# Automated IOC Extraction

> Master automated IOC extraction. Learn to use Python and regex to extract IPs, domains, hashes, and URLs from malware configs and memory dumps.

Canonical: https://codelivly.com/rooms/automated-ioc-extraction
Last updated: 2026-09-21

| | |
|---|---|
| Level | Intermediate |
| Category | Malware Analysis |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This module focuses on the critical skill of programmatically extracting Indicators of Compromise (IOCs) from malware samples and memory artifacts. You will learn to write Python scripts using regular expressions (regex) to extract IPs, domains, URLs, and hashes from raw binary data, decrypted configuration blocks, and network traffic. The curriculum covers building custom config extractors for known malware families, parsing structured C2 beacons (JSON/XML), and automating the generation of YARA rules from extracted artifacts. By mastering automated IOC extraction, you will transform raw, encrypted malware payloads into clean, actionable intelligence feeds in seconds.

## Lessons

1. What Is Automated IOC Extraction and Why Does It Matter (30 min)
2. Regex Patterns for IPs, Domains and Hashes (30 min)
3. Guided Lab: Building an IOC Extraction Script (30 min)

## Related

- [Learning path: Scripting and Automation for Malware Analysis](https://codelivly.com/learning-paths/scripting-and-automation-for-malware-analysis)
- [All rooms](https://codelivly.com/rooms)