NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Malware Analysis
Automated IOC Extraction
Master automated IOC extraction. Learn to use Python and regex to extract IPs, domains, hashes, and URLs from malware configs and memory dumps.
Room tasks
1What Is Automated IOC Extraction and Why Does It Matter
2Regex Patterns for IPs, Domains and Hashes
3Guided Lab: Building an IOC Extraction Script
Frequently Asked Questions
What is IOC extraction?
IOC extraction is the process of pulling indicators of compromise, such as IP addresses, domains, file hashes and URLs, out of malware samples, memory or reports so defenders can block and hunt for them.
Why use Python and regex to extract IOCs?
Regular expressions can match patterns like IPv4 addresses, domains and hashes quickly across large datasets. Combined with Python, they let analysts automate repetitive extraction and feed results straight into detection tooling.
Can extracted IOCs be turned into detections?
Yes. Extracted indicators and strings can be used to write YARA rules, blocklists and SIEM searches. This free Codelivly room shows how to move from raw extraction to detection content.