An Automatic Assessment Method of Cyber Threat Intelligence Combined with ATT&CK Matrix

Table 3

IOCs’ regular expressions and example.

IOC feature	Regex expression	Example
IP	^((25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(25[0-5]|2[0-4]\d|[01]?\d\d?)$	41.208.110.46
Hash	\b[a-fA-F\d]{32}\b|\b[a-fA-F\d] {40}\b|\b[a-fA-F\d]{64}\b	830a09ff05eac9a5f42897ba5176a36a
Domain	\b(([a-zA-Z]\?\]|[\?\a-zA-Z][\?\a-zA-Z0-9\-][\?\a-zA-Z0-9)\.)+([A-Za-z0-9][A-Za-z0-9\-][A-Za-z0-9]|[A-Za-z0-9])\b	http://gezelimmi.com
URL	\b([a-z]{3,}\:\/\/[\S]{16,})\b	http://www.secureworks.com/
Email	\b([a-z][_a-z0-9-.]+@[a-z0-9-]+\.[a-z]+)\b	[e-mail]