From actioner
Extract, normalize, and defang IOCs (IPs, domains, URLs, hashes, file paths, registry keys) and TTPs mapped to MITRE ATT&CK from source text. Use when turning an article, report, or writeup into structured indicators before rule generation.
How this skill is triggered — by the user, by Claude, or both
Slash command
/actioner:ioc-extractThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Identification, normalization, and defanging of indicators of compromise and TTP extraction from source text.
Identification, normalization, and defanging of indicators of compromise and TTP extraction from source text.
Key Principle: Extract IOCs and TTPs as co-equal, first-class outputs. Concrete artifacts (IOCs — strings, hashes, paths, network indicators) are what the PoC/advisory-specific layer keys on (the product default); TTPs describe durable behavior for the opt-in behavioral layer and for MITRE ATT&CK mapping. Which one a given rule keys on is an altitude decision made downstream in rule-gen — so extract both thoroughly and tag them; don't pre-rank one over the other here.
Invoke this skill when processing source text (articles, reports, technical writeups) to extract structured indicators before populating a topic summary. This skill bridges ingestion/research and rule generation.
Scan the source text for the following indicator types:
| IOC Type | Pattern | Examples |
|---|---|---|
| IPv4 Address | Dotted-quad, optional port | 192.168.1.100, 45.33.32.156:8443 |
| IPv6 Address | Colon-separated hex groups | 2001:0db8::1 |
| Domain | FQDN with valid TLD | malware-c2.evil.com, update.legitimatesoftware.net |
| URL | Full URI with scheme | https://evil.com/payload.exe?id=123 |
| File Hash (MD5) | 32 hex characters | d41d8cd98f00b204e9800998ecf8427e |
| File Hash (SHA1) | 40 hex characters | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| File Hash (SHA256) | 64 hex characters | e3b0c44298fc1c149afbf4c8996fb924... |
| File Path | OS-specific paths | /tmp/.cache/update, C:\Users\Public\svchost.exe |
| Registry Key | Windows registry paths | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Email Address | user@domain format | [email protected] |
| CVE ID | CVE-YYYY-NNNNN format | CVE-2024-3400 |
TTPs describe adversary behavior — the actions they take, not just the artifacts they leave. They are the basis for the durable, opt-in behavioral detection layer (and for MITRE ATT&CK mapping). Capture them precisely — vague TTPs make weak, false-positive-prone rules.
POST /api/v1/check-in with User-Agent: Mozilla/5.0 (compatible; UpdateService/1.0) and base64-encoded bodyexcel.exe → cmd.exe → powershell.exe -enc [base64] → certutil -urlcache -f http://... payload.dllC:\ProgramData\svchost.exe (note: legitimate path, suspicious binary name collision)HKCU\Software\Classes\CLSID\{...}\InprocServer32 pointing to malicious DLL[random-8-chars].c2domain.com every 60 secondsklist followed by TGS requests for service accounts/api/update every 300s +/-15% jitter, 64-byte minimum payloadMap observed behaviors to MITRE ATT&CK techniques:
T####.### - Technique Name| Observed Behavior | TID | Technique |
|---|---|---|
| Phishing email with macro-enabled doc | T1566.001 | Spearphishing Attachment |
| PowerShell download cradle | T1059.001 | PowerShell |
| Scheduled task for persistence | T1053.005 | Scheduled Task |
| certutil for download | T1105 | Ingress Tool Transfer |
| Process injection via CreateRemoteThread | T1055.001 | Dynamic-link Library Injection |
| DNS tunneling for exfil | T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
Apply consistent formatting:
Evil.COM → evil.com)?utm_source=..., &ref=..., &fbclid=...)045.033.032.156 → 45.33.32.156)Apply defanging to prevent accidental resolution or click-through:
| Type | Rule | Before | After |
|---|---|---|---|
| URL scheme | Replace http with hxxp | https://evil.com/payload | hxxps://evil[.]com/payload |
| Domain dots | Replace . with [.] | evil.com | evil[.]com |
| IP dots | Replace . with [.] | 45.33.32.156 | 45.33.32[.]156 |
| Email @ | Replace @ with [at] | [email protected] | attacker[at]evil[.]com |
| Email domain | Also defang dots | [email protected] | attacker[at]evil[.]com |
Organize extracted indicators into the topic summary template sections:
Place in the appropriate table under ## Indicators of Compromise (IOCs):
Place in the ## MITRE ATT&CK Mapping table with TID, Technique Name, and Observed Behavior columns.
Feed detailed TTP descriptions into the appropriate ## Technical Analysis subsections (stages, C2, platform-specific behavior).
Both are valuable; they feed different altitudes. Concrete artifacts power the PoC/advisory-specific layer (the default — precise, low false-positive); behaviors power the durable behavioral (TTP) layer (opt-in — higher recall, broader). Tag each so rule-gen can select per the requested altitude.
| Indicator | Classification | Feeds | Note |
|---|---|---|---|
45.33.32[.]156 | IOC (artifact) | PoC/advisory-specific | Precise now; rotates over time |
evil[.]com | IOC (artifact) | PoC/advisory-specific | Precise now; may be burned later |
| SHA256 of malware binary | IOC (artifact) | PoC/advisory-specific | Exact-match; one variant |
POST /api/v1/check-in with specific User-Agent | TTP (behavioral) | durable behavioral | C2 protocol pattern |
excel.exe → cmd.exe → powershell.exe -enc | TTP (behavioral) | durable behavioral | Execution-chain behavior |
| DNS TXT queries at regular intervals | TTP (behavioral) | durable behavioral | C2 communication pattern |
| Registry run key persistence | TTP (behavioral) | durable behavioral | Persistence mechanism |
Rule of thumb: if the adversary can change it by editing a config file, it's an IOC/artifact (feeds the specific layer); if changing it requires rewriting code or redesigning the attack, it's a TTP (feeds the behavioral layer). The default altitude keys on the artifacts; the behavioral layer is opt-in.
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub thomaspark20/actioner --plugin actioner