[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HDDM3TBV9DG63S5TP9MY1J":3,"skill-same:01M6HDDM3TBV9DG63S5TP9MY1J":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6HDDM3TBV9DG63S5TP9MY1J","collecting-indicators-of-compromise",null,"Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fcollecting-indicators-of-compromise\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"indicators","collecting indicators of compromise","threat-intelligence-sharing","host","incident","intelligence","behavioral","threat","collection","T1547.001","security","STIX-TAXII","threat-indicators","IOC-collection","T1059.001","network","threat-intelligence","email","threat intelligence","cybersecurity","2026-11-10 10:12:30",false,"---\nname: collecting-indicators-of-compromise\ndescription: Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using...\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- IOC-collection\n- threat-indicators\n- STIX-TAXII\n- MISP\n- threat-intelligence-sharing\nmitre_attack:\n- T1071.001\n- T1071.004\n- T1053.005\n- T1547.001\n- T1059.001\n- T1041\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\ncategory: collecting-indicators-of-compromise\n---\n# Collecting-Indicators-Of-Compromise\n\n## Overview\nSystematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX\u002FTAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.\n\n\n\n# Collecting Indicators of Compromise\n\n## When to Use\n\n- During active incident response to identify and block adversary infrastructure\n- Post-incident to document all observed adversary artifacts for future detection\n- When sharing threat intelligence with ISACs, sector partners, or law enforcement\n- When building detection rules in SIEM, EDR, or network security tools\n- When enriching IOCs with threat intelligence context for risk scoring\n\n**Do not use** for behavioral TTP analysis without accompanying technical indicators; use MITRE ATT&CK mapping for behavioral characterization.\n\n## Prerequisites\n\n- Access to incident evidence sources: SIEM logs, EDR telemetry, memory dumps, disk images, network captures\n- Threat intelligence platform (MISP, OpenCTI, ThreatConnect) for IOC management and sharing\n- IOC enrichment tools: VirusTotal, OTX (AlienVault Open Threat Exchange), Shodan, DomainTools\n- STIX 2.1 knowledge for structured IOC representation\n- Sharing agreements with relevant ISACs (FS-ISAC, H-ISAC, IT-ISAC) or sector partners\n\n## Workflow\n\n### Step 1: Identify IOC Categories\n\nCollect indicators across all categories from incident evidence:\n\n**Network Indicators:**\n- IP addresses (C2 servers, staging servers, exfiltration destinations)\n- Domain names (C2 domains, phishing domains, DGA domains)\n- URLs (malware download, C2 check-in, exfiltration endpoints)\n- JA3\u002FJA3S hashes (TLS client\u002Fserver fingerprints)\n- User-Agent strings (custom or unusual HTTP headers)\n- DNS query patterns (tunneling signatures, DGA patterns)\n\n**Host Indicators:**\n- File hashes (MD5, SHA-1, SHA-256 of malware, tools, scripts)\n- File paths (known malware installation directories)\n- Registry keys (persistence mechanisms, configuration storage)\n- Scheduled tasks and service names (persistence)\n- Mutex\u002Fevent names (malware instance synchronization)\n- Named pipes (C2 communication channels, e.g., Cobalt Strike)\n\n**Email Indicators:**\n- Sender addresses and domains (spoofed or attacker-controlled)\n- Subject lines and body content patterns\n- Attachment names and hashes\n- Embedded URLs\n- Email header anomalies (SPF\u002FDKIM\u002FDMARC failures)\n\n### Step 2: Extract IOCs from Evidence Sources\n\nSystematically extract indicators from each evidence source:\n\n**From SIEM\u002FLog Analysis:**\n```\n# Extract unique destination IPs from firewall logs\nindex=firewall action=blocked\n| stats count by dest_ip\n| where count > 100\n\n# Extract domains from DNS query logs\nindex=dns query=*evil* OR query=*c2*\n| stats count by query\n```\n\n**From Memory Forensics:**\n```bash\n# Extract network connections\nvol -f memory.raw windows.netscan | grep ESTABLISHED\n\n# Extract strings from suspicious process memory\nvol -f memory.raw windows.memmap --pid 3847 --dump\nstrings -n 8 pid.3847.dmp | grep -E \"(http|https):\u002F\u002F\"\n```\n\n**From Malware Analysis:**\n```\nSandbox Report IOC Extraction:\n- Dropped files:      3 (hashes extracted)\n- DNS queries:        update.evil[.]com, cdn.malware[.]net\n- HTTP connections:   POST to https:\u002F\u002F185.220.101[.]42\u002Fgate.php\n- Registry modified:  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svcupdate\n- Mutex created:      Global\\MTX_0x1234ABCD\n- Named pipe:         \\\\.