
IOC Extraction Methodology for Indian SOCs
How to turn a malware sample into a layered IOC pack — file, network, behaviour — that your SOC can actually action.
Indian SOCs are drowning in IOC feeds — and missing the actor. A 50,000-IOC feed of expired SHA-256s and parked C2 domains feels productive but catches nothing. This whitepaper documents the IOC extraction methodology Macksofy DFIR runs on every malware engagement, organised by the David Bianco Pyramid of Pain and tuned for the operational realities of an Indian SOC.
1. The Pyramid of Pain — why it still matters
Atomic IOCs (hashes, IPs, domains) are cheap for an attacker to change. Computed IOCs (Imphash, ssdeep, behavioural patterns) are harder. TTPs are the most expensive. A SOC that only ingests atomic IOCs is fighting yesterday's campaign; a SOC that hunts TTPs is fighting the actor.
2. Atomic IOCs — extract them, but don't stop there
- MD5 / SHA-1 / SHA-256 — capture all three for compatibility with feeds and EDRs
- Domain + URL paths — full URL, not just the apex domain
- IPv4 / IPv6 — both, with ASN annotation for cluster correlation
- Email indicators — sender, X-Originating-IP, SPF/DKIM/DMARC status
- Filenames + paths — when distinctive (avoid `update.exe`, capture `c:\users\public\winhost_v2.exe`)
- Registry keys + persistence paths
3. Computed IOCs — the real value layer
| IOC type | How to compute | Why it survives variants |
|---|---|---|
| Imphash | pefile.PE(f).get_imphash() | PE import table changes slowly across variants |
| TLSH | tlsh.hash(open(f,'rb').read()) | Locality-sensitive hash; catches near-duplicates |
| ssdeep | ssdeep --compare | Fuzzy hash for chunk-level similarity |
| YARA cluster ID | From your YARA rule's family tag | Pattern-match across the malware family |
| Behavioural pattern | From sandbox (e.g., Cuckoo, ANY.RUN) signatures | Same family acts the same way under detonation |
4. Behavioural IOCs — TTPs you can actually hunt
TTPs are MITRE ATT&CK techniques the malware exhibits. They survive every cosmetic change to the binary. A SOC that hunts T1566.001 (spearphishing attachment), T1204 (user execution), T1059.001 (PowerShell), T1071.001 (web protocol C2) for malware-family X catches the same family even when the binary changes weekly.
- Encode each malware family as a MITRE ATT&CK technique-set
- Convert techniques into Sigma rules for SIEM hunting
- Convert Sigma into your specific SIEM dialect (Splunk SPL / KQL / ESQL / etc.)
- Tune for false-positive rate against a known-good corpus before promotion to production
5. The IOC lifecycle — preventing stale-feed fatigue
- Every IOC has a publication-date and an expiry-date in metadata
- Atomic IOC default expiry: 30 days (parked / sinkholed quickly)
- Computed IOC expiry: 180 days
- Behavioural / Sigma IOC expiry: revisit annually
- Reputation re-check at expiry — promote, demote or delete
- Track false-positive rate per IOC source; demote noisy sources
6. Tooling stack (open + commercial)
- MISP — IOC sharing platform; native event model + STIX export
- OpenCTI — threat-intel platform with knowledge-graph view
- TheHive + Cortex — case management with IOC enrichment connectors
- VirusTotal — multi-engine atomic-IOC reputation
- URLhaus / abuse.ch — community feeds for malware C2
- Macksofy IOC pack — India-context curated feed (BFSI / fintech-targeting families)
Many global IOC feeds under-cover Indian-targeting malware — banking trojans pivoted to UPI fraud, fake-RBI lure infrastructure, GSTN-themed phishing kits. Macksofy's IOC feed is sourced from Indian customer engagements and is calibrated to what hits Indian SOCs first.
Macksofy offers full-service engagements that map directly to this resource. Common starting points:
- Malware Analysis & Reverse Engineering →
- Cyber Threat Intelligence →
- Digital Forensics & Incident Response (DFIR) →
