Python tools for IOC (Indicator of Compromise) handling
Some simple utilities for parsing IOC files:
iocdump.py: spit out the indicator items being referenced
iocwalk.py: parse the boolean logic behind the IOC and the items referenced.
pyiocClient:
A client for linux/windows that handles basic searches for Files,
processes, registry items and ports. It compiles to native linux/windows
32 or 64bit code via pyinstaller and can therefore be run with no python
interpreter on the client system.
pyiocServer:
The server-side compliment to the client. It dishes out .ioc files to
clients that call in via SOAP over SSL and logs the results of the
client checks.
IOCs can be tailored by a simple directory structure corresponding to
the net CIDR mask of the client system.
i.e.
iocs/172.21-16/firefox.ioc
will issue the firefox.ioc to any system inthe 172.21.0.0/16 ip range
when the client is run.
- Download package
-
Checkout Package
osc -A https://api.opensuse.org checkout security:forensics/pyioc && cd $_
- Create Badge
Source Files
Filename | Size | Changed |
---|---|---|
README.opensuse | 0000000360 360 Bytes | |
pyioc-20130422.tar.gz | 0151669547 145 MB | |
pyioc.changes | 0000000493 493 Bytes | |
pyioc.git | 0000036156 35.3 KB | |
pyioc.spec | 0000002914 2.85 KB |
Comments 0