\\pipe\\MSSE-1234-server\n```\n\n### Step 3: Enrich IOCs with Context\n\nAdd threat intelligence context to each indicator:\n\n```\nIOC Enrichment Report:\n━━━━━━━━━━━━━━━━━━━━━\nIP: 185.220.101.42\n  VirusTotal:     12\u002F89 vendors flag as malicious\n  Shodan:         Open ports: 443, 8443, 80\n  Geolocation:    Netherlands, AS208476\n  First Seen:     2025-10-01\n  Threat Intel:   Associated with Qakbot C2 infrastructure\n  Confidence:     High\n  TLP:            AMBER\n\nDomain: update.evil[.]com\n  Registration:   2025-10-28 (recently registered)\n  Registrar:      Namecheap\n  WHOIS Privacy:  Yes\n  VirusTotal:     8\u002F89 vendors flag as malicious\n  DNS History:    Resolved to 185.220.101.42, 91.215.85.17\n  Confidence:     High\n  TLP:            AMBER\n```\n\n### Step 4: Score and Prioritize IOCs\n\nAssign confidence and risk scores to each indicator:\n\n| Score | Confidence Level | Criteria |\n|-------|-----------------|----------|\n| 90-100 | Confirmed Malicious | Multiple TI sources confirm, observed in active attack |\n| 70-89  | Highly Suspicious | Single TI source confirms, behavioral analysis supports |\n| 50-69  | Suspicious | Limited TI data, contextually suspicious |\n| 30-49  | Unconfirmed | No TI matches, but anomalous in environment |\n| 0-29   | Likely Benign | False positive indicators or legitimate infrastructure |\n\n### Step 5: Distribute IOCs for Detection and Blocking\n\nPush IOCs to defensive systems for immediate protection:\n\n- **Firewall\u002FIPS**: Block C2 IPs and domains\n- **DNS**: Sinkhole malicious domains\n- **EDR**: Add file hashes to blocklist, create custom IOC watchlists\n- **Email Gateway**: Block sender domains, attachment hashes, malicious URLs\n- **SIEM**: Create correlation searches for IOC matches\n- **Web Proxy**: Block URLs and domains in web filtering policy\n\n### Step 6: Share IOCs with Partners\n\nPackage IOCs in STIX 2.1 format for sharing:\n\n```json\n{\n  \"type\": \"indicator\",\n  \"spec_version\": \"2.1\",\n  \"id\": \"indicator--a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n  \"created\": \"2025-11-15T18:00:00Z\",\n  \"modified\": \"2025-11-15T18:00:00Z\",\n  \"name\": \"Qakbot C2 Server IP\",\n  \"indicator_types\": [\"malicious-activity\"],\n  \"pattern\": \"[ipv4-addr:value = '185.220.101.42']\",\n  \"pattern_type\": \"stix\",\n  \"valid_from\": \"2025-11-15T14:23:00Z\",\n  \"confidence\": 95,\n  \"labels\": [\"c2\", \"qakbot\"],\n  \"object_marking_refs\": [\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"]\n}\n```\n\nSubmit to MISP, ISAC portals, and TAXII servers per sharing agreements.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IOC (Indicator of Compromise)** | Technical artifact observed during a security incident that indicates adversary presence (hash, IP, domain, etc.) |\n| **TLP (Traffic Light Protocol)** | Standard for classifying the sharing restrictions of threat intelligence: WHITE, GREEN, AMBER, AMBER+STRICT, RED |\n| **STIX (Structured Threat Information Expression)** | Standard language for representing cyber threat intelligence in a structured, machine-readable format |\n| **TAXII (Trusted Automated Exchange of Intelligence Information)** | Transport protocol for sharing STIX-formatted threat intelligence between organizations |\n| **Confidence Score** | Numerical rating (0-100) indicating the analyst's certainty that an indicator is truly malicious |\n| **IOC Lifecycle** | Process of