed network artifacts
9 
10**Do not use** this skill in isolation for high-stakes blocking decisions — always combine automated enrichment with analyst judgment, especially for shared infrastructure (CDNs, cloud providers).
11 
12## Prerequisites
13 
14- VirusTotal API key (free or Enterprise) for multi-AV and sandbox lookup
15- AbuseIPDB API key for IP reputation checks
16- MISP instance or TIP for cross-referencing against known campaigns
17- Python with `requests` and `vt-py` libraries, or SOAR platform with pre-built connectors
18 
19## Workflow
20 
21### Step 1: Normalize and Classify IOC Types
22 
23Before enriching, classify each IOC:
24- **IPv4/IPv6 address**: Check if RFC 1918 private (skip external enrichment), validate format
25- **Domain/FQDN**: Defang for safe handling (`evil[.]com`), extract registered domain via tldextract
26- **URL**: Extract domain + path separately; check for redirectors
27- **File hash**: Identify hash type (MD5/SHA-1/SHA-256); prefer SHA-256 for uniqueness
28- **Email address**: Split into domain (check MX/DMARC) and local part for pattern analysis
29…