ioc-extractor/dist/chunk-7HCTUD4R.js

IoC (Indicator of Compromise) extractor

import {
  dedup,
  sortByValue
} from "./chunk-AUD6FQ2X.js";
import {
  urlRegex
} from "./chunk-JDWFL65M.js";
import {
  emailRegex
} from "./chunk-B2TB3BWS.js";
import {
  domainRegex
} from "./chunk-2C3BXX7F.js";
import {
  asnRegex,
  btcRegex,
  cveRegExp,
  ethRegex,
  gaPubIDRegex,
  gaTrackIDRegex,
  macAddressRegex,
  md5Regex,
  sha1Regex,
  sha256Regex,
  sha512Regex,
  ssdeepRegex,
  xmrRegex
} from "./chunk-A2GVSYTG.js";
import {
  ipRegex
} from "./chunk-JJ3RH2QY.js";

// src/aux/extractors.ts
function matchesWithRegExp(s, regexp, options = { sort: true }) {
  const matched = s.match(regexp);
  const values = matched === null ? [] : dedup(matched);
  return options.sort ? sortByValue(values) : values;
}
function getFirstMatchedValue(s, regexp) {
  if (regexp.global) {
    const flags = regexp.flags.replace("g", "");
    regexp = new RegExp(regexp.source, flags);
  }
  const matched = s.match(regexp);
  return matched === null ? null : matched[0];
}
function extractMD5s(s, options = { sort: true }) {
  return matchesWithRegExp(s, md5Regex, options);
}
function extractMD5(s) {
  return getFirstMatchedValue(s, md5Regex);
}
function extractSHA1s(s, options = { sort: true }) {
  return matchesWithRegExp(s, sha1Regex, options);
}
function extractSHA1(s) {
  return getFirstMatchedValue(s, sha1Regex);
}
function extractSHA256s(s, options = { sort: true }) {
  return matchesWithRegExp(s, sha256Regex, options);
}
function extractSHA256(s) {
  return getFirstMatchedValue(s, sha256Regex);
}
function extractSHA512s(s, options = { sort: true }) {
  return matchesWithRegExp(s, sha512Regex, options);
}
function extractSHA512(s) {
  return getFirstMatchedValue(s, sha512Regex);
}
function extractSSDEEPs(s, options = { sort: true }) {
  return matchesWithRegExp(s, ssdeepRegex, options);
}
function extractSSDEEP(s) {
  return getFirstMatchedValue(s, ssdeepRegex);
}
function extractASNs(s, options = { sort: true }) {
  if (!s.includes("AS")) {
    return [];
  }
  return matchesWithRegExp(s, asnRegex, options);
}
function extractASN(s) {
  if (!s.includes("AS")) {
    return null;
  }
  return getFirstMatchedValue(s, asnRegex);
}
function extractDomains(s, options = { strict: true, sort: true }) {
  if (!s.includes(".")) {
    return [];
  }
  const regexp = domainRegex(options);
  const values = matchesWithRegExp(s, regexp);
  return options.sort ? sortByValue(values) : values;
}
function extractDomain(s, options = { strict: true }) {
  if (!s.includes(".")) {
    return null;
  }
  const regexp = domainRegex(options);
  return getFirstMatchedValue(s, regexp);
}
function extractEmails(s, options = { strict: true, sort: true }) {
  if (!s.includes("@") && !s.includes(".")) {
    return [];
  }
  const regexp = emailRegex(options);
  const values = matchesWithRegExp(s, regexp);
  return options.sort ? sortByValue(values) : values;
}
function extractEmail(s, options = { strict: true }) {
  if (!s.includes("@") && !s.includes(".")) {
    return null;
  }
  const regexp = emailRegex(options);
  return getFirstMatchedValue(s, regexp);
}
function extractIPv4s(s, options = { sort: true }) {
  if (!s.includes(".")) {
    return [];
  }
  return matchesWithRegExp(s, ipRegex.v4(), options);
}
function extractIPv4(s) {
  if (!s.includes(".")) {
    return null;
  }
  return getFirstMatchedValue(s, ipRegex.v4());
}
function extractIPv6s(s, options = { sort: true }) {
  return matchesWithRegExp(s, ipRegex.v6(), options);
}
function extractIPv6(s) {
  return getFirstMatchedValue(s, ipRegex.v6());
}
function extractURLs(s, options = { strict: true, sort: true }) {
  const regexp = urlRegex(options);
  return matchesWithRegExp(s, regexp, options);
}
function extractURL(s, options = { strict: true }) {
  const regexp = urlRegex(options);
  return getFirstMatchedValue(s, regexp);
}
function extractCVEs(s, options = { sort: true }) {
  return matchesWithRegExp(s, cveRegExp, options);
}
function extractCVE(s) {
  return getFirstMatchedValue(s, cveRegExp);
}
function extractBTCs(s, options = { sort: true }) {
  return matchesWithRegExp(s, btcRegex, options);
}
function extractBTC(s) {
  return getFirstMatchedValue(s, btcRegex);
}
function extractXMRs(s, options = { sort: true }) {
  return matchesWithRegExp(s, xmrRegex, options);
}
function extractXMR(s) {
  return getFirstMatchedValue(s, xmrRegex);
}
function extractGAPubIDs(s, options = { sort: true }) {
  return matchesWithRegExp(s, gaPubIDRegex, options);
}
function extractGAPubID(s) {
  return getFirstMatchedValue(s, gaPubIDRegex);
}
function extractGATrackIDs(s, options = { sort: true }) {
  return matchesWithRegExp(s, gaTrackIDRegex, options);
}
function extractGATrackID(s) {
  return getFirstMatchedValue(s, gaTrackIDRegex);
}
function extractMacAddresses(s, options = { sort: true }) {
  return matchesWithRegExp(s, macAddressRegex, options);
}
function extractMacAddress(s) {
  return getFirstMatchedValue(s, macAddressRegex);
}
function extractETHs(s, options = { sort: true }) {
  return matchesWithRegExp(s, ethRegex, options);
}
function extractETH(s) {
  return getFirstMatchedValue(s, ethRegex);
}

export {
  matchesWithRegExp,
  extractMD5s,
  extractMD5,
  extractSHA1s,
  extractSHA1,
  extractSHA256s,
  extractSHA256,
  extractSHA512s,
  extractSHA512,
  extractSSDEEPs,
  extractSSDEEP,
  extractASNs,
  extractASN,
  extractDomains,
  extractDomain,
  extractEmails,
  extractEmail,
  extractIPv4s,
  extractIPv4,
  extractIPv6s,
  extractIPv6,
  extractURLs,
  extractURL,
  extractCVEs,
  extractCVE,
  extractBTCs,
  extractBTC,
  extractXMRs,
  extractXMR,
  extractGAPubIDs,
  extractGAPubID,
  extractGATrackIDs,
  extractGATrackID,
  extractMacAddresses,
  extractMacAddress,
  extractETHs,
  extractETH
};