creating, validating, distributing, and eventually retiring indicators as they lose relevance |\n| **Defanging** | Practice of modifying malicious URLs and domains in reports to prevent accidental clicks (e.g., evil[.]com) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence sharing platform for managing, storing, and distributing IOCs\n- **VirusTotal**: Multi-engine malware scanning and threat intelligence platform for IOC enrichment\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 natively\n- **Yeti**: Open-source platform for organizing observables, indicators, and TTPs\n- **CyberChef**: GCHQ's data transformation tool useful for decoding, defanging, and formatting IOCs\n\n## Common Scenarios\n\n### Scenario: Post-Incident IOC Package for ISAC Sharing\n\n**Context**: After responding to a Qakbot infection that led to Cobalt Strike deployment, the IR team must package all IOCs for sharing with the Financial Services ISAC (FS-ISAC).\n\n**Approach**:\n1. Compile all network, host, and email indicators from the investigation\n2. Enrich each IOC with VirusTotal and MISP correlation data\n3. Assign confidence scores based on direct observation vs. secondary correlation\n4. Mark all IOCs with TLP:AMBER for partner sharing\n5. Export as STIX 2.1 bundle and submit to FS-ISAC TAXII feed\n6. Create a human-readable IOC summary report for email distribution\n\n**Pitfalls**:\n- Including internal IP addresses or hostnames in shared IOC packages (information leakage)\n- Sharing IOCs at TLP:WHITE that should be restricted to TLP:AMBER\n- Not defanging URLs and domains in human-readable reports\n- Sharing IP addresses of legitimate CDNs or cloud providers as malicious IOCs\n\n## Output Format\n\n```\nINDICATOR OF COMPROMISE REPORT\n================================\nIncident:     INC-2025-1547\nDate:         2025-11-15\nTLP:          AMBER\nSharing:      FS-ISAC, internal SOC\n\nNETWORK INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nIPv4     | 185.220.101[.]42         | 95         | Qakbot C2 server\nIPv4     | 91.215.85[.]17           | 90         | Cobalt Strike C2\nDomain   | update.evil[.]com        | 95         | Staging domain\nURL      | hxxps:\u002F\u002F185.220[.]101.42\u002Fgate.php | 95  | C2 check-in\nJA3      | a0e9f5d64349fb13191bc7...| 80         | Qakbot TLS fingerprint\n\nHOST INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nSHA-256  | a1b2c3d4e5f6...         | 100        | Qakbot dropper\nSHA-256  | b2c3d4e5f6a7...         | 100        | Cobalt Strike beacon\nFilePath | C:\\Users\\*\\AppData\\Local\\Temp\\update.exe | 85 | Dropper location\nRegKey   | HKCU\\...\\Run\\svcupdate  | 90         | Persistence\nMutex    | Global\\MTX_0x1234ABCD   | 95         | Qakbot instance lock\nTask     | WindowsUpdate           | 90         | Scheduled task persistence\n\nEMAIL INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nSender   | billing@spoofed[.]com   | 95         | Phishing sender\nSubject  | \"Invoice-Nov2025\"       | 70         | Phishing subject line\nHash     | c3d4e5f6a7b8...         | 100        | Malicious .docm attachment\n\nTOTAL: 14 indicators | HIGH confidence avg: 91\n```\n","# Collecting-Indicators-Of-Compromise\n\n## Overview\nSystematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX\u002FTAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.\n\n\n\n# Collecting Indicators of Compromise\n\n## When to Use\n\n- During active incident response to identify and block adversary infrastructure\n- Post-incident to document all observed adversary artifacts for future detection\n- When sharing threat intelligence with ISACs, sector partners, or law enforcement\n- When building detection rules in SIEM, EDR, or network security tools\n- When enriching IOCs with threat intelligence context for risk scoring\n\n**Do not use** for behavioral TTP analysis without accompanying technical indicators; use MITRE ATT&CK mapping for behavioral characterization.