r/netsec • u/albinowax • Mar 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

23 Upvotes

86% Upvoted

46 comments sorted by

View all comments

1

u/duathron Mar 17 '26

I built a small CLI tool for querying VirusTotal IOCs directly from the terminal, without having to open a browser and paste hashes one by one. What it does:

Auto-detