[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DVR29MNX6GKSADHAWSYDS":3,"skill-same:01M71DVR29MNX6GKSADHAWSYDS":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":40,"updatedAt":41,"install":42,"resources":55},"01M71DVR29MNX6GKSADHAWSYDS","intel-ioc-indicator",null,"- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel-ioc-indicator\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29],"ioc","intel ioc indicator","indicator","intel","oasis","stix","open","cybersecurity","valid","https","docs","2026-11-10 10:12:30",false,"---\nname: intel-ioc-indicator\ndescription: \"- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.\"\ndomain: cybersecurity\n---\n\n# Performing Indicator Lifecycle Management\n\n## Overview\n\nIndicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.\n\n## When to Use\n\n- When conducting security assessments that involve performing indicator lifecycle management\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries\n- MISP or OpenCTI instance for indicator storage\n- SIEM with IOC watchlist capabilities (Splunk, Elastic)\n- Understanding of IOC types, confidence scoring, and TLP classifications\n\n## Key Concepts\n\n### Indicator Lifecycle Phases\n1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response\n2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)\n3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)\n4. **Deployment**: IOC pushed to detection systems (SIEM, IDS, firewall)\n5. **Monitoring**: Track hit rates, false positive rates, detection efficacy\n6. **Review**: Periodic assessment of IOC relevance and accuracy\n7. **Retirement**: IOC expired or removed based on aging policy\n\n### Confidence Decay\nIndicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).\n\n### Quality Metrics\n- **Hit Rate**: Percentage of deployed IOCs generating true positive alerts\n- **False Positive Rate**: Percentage of IOC alerts that are benign\n- **Coverage**: Percentage of known threat techniques with IOC coverage\n- **Freshness**: Average age of active indicators in the database\n\n## Workflow\n\n### Step 1: Implement IOC Lifecycle State Machine\n\n```python\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\nclass IOCState(Enum):\n    DISCOVERED = \"discovered\"\n    VALIDATED = \"validated\"\n    ENRICHED = \"enriched\"\n    DEPLOYED = \"deployed\"\n    MONITORING = \"monitoring\"\n    UNDER_REVIEW = \"under_review\"\n    RETIRED = \"retired\"\n\nclass IOCLifecycle:\n    def __init__(self, ioc_type, value, source, initial_confidence=50):\n        self.ioc_type = ioc_type\n        self.value = value\n        self.source = source\n        self.confidence = initial_confidence\n        self.state = IOCState.DISCOVERED\n        self.created = datetime.utcnow()\n        self.last_updated = datetime.utcnow()\n        self.last_seen = None\n        self.hit_count = 0\n        self.false_positive_count = 0\n        self.history = [{\"state\": \"discovered\", \"timestamp\": self.created.isoformat()}]\n\n    def transition(self, new_state: IOCState, reason=\"\"):\n        self.state = new_state\n        self.last_updated = datetime.utcnow()\n        self.history.append({\n            \"state\": new_state.value,\n            \"timestamp\": self.last_updated.isoformat(),\n            \"reason\": reason,\n        })\n\n    def apply_decay(self):\n        \"\"\"Apply confidence decay based on IOC type half-life.\"\"\"\n        half_lives = {\"ip\": 30, \"domain\": 90, \"hash\": 365, \"url\": 60}\n        half_life = half_lives.get(self.ioc_type, 90)\n        age_days = (datetime.utcnow() - self.created).days\n        decay_factor = 0.5 ** (age_days \u002F half_life)\n        self.confidence = max(0, int(self.confidence * decay_factor))\n\n    def record_hit(self, is_true_positive=True):\n        self.hit_count += 1\n        self.last_seen = datetime.utcnow()\n        if not is_true_positive:\n            self.false_positive_count += 1\n            if self.false_positive_count > 3:\n                self.transition(IOCState.UNDER_REVIEW, \"Excessive false positives\")\n\n    def should_retire(self):\n        max_ages = {\"ip\": 90, \"domain\": 180, \"hash\": 730, \"url\": 120}\n        max_age = max_ages.get(self.ioc_type, 180)\n        age_days = (datetime.utcnow() - self.created).days\n        return age_days > max_age and self.hit_count == 0\n```\n\n## Validation Criteria\n\n- IOC lifecycle state machine transitions correctly between phases\n- Confidence decay reduces scores based on IOC type half-life\n- Hit rate and false positive tracking functional\n- Aging policy automatically flags indicators for review\u002Fretirement\n- Quality metrics dashboard shows IOC database health\n\n## References\n\n- [MISP Indicator Lifecycle](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [IOC Quality Framework](https:\u002F\u002Fwww.first.org\u002F)\n","# Performing Indicator Lifecycle Management\n\n## Overview\n\nIndicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes for IOC quality assessment, aging policies, confidence scoring decay, false positive tracking, hit-rate monitoring, and automated expiration to maintain a high-quality, actionable indicator database that minimizes analyst fatigue and maximizes detection efficacy.