\n\n## Prerequisites\n\n- Access to incident evidence sources: SIEM logs, EDR telemetry, memory dumps, disk images, network captures\n- Threat intelligence platform (MISP, OpenCTI, ThreatConnect) for IOC management and sharing\n- IOC enrichment tools: VirusTotal, OTX (AlienVault Open Threat Exchange), Shodan, DomainTools\n- STIX 2.1 knowledge for structured IOC representation\n- Sharing agreements with relevant ISACs (FS-ISAC, H-ISAC, IT-ISAC) or sector partners\n\n## Workflow\n\n### Step 1: Identify IOC Categories\n\nCollect indicators across all categories from incident evidence:\n\n**Network Indicators:**\n- IP addresses (C2 servers, staging servers, exfiltration destinations)\n- Domain names (C2 domains, phishing domains, DGA domains)\n- URLs (malware download, C2 check-in, exfiltration endpoints)\n- JA3\u002FJA3S hashes (TLS client\u002Fserver fingerprints)\n- User-Agent strings (custom or unusual HTTP headers)\n- DNS query patterns (tunneling signatures, DGA patterns)\n\n**Host Indicators:**\n- File hashes (MD5, SHA-1, SHA-256 of malware, tools, scripts)\n- File paths (known malware installation directories)\n- Registry keys (persistence mechanisms, configuration storage)\n- Scheduled tasks and service names (persistence)\n- Mutex\u002Fevent names (malware instance synchronization)\n- Named pipes (C2 communication channels, e.g., Cobalt Strike)\n\n**Email Indicators:**\n- Sender addresses and domains (spoofed or attacker-controlled)\n- Subject lines and body content patterns\n- Attachment names and hashes\n- Embedded URLs\n- Email header anomalies (SPF\u002FDKIM\u002FDMARC failures)\n\n### Step 2: Extract IOCs from Evidence Sources\n\nSystematically extract indicators from each evidence source:\n\n**From SIEM\u002FLog Analysis:**\n```\n# Extract unique destination IPs from firewall logs\nindex=firewall action=blocked\n| stats count by dest_ip\n| where count > 100\n\n# Extract domains from DNS query logs\nindex=dns query=*evil* OR query=*c2*\n| stats count by query\n```\n\n**From Memory Forensics:**\n```bash\n# Extract network connections\nvol -f memory.raw windows.netscan | grep ESTABLISHED\n\n# Extract strings from suspicious process memory\nvol -f memory.raw windows.memmap --pid 3847 --dump\nstrings -n 8 pid.3847.dmp | grep -E \"(http|https):\u002F\u002F\"\n```\n\n**From Malware Analysis:**\n```\nSandbox Report IOC Extraction:\n- Dropped files:      3 (hashes extracted)\n- DNS queries:        update.evil[.]com, cdn.malware[.]net\n- HTTP connections:   POST to https:\u002F\u002F185.220.101[.]42\u002Fgate.php\n- Registry modified:  HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svcupdate\n- Mutex created:      Global\\MTX_0x1234ABCD\n- Named pipe:         \\\\.\\pipe\\MSSE-1234-server\n```\n\n### Step 3: Enrich IOCs with Context\n\nAdd threat intelligence context to each indicator:\n\n```\nIOC Enrichment Report:\n━━━━━━━━━━━━━━━━━━━━━\nIP: 185.220.101.42\n  VirusTotal:     12\u002F89 vendors flag as malicious\n  Shodan:         Open ports: 443, 8443, 80\n  Geolocation:    Netherlands, AS208476\n  First Seen:     2025-10-01\n  Threat Intel:   Associated with Qakbot C2 infrastructure\n  Confidence:     High\n  TLP:            AMBER\n\nDomain: update.evil[.]com\n  Registration:   2025-10-28 (recently registered)\n  Registrar:      Namecheap\n  WHOIS Privacy:  Yes\n  VirusTotal:     8\u002F89 vendors flag as malicious\n  DNS History:    Resolved to 185.220.101.42, 91.215.85.17\n  Confidence:     High\n  TLP:            AMBER\n```\n\n### Step 4: Score and Prioritize IOCs\n\nAssign confidence and risk scores to each indicator:\n\n| Score | Confidence Level | Criteria |\n|-------|-----------------|----------|\n| 90-100 | Confirmed Malicious | Multiple TI sources confirm, observed in active attack |\n| 70-89  | Highly Suspicious | Single TI source confirms, behavioral analysis supports |\n| 50-69  | Suspicious | Limited TI data, contextually suspicious |\n| 30-49  | Unconfirmed | No TI matches, but anomalous in environment |\n| 0-29   | Likely Benign | False positive indicators or legitimate infrastructure |\n\n### Step 5: Distribute IOCs for Detection and Blocking\n\nPush IOCs to defensive systems for immediate