forensicate.net

notes from the trenches

UTC

Rapidly Triage Indicators with IOC Recon

Posted 2026-07-06 by Andrew Prince · 1 min read ·

Table of Contents
  1. Features
  2. Install
  3. References
exfiltrace-labs/ioc-reconPublic
TypeScript00

Install it here: IOC Recon - Context Menu Search

Triaging indicators usually means the same tedious loop: copy an IP, paste it into VirusTotal, copy it again, paste it into your next source, then do the same for each domain, hash, and URL you’re chasing. IOC Recon collapses that loop into a single right-click.

Features

  • Right-click any selection to search every matching source at once, or fire “Search all matching sources” to open them in background tabs.
  • Smart indicator detection for IPv4, IPv6, domains, URLs, emails, MD5, SHA1, SHA256, and CVEs, so only relevant sources show up.
  • Automatic refang of defanged indicators (hxxp, [.], [at]), plus copy-refanged and copy-defanged actions from the menu.
  • Configurable sources built from a URL template and a %s placeholder, GET or POST, with optional URL or Base64 encoding.
  • Per-source regex rules: a match pattern that controls when a source appears, and transforms that rewrite the selection first (for example, a MITRE sub-technique like T1543.003 into the T1543/003 path ATT&CK expects).
  • Group sources into categories, reorder them, and open results in the background.
  • Import and export configurations as JSON, or sync a shared, version-controlled source list across your team from a remote URL.

Install

IOC Recon is available on the Chrome Web Store and the Firefox Add-ons repository, and the source is on GitHub if you’d rather build it yourself or contribute.

References