FangShepherd: A Lightweight IOC Defanging Tool

FangShepherd CLI Window

In the world of cybersecurity, sharing threat intelligence is a daily necessity. Whether you’re in digital forensics, incident response, or threat hunting, you’ve likely shared Indicators of Compromise (IOCs) like URLs, IP addresses, email addresses, and file hashes. But sharing these indicators comes with a risk: active IOCs can accidentally be clicked or executed, leading to unintended consequences.

Enter FangShepherd, a lightweight, command-line Python tool designed to make the process of defanging and refanging IOCs simple, fast, and efficient.

Why Defanging Matters

When sharing IOCs in emails, reports, or chat platforms, defanging protects recipients from accidentally triggering malicious content. For instance:

Original: http://malicious.example.com
Defanged: hxxp://malicious[.]example[.]com

Defanging ensures links are inert, IPs can’t be easily accessed, and email addresses won’t be automatically parsed by software. FangShepherd automates this process while supporting a wide array of IOC types, saving time and reducing human error.

Features at a Glance

• IOC Extraction: URLs, IPs, emails, MD5, SHA1, and SHA256 hashes.
• Flexible Input: Paste text directly or read from a file.
• Defang or Refang: Bidirectional conversion for safer sharing or reactivation.
• Save Results: Output processed data to a file for reporting or archiving.

How FangShepherd Works

FangShepherd uses Python’s re module for regex pattern matching to identify IOCs in logs or text blobs. Here's what it looks for:

URLs: http[s]://...

IPs: 123.123.123.123

Emails: user@example.com

Hashes:

• MD5: 32-character hex
• SHA1: 40-character hex
• SHA256: 64-character hex

Defanging involves replacing certain characters to neutralize the IOC:

• http ➔ hxxp
• . ➔ [.]
• @ ➔ [@]

Refanging reverses this, returning IOCs to their active form when needed for analysis or tool ingestion.

Running the Tool

You can run FangShepherd from the terminal with ease:

$ python3 fangshepherd.py

You’ll be greeted with the FangShepherd banner and prompted to:

Select your action:

1. Extract + Defang
2. Extract + Refang
3. Just Defang
4. Just Refang

Choose input method:

1. Paste text

2. Read from file

After processing, you’ll see the results in the terminal and can optionally save them to a file.

Sample Use Case: Log Analysis

Let’s say you’ve received firewall logs or Windows event logs filled with potential IOCs. FangShepherd allows you to safely extract and defang these for sharing with your team or reporting to stakeholders. Here’s a snippet of a sample log entry:

Connection attempt from 192.168.1.25 to http://evilsite.com on port 80. File hash: a4d55a8d778e5022fab701977c5d840bbc486d0.

FangShepherd will identify and defang the URL, IP, and hash, outputting:

hxxp://evilsite[.]com
192[.]168[.]1[.]25
a4d55a8d778e5022fab701977c5d840bbc486d0

Get Involved

FangShepherd is open source and available on GitHub. Contributions, issues, and feature requests are welcome! If you find it useful, give it a star and share it with your colleagues.

GitHub Repo: https://github.com/alaynavendetta/FangShepherd

Feel free to fork it, improve it, or build your own modules on top of it.

Final Thoughts

Tools like FangShepherd empower analysts to work faster and safer. In an era of constant cyber threats, being able to efficiently extract and sanitize IOCs for sharing is essential. FangShepherd is designed to do just that — with simplicity, flexibility, and a touch of flair.

Stay safe, defang responsibly, and shepherd your IOCs wisely.