protection:\n\n- **Firewall\u002FIPS**: Block C2 IPs and domains\n- **DNS**: Sinkhole malicious domains\n- **EDR**: Add file hashes to blocklist, create custom IOC watchlists\n- **Email Gateway**: Block sender domains, attachment hashes, malicious URLs\n- **SIEM**: Create correlation searches for IOC matches\n- **Web Proxy**: Block URLs and domains in web filtering policy\n\n### Step 6: Share IOCs with Partners\n\nPackage IOCs in STIX 2.1 format for sharing:\n\n```json\n{\n  \"type\": \"indicator\",\n  \"spec_version\": \"2.1\",\n  \"id\": \"indicator--a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n  \"created\": \"2025-11-15T18:00:00Z\",\n  \"modified\": \"2025-11-15T18:00:00Z\",\n  \"name\": \"Qakbot C2 Server IP\",\n  \"indicator_types\": [\"malicious-activity\"],\n  \"pattern\": \"[ipv4-addr:value = '185.220.101.42']\",\n  \"pattern_type\": \"stix\",\n  \"valid_from\": \"2025-11-15T14:23:00Z\",\n  \"confidence\": 95,\n  \"labels\": [\"c2\", \"qakbot\"],\n  \"object_marking_refs\": [\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"]\n}\n```\n\nSubmit to MISP, ISAC portals, and TAXII servers per sharing agreements.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IOC (Indicator of Compromise)** | Technical artifact observed during a security incident that indicates adversary presence (hash, IP, domain, etc.) |\n| **TLP (Traffic Light Protocol)** | Standard for classifying the sharing restrictions of threat intelligence: WHITE, GREEN, AMBER, AMBER+STRICT, RED |\n| **STIX (Structured Threat Information Expression)** | Standard language for representing cyber threat intelligence in a structured, machine-readable format |\n| **TAXII (Trusted Automated Exchange of Intelligence Information)** | Transport protocol for sharing STIX-formatted threat intelligence between organizations |\n| **Confidence Score** | Numerical rating (0-100) indicating the analyst's certainty that an indicator is truly malicious |\n| **IOC Lifecycle** | Process of creating, validating, distributing, and eventually retiring indicators as they lose relevance |\n| **Defanging** | Practice of modifying malicious URLs and domains in reports to prevent accidental clicks (e.g., evil[.]com) |\n\n## Tools & Systems\n\n- **MISP**: Open-source threat intelligence sharing platform for managing, storing, and distributing IOCs\n- **VirusTotal**: Multi-engine malware scanning and threat intelligence platform for IOC enrichment\n- **OpenCTI**: Open-source cyber threat intelligence platform supporting STIX 2.1 natively\n- **Yeti**: Open-source platform for organizing observables, indicators, and TTPs\n- **CyberChef**: GCHQ's data transformation tool useful for decoding, defanging, and formatting IOCs\n\n## Common Scenarios\n\n### Scenario: Post-Incident IOC Package for ISAC Sharing\n\n**Context**: After responding to a Qakbot infection that led to Cobalt Strike deployment, the IR team must package all IOCs for sharing with the Financial Services ISAC (FS-ISAC).\n\n**Approach**:\n1. Compile all network, host, and email indicators from the investigation\n2. Enrich each IOC with VirusTotal and MISP correlation data\n3. Assign confidence scores based on direct observation vs. secondary correlation\n4. Mark all IOCs with TLP:AMBER for partner sharing\n5. Export as STIX 2.1 bundle and submit to FS-ISAC TAXII feed\n6. Create a human-readable IOC summary report for email distribution\n\n**Pitfalls**:\n- Including internal IP addresses or hostnames in shared IOC packages (information leakage)\n- Sharing IOCs at TLP:WHITE that should be restricted to TLP:AMBER\n- Not defanging URLs and domains in human-readable reports\n- Sharing IP addresses of legitimate CDNs or cloud providers as malicious IOCs\n\n## Output Format\n\n```\nINDICATOR OF COMPROMISE REPORT\n================================\nIncident:     INC-2025-1547\nDate:         2025-11-15\nTLP:          AMBER\nSharing:      FS-ISAC, internal SOC\n\nNETWORK INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nIPv4     | 185.220.101[.]42         | 95         | Qakbot C2 server\nIPv4     | 91.215.85[.]17           | 90         | Cobalt Strike C2\nDomain   | update.evil[.]com        | 95         | Staging domain\nURL      | hxxps:\u002F\u002F185.220[.]101.42\u002Fgate.php | 95  | C2 check-in\nJA3      | a0e9f5d64349fb13191bc7...