LAB-17Easy
IOC Extraction
Extract the full indicator-of-compromise profile from a sample.
15 min5 prerequisites7 tools
Investigate
Hints
Hint 1
Four IOC categories: network, host, persistence, dropped file.
Hint 2
The mutex is a Global\ mutex.
Hint 3
The dropped path uses the TEMP environment variable.
Submit Findings
Solution
IOC Extraction — Solution
The full IOC profile:
- Network:
http://evil.example.net/update - Host (mutex):
Global\mutex_zz9 - Persistence:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run - Dropped file:
%TEMP%\svc.exe
Each is an atomic IOC a defender can blocklist or hunt for. Together they describe an implant that drops a payload, persists via the Run key, guards against double-run with a mutex, and phones home.
Prerequisites
- m5-ioc-reporting
- sa1-strings-metadata
- sa2-imports-exports
- IOC types: network, host, persistence, file, registry, mutex
- STIX/OpenIOC/MISP formats
Methodology
Investigation Methodology
1. Systematic String Extraction
- Run
strings -a -el sample.bin > strings.txt - Also check Ghidra's Defined Strings window
- Categorize every string by IOC type
2. IOC Taxonomy
| Category | Sub-types | Examples |
|---|---|---|
| Network | Domain, IP, URL, User-Agent, Certificate | c2.evil.com, 1.2.3.4:443 |
| Host | Mutex, Pipe, Event, Semaphore, Window class | Global\mutex_xyz |
| Persistence | Run key, Service, Scheduled Task, WMI, Startup | HKCU\...\Run |
| File | Dropped path, Loaded DLL, Written file | %TEMP%\svc.exe |
| Registry | Key paths, Value names, Data | HKLM\Software\... |
| Artifact | Hash (MD5/SHA256), PDB path, Compile time | a1b2c3..., C:\build\malware.pdb |
3. Correlation & Context
- Single IOC = Low fidelity (e.g.,
kernel32.dllis not an IOC) - Clustered IOCs = High fidelity (mutex + C2 + persistence = implant)
- Behavioral context: What uses the IOC? (API call trace)
4. Standardize Output
Format for sharing:
- STIX 2.1: Structured threat intelligence
- OpenIOC: Mandiant format
- MISP: Platform-agnostic
- CSV/JSON: Simple ingestion
5. Enrichment
- Passive DNS: Domain history, resolutions
- VT/URLhaus: Malicious verdicts, relationships
- WHOIS: Registrar, creation date, privacy
- SSL Certs: JA3, issuer, validity
- File Reputation: Hash lookup, sandbox reports
Common Pitfalls
- Including non-IOCs (common DLLs, system paths, generic strings)
- Missing Unicode/UTF-16 strings — always use `strings -el`
- Not normalizing paths (case, env vars, short vs long names)
- Forgetting file hashes — primary identifier for sharing
- Not categorizing — raw string list is not an IOC report
Tools
- strings (GNU) with `-a -el`
- FLOSS (FireEye) for encoded strings
- Ghidra (Defined Strings, Cross-references)
- Malcat (fast triage + IOC extraction)
- CAPA (Mandiant) — auto capability + IOC detection
- YARA (rule-based extraction)
- MISP / OpenCTI (platform)
References
- Lesson M5: IOC Reporting
- Lesson SA1: Strings & Metadata
- STIX 2.1 Specification
- OpenIOC 1.1
- MISP Taxonomy
- MITRE ATT&CK: IOC mapping per technique
Extensions & Challenges
- Convert findings to STIX 2.1 bundle
- Write a YARA rule that matches all 4 IOC categories
- Submit IOCs to MISP instance
- Research: How to extract IOCs from memory dump (Volatility)?
- Build an automated IOC extractor pipeline