hunt_ioc_pack
Hunts behavioral Indicators of Compromise (IoCs) from forensics metadata packs—scanning exported logs, filenames, and PCAP payloads to detect adversary activity in collected artifacts.
Instructions
Hunt behavioral IoCs from a metadata pack across exported logs, text artifacts, filenames, and PCAP payloads. Bundled pack: impacket-iocs.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pack | No | Bundled pack id/name to load | impacket-iocs |
| limit | No | Maximum findings/hits to return | |
| max_files | No | Maximum files to inspect | |
| pack_path | No | Optional external pack directory or pack.json path | |
| scan_pcap | No | Scan PCAP payloads when scapy is installed | |
| scan_files | No | Scan plaintext exports/logs and filenames | |
| artifacts_dir | Yes | Base directory containing forensic artifacts, exported logs, PCAPs, or parsed tool output | |
| max_file_size | No | Skip files larger than this many bytes |