| 80         | Qakbot TLS fingerprint\n\nHOST INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nSHA-256  | a1b2c3d4e5f6...         | 100        | Qakbot dropper\nSHA-256  | b2c3d4e5f6a7...         | 100        | Cobalt Strike beacon\nFilePath | C:\\Users\\*\\AppData\\Local\\Temp\\update.exe | 85 | Dropper location\nRegKey   | HKCU\\...\\Run\\svcupdate  | 90         | Persistence\nMutex    | Global\\MTX_0x1234ABCD   | 95         | Qakbot instance lock\nTask     | WindowsUpdate           | 90         | Scheduled task persistence\n\nEMAIL INDICATORS\nType     | Value                    | Confidence | Context\n---------|--------------------------|------------|--------\nSender   | billing@spoofed[.]com   | 95         | Phishing sender\nSubject  | \"Invoice-Nov2025\"       | 70         | Phishing subject line\nHash     | c3d4e5f6a7b8...         | 100        | Malicious .docm attachment\n\nTOTAL: 14 indicators | HIGH confidence avg: 91\n```\n",{"name":5,"tags":44,"author":46,"domain":38,"license":15,"version":47,"category":5,"nist_csf":48,"subdomain":53,"description":7,"mitre_attack":54},[32,31,30,45,21],"MISP","mahipal","1.0.0",[49,50,51,52],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","incident-response",[55,56,57,28,33,58],"T1071.001","T1071.004","T1053.005","T1041","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fcollecting-indicators-of-compromise",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill collecting-indicators-of-compromise",{"tool":73,"command":74},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill collecting-indicators-of-compromise",{"tool":76,"command":77},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill collecting-indicators-of-compromise","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fcollecting-indicators-of-compromise\u002FSKILL.md",true,[81,86,92],{"path":82,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fcollecting-indicators-of-compromise\u002FLICENSE",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fapi-reference.md","REFERENCE","参考文档",2231,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fcollecting-indicators-of-compromise\u002Freferences\u002Fapi-reference.md",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fagent.py","SCRIPT","脚本",7461,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fcollecting-indicators-of-compromise\u002Fscripts\u002Fagent.py",[99,128,154,176,192,213],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":110,"publishedAt":39},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[105],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[111,112,113,114,115,116,38,117,118,119,53,120,121,122,123,124,125,23,126,127],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","t1078","t1490","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":39},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[135,136,137,138,139,38,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":39},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[29,161,23,38,162,163,164,122,123,165,166,167,168,169,170,171,172,173,174,175],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[29,183,184,161,23,139,38,185,163,53,186,187,122,123,188,166,149,189,190,191],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":39},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[29,199,200,201,202,203,38,204,205,206,163,207,122,208,209,210,169,211,23,212],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review","cm","de",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":219,"publishedAt":39},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[220,221,222,26,38,223,224,225,35,226,227,208,228,229,211,24,212,230,231,232],"infrastructure","tracking threat actor infrastructure","tracking","monitoring","mitre-attack","threat-actor","command-and-control","dns","command","exploit","domains","kit","hosts"]