extract_iocs
Extract IOCs (IPs, domains, URLs, hashes, registry keys, etc.) from text with confidence scoring
How to use it
extract_iocs is exposed by the Remnux MCP Server MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the extract_iocs tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Remnux MCP Server
docker run -d --name remnux remnux/remnux-distro:nobleOther tools in Remnux MCP Server (17)
Auto-select and run REMnux tools based on detected file type
For a Windows PE, report per-behavior staticcapability (clipboard, HTTP/WinHTTP C2, injection, persistence, etc.) from the import table; packed/.NET binaries return analysisincomplete, not a false negative
Check which REMnux analysis tools are installed and available
Structured diff of two related samples (loader vs payload): size/entropy, architecture, compiler, packer, imports, capabilities, and sections added/removed
Download a file from the output directory to the host (password-protected archive by default; password: infected)
Download a file from a URL into the samples directory
Extract .zip, .7z, .rar archives with automatic password detection (infected, malware, virus). Handles WinZip AES-256 .zip and header-encrypted .7z (-mhe=on) by routing to 7z automatically
Get file type, hashes (SHA256, MD5), basic metadata
Return bundled, offline OSINT triage guidance for malware indicators. Enrichment tradecraft (hash-first, disclosure-aware, do-not-tip-off-the-adversary, leads-not-verdicts) plus a curated, PR-maintained catalog of free and freemium lookup services. topic selects the guidance slice, ioctype narrows t
Return bundled report writing guidelines (sections, confidence, capabilities, IOC tiering, anti-patterns); topic narrows the digest, or topic='triagechecklist' returns the pre-claim artifact-vs-behavior triage discipline checklist
Return a bundled malware analysis report template (CC BY 4.0, by Lenny Zeltser) for drafting a report offline. The response also carries an optionalsectionconvention explaining that headings marked (Optional) are conditional markers to resolve, not literal heading text
Get usage help (--help output) for any installed REMnux tool
List files in samples or output directory
Execute a command in REMnux (supports piped commands)
Detect file type and return recommended tools with analysis hints (no execution)
Upload a file from the host to the samples directory (200MB limit)
Check whether an embedded string is referenced by code (referencedfromcode) or vestigial (nocodexrefsdetected) using radare2 — never claims a string is "unused"; degraded analysis returns unknown