<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# IOC Extraction — API Reference

## VirusTotal API v3

### File Report

```bash
curl -s -H "x-apikey: $VT_KEY" \
  "https://www.virustotal.com/api/v3/files/<sha256>" | jq
```

### File Search

```bash
curl -s -H "x-apikey: $VT_KEY" \
  "https://www.virustotal.com/api/v3/intelligence/search?query=<query>"
```

### Rate Limits
- Free: 4 requests/min, 500/day
- Premium: 30 requests/min

## iocextract (Python)

```bash
pip install iocextract
```

```python
import iocextract

text = open("sample_strings.txt").read()
iocextract.extract_urls(text)         # URLs
iocextract.extract_ips(text)          # IP addresses
iocextract.extract_emails(text)       # Emails
iocextract.extract_hashes(text)       # Hashes
iocextract.extract_yara_rules(text)   # Embedded YARA
```

## STIX 2.1 (Python)

```bash
pip install stix2
```

```python
from stix2 import Indicator, Bundle

indicator = Indicator(
    name="Malicious hash",
    pattern="[file:hashes.'SHA-256' = 'abc123']",
    pattern_type="stix",
    valid_from="2026-01-01T00:00:00Z",
)
bundle = Bundle(objects=[indicator])
print(bundle.serialize(pretty=True))
```

### STIX Pattern Examples

| IOC Type | Pattern |
|----------|---------|
| SHA-256 | `[file:hashes.'SHA-256' = 'abc']` |
| Domain | `[domain-name:value = 'evil.com']` |
| IPv4 | `[ipv4-addr:value = '1.2.3.4']` |
| URL | `[url:value = 'http://evil.com']` |
| Email | `[email-addr:value = 'bad@evil.com']` |
| File | `[file:name = 'malware.exe']` |
| Registry | `[windows-registry-key:key = 'HKLM\\...']` |

## FLOSS (FLARE Obfuscated String Solver)

```bash
floss sample.exe                    # All strings
floss sample.exe -j                 # JSON output
floss sample.exe --no stack_strings # Skip stack strings
floss sample.exe -n 8              # Minimum length 8
```

## ssdeep (Fuzzy Hashing)

```bash
ssdeep sample.exe                   # Generate hash
ssdeep -m known_hashes.txt sample.exe  # Compare against known
ssdeep -d samples/*.exe             # Compare directory (all-vs-all)
```

## MISP API

```bash
# Add indicator
curl -H "Authorization: $MISP_KEY" -H "Content-Type: application/json" \
  -d '{"Event": {"info": "Malware IOCs", "Attribute": [{"type": "sha256", "value": "abc123"}]}}' \
  https://misp/events/add
```
