IOC Scanner

A Python-based IOC (Indicator of Compromise) scanner that matches known malicious indicators against log files and generates findings reports.

Built to practice threat detection, log analysis, and SOC workflows.

Features

• Match IPs, domains, and file hashes against log files
• CLI interface with argparse
• Export findings to TXT and JSON
• Custom log and IOC file paths
• Custom TXT and JSON output paths

Screenshots

CLI Help

CLI Usage

Project Structure

ioc-scanner/
├── src/
│   ├── scanner.py      # IOC loading and log matching logic
│   ├── reporter.py     # findings output and TXT/JSON export
│   └── main.py         # CLI entry point
├── data/
│   ├── iocs.txt        # sample IOC list (IPs, domains, hashes)
│   └── sample.log      # sample log file for testing
├── reports/            # generated findings reports
├── screenshots/
└── README.md

Installation

git clone https://github.com/yugg755i/ioc-scanner.git
cd ioc-scanner

Usage

Run with default sample data:

python src/main.py

Specify custom log and IOC files:

python src/main.py --log /var/log/auth.log --ioc data/iocs.txt

Export findings:

python src/main.py --save-txt
python src/main.py --save-json
python src/main.py --save-txt --save-json

Custom output paths:

python src/main.py --save-txt --txt-path /tmp/findings.txt
python src/main.py --save-json --json-path /tmp/findings.json

IOC Format

One indicator per line in a plain text file:

185.220.101.1
malicious-domain.com
44d88612fea8a8f36de82e1278abb02f

Supports IPs, domains, and file hashes.

Example Output

[HIGH] 3 IOC matches found

IOC: 185.220.101.1
Line: 2025-06-10 08:17:01 WARNING Failed login from 185.220.101.1

IOC: malicious-domain.com
Line: 2025-06-10 08:21:44 WARNING DNS request sent to malicious-domain.com

IOC: 44d88612fea8a8f36de82e1278abb02f
Line: 2025-06-10 08:26:10 WARNING File hash detected: 44d88612fea8a8f36de82e1278abb02f

Stack

• Python 3.10+
• Standard library only (no external dependencies)