\n\n## When to Use\n\n- When conducting security assessments that involve performing indicator lifecycle management\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Python 3.9+ with `pymisp`, `requests`, `stix2` libraries\n- MISP or OpenCTI instance for indicator storage\n- SIEM with IOC watchlist capabilities (Splunk, Elastic)\n- Understanding of IOC types, confidence scoring, and TLP classifications\n\n## Key Concepts\n\n### Indicator Lifecycle Phases\n1. **Discovery**: IOC first identified from threat intelligence, malware analysis, or incident response\n2. **Validation**: IOC verified against enrichment sources (VirusTotal, Shodan)\n3. **Enrichment**: Additional context added (WHOIS, passive DNS, threat actor attribution)\n4. **Deployment**: IOC pushed to detection systems (SIEM, IDS, firewall)\n5. **Monitoring**: Track hit rates, false positive rates, detection efficacy\n6. **Review**: Periodic assessment of IOC relevance and accuracy\n7. **Retirement**: IOC expired or removed based on aging policy\n\n### Confidence Decay\nIndicator confidence decreases over time as adversaries rotate infrastructure. A time-based decay function reduces confidence scores automatically, ensuring old indicators do not generate excessive alerts. Typical half-life: IP addresses (30 days), domains (90 days), file hashes (365 days).\n\n### Quality Metrics\n- **Hit Rate**: Percentage of deployed IOCs generating true positive alerts\n- **False Positive Rate**: Percentage of IOC alerts that are benign\n- **Coverage**: Percentage of known threat techniques with IOC coverage\n- **Freshness**: Average age of active indicators in the database\n\n## Workflow\n\n### Step 1: Implement IOC Lifecycle State Machine\n\n```python\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\nclass IOCState(Enum):\n    DISCOVERED = \"discovered\"\n    VALIDATED = \"validated\"\n    ENRICHED = \"enriched\"\n    DEPLOYED = \"deployed\"\n    MONITORING = \"monitoring\"\n    UNDER_REVIEW = \"under_review\"\n    RETIRED = \"retired\"\n\nclass IOCLifecycle:\n    def __init__(self, ioc_type, value, source, initial_confidence=50):\n        self.ioc_type = ioc_type\n        self.value = value\n        self.source = source\n        self.confidence = initial_confidence\n        self.state = IOCState.DISCOVERED\n        self.created = datetime.utcnow()\n        self.last_updated = datetime.utcnow()\n        self.last_seen = None\n        self.hit_count = 0\n        self.false_positive_count = 0\n        self.history = [{\"state\": \"discovered\", \"timestamp\": self.created.isoformat()}]\n\n    def transition(self, new_state: IOCState, reason=\"\"):\n        self.state = new_state\n        self.last_updated = datetime.utcnow()\n        self.history.append({\n            \"state\": new_state.value,\n            \"timestamp\": self.last_updated.isoformat(),\n            \"reason\": reason,\n        })\n\n    def apply_decay(self):\n        \"\"\"Apply confidence decay based on IOC type half-life.\"\"\"\n        half_lives = {\"ip\": 30, \"domain\": 90, \"hash\": 365, \"url\": 60}\n        half_life = half_lives.get(self.ioc_type, 90)\n        age_days = (datetime.utcnow() - self.created).days\n        decay_factor = 0.5 ** (age_days \u002F half_life)\n        self.confidence = max(0, int(self.confidence * decay_factor))\n\n    def record_hit(self, is_true_positive=True):\n        self.hit_count += 1\n        self.last_seen = datetime.utcnow()\n        if not is_true_positive:\n            self.false_positive_count += 1\n            if self.false_positive_count > 3:\n                self.transition(IOCState.UNDER_REVIEW, \"Excessive false positives\")\n\n    def should_retire(self):\n        max_ages = {\"ip\": 90, \"domain\": 180, \"hash\": 730, \"url\": 120}\n        max_age = max_ages.get(self.ioc_type, 180)\n        age_days = (datetime.utcnow() - self.created).days\n        return age_days > max_age and self.hit_count == 0\n```\n\n## Validation Criteria\n\n- IOC lifecycle state machine transitions correctly between phases\n- Confidence decay reduces scores based on IOC type half-life\n- Hit rate and false positive tracking functional\n- Aging policy automatically flags indicators for review\u002Fretirement\n- Quality metrics dashboard shows IOC database health\n\n## References\n\n- [MISP Indicator Lifecycle](https:\u002F\u002Fwww.misp-project.org\u002F)\n- [STIX Indicator Valid From\u002FUntil](https:\u002F\u002Fdocs.oasis-open.org\u002Fcti\u002Fstix\u002Fv2.1\u002Fstix-v2.1.html)\n- [IOC Quality Framework](https:\u002F\u002Fwww.first.org\u002F)\n",{"name":5,"domain":26,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fintel-ioc-indicator","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill intel-ioc-indicator",{"tool":48,"command":49},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill intel-ioc-indicator",{"tool":51,"command":52},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill intel-ioc-indicator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel-ioc-indicator\u002FSKILL.md",true,[56],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"index.json","REFERENCE","参考文档",516,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fintel-ioc-indicator\u002Findex.json",[63,88,111,133,155,171],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":30},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,26,87],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":30},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[95,70,96,73,97,98,99,26,100,101,102,103,104,105,75,106,107,108,109,110],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":30},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[118,119,120,121,122,123,26,100,124,101,125,126,75,108,127,128,129,130,131,132],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":30},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[71,140,141,142,143,144,145,76,146,26,87,147,148,149,150,151,152,153,154,75],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":30},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[162,163,71,164,142,144,165,76,166,146,26,87,101,167,168,169,170,154,75,77],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":30},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[178,71,142,179,165,76,180,181,26,87,182,183,184,185,186,187,75,77,188,189],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]