iocextract
iocextract copied to clipboard
IPv4 extraction doesn't recognize netstat command input
iocextract doesn't seem to recognize any IPv4 addresses from netstat output since they all end with .<port number> or the protocol. For example, 10.1.1.117.4222 and 10.1.1.117.https.
It pulls out IPv6 adddresses just fine, though.
This would be a super useful addition to have when triaging host events from an DFIR standpoint :)
Any suggested work around or is there a possible patch that would cover this?