## Extracting Indicators of Compromise\n\n### Types of IOCs\n\n| IOC Type | Example | Detection Value |\n|----------|---------|----------------|\n| **File Hash** | SHA256: abc123... | High (unique) |\n| **Domain** | evil-c2.com | Medium (can change) |\n| **IP Address** | 185.123.45.67 | Medium |\n| **URL** | /gate.php?id= | High (URI patterns) |\n| **Email** | attacker@evil.com | Medium |\n| **Mutex** | Global\\M4lw4r3 | High (unique) |\n| **Registry Key** | HKCU\\Run\\malware | Medium |\n| **User-Agent** | Mozilla/5.0 (compatible; Evil) | Medium |\n\n### Extracting Network IOCs\n\n**From sandbox reports**:\n```json\n{\n  "network": {\n    "dns": ["evil-c2.com", "update.evil.net"],\n    "http": [{"host": "185.123.45.67", "uri": "/gate.php"}],\n    "tcp": [{"dst": "185.123.45.67", "port": 443}]\n  }\n}\n```\n\n**From PCAP**:\n```bash\ntshark -r traffic.pcap -Y "http.request" -T fields -e http.host -e http.request.uri\n```\n\n### Config Extraction\n\nMany malware families have embedded configs:\n- C2 servers\n- Encryption keys\n- Campaign IDs\n- Victim identifiers\n\n**Tools**: CAPE Sandbox, malware-config extractors\n\n### Creating Detection Rules\n\n**YARA Rule Example**:\n```yara\nrule Emotet_Loader {\n    meta:\n        description = "Emotet loader"\n        author = "Analyst"\n    strings:\n        $s1 = "POST" ascii\n        $s2 = {8B 45 ?? 89 45 ?? 8B 45}\n    condition:\n        uint16(0) == 0x5A4D and all of them\n}\n```\n\n**Snort/Suricata Rule**:\n```\nalert http any any -> any any (msg:"Malware C2 Beacon"; content:"POST"; http_method; content:"/gate.php"; http_uri; sid:1000001;)\n```