DECODA’s IOC extraction engine automatically detects indicators of compromise from analysis output using pattern matching with validation. Each indicator is assigned a confidence level and can be exported in machine-readable formats.
Network Indicators
| Category | Pattern | Confidence | Example |
|---|
| IPv4 | Standard dotted-decimal | High | 192.168.1.100 |
| IPv4 with Port | IP:port format | High | 10.0.0.1:4444 |
| IPv6 | Full and compressed formats | Medium | fe80::1, 2001:db8::1 |
| Domain | Common TLDs used in malware ops | Medium | evil-c2.xyz, payload.onion |
| URL | HTTP/HTTPS/FTP with paths | High | https://malware.site/payload.bin |
| Email | Standard email format | High | attacker@evil.com |
Domain detection covers 60+ TLDs including those commonly abused in malware campaigns: .xyz, .top, .tk, .pw, .onion, .bit, and country-code TLDs.
File Indicators
| Category | Pattern | Confidence | Example |
|---|
| MD5 | 32 hex characters | Low | d41d8cd98f00b204e9800998ecf8427e |
| SHA-1 | 40 hex characters | Low | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA-256 | 64 hex characters | Low | e3b0c44298fc1c149afbf4c8996fb924... |
| SHA-512 | 128 hex characters | Low | Full 128-char hex string |
| PDB Path | Windows .pdb debug paths | High | C:\Users\dev\malware\Release\loader.pdb |
| Windows Path | Drive letter paths | Medium | C:\Windows\System32\cmd.exe |
| Unix Path | System directory paths | Medium | /tmp/.hidden/payload |
PDB paths are particularly valuable for attribution, as they may reveal developer usernames, project names, and build environments.
Host Indicators
| Category | Pattern | Confidence | Example |
|---|
| Registry Key | HKEY_* / HKLM / HKCU paths | High | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Mutex | Global\ and Local\ prefixed names | High | Global\{DEADBEEF-1234-5678} |
| User Agent | Mozilla/* HTTP user-agent strings | Medium | Mozilla/5.0 (Windows NT 10.0; ...) |
Cryptocurrency Indicators
| Category | Pattern | Confidence | Example |
|---|
| Bitcoin | P2PKH (1…), P2SH (3…), Bech32 (bc1…) | High | bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh |
| Monero | Standard addresses starting with 4 | High | 4AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx... |
Confidence Levels
Each detected IOC is assigned a confidence level:
- High — Strong structural match with validation (URLs, registry keys, crypto addresses, mutexes)
- Medium — Good pattern match but may have false positives (domains, IP addresses, file paths, user agents)
- Low — Hex string length match only (hashes) — could be coincidental hex sequences
Hash confidence is low because a 32-character hex string could be an MD5 hash, a GUID, or just a hex-encoded value. DECODA uses context from surrounding analysis to improve hash classification.
JSON
Structured data suitable for SIEM ingestion or custom tooling:
{
"indicators": [
{
"type": "ipv4",
"value": "192.168.1.100",
"confidence": "high",
"context": "Found in decoded C2 configuration"
}
]
}
CSV
Spreadsheet-compatible format for manual review or bulk import:
type,value,confidence,context
ipv4,192.168.1.100,high,Found in decoded C2 configuration
domain,evil-c2.xyz,medium,Referenced in HTTP beacon function
STIX 2.1
Standard threat intelligence format for sharing between organisations and tools. DECODA generates valid STIX bundles with proper object types (indicators, observables, relationships).
Filtering & Options
When asking the agent to extract IOCs, you can specify:
- Category filter — “Extract only network IOCs” or “Just the file hashes”
- Confidence threshold — “Only high-confidence indicators”
- Defanged output — IOCs are modified to prevent accidental clicks (e.g.,
hxxps://evil[.]com)
Example prompts:
“Extract all network IOCs and export as STIX 2.1”
“Find high-confidence IOCs only, defanged, as CSV”
“Generate IOCs from this analysis and export as JSON”
False Positive Filtering
DECODA maintains a whitelist to filter out common false positives:
- Known-safe domains (microsoft.com, google.com, etc.)
- Private/reserved IP ranges (unless specifically suspicious in context)
- File extensions that look like domains (
.dll, .exe, .sys)
- Common library paths that aren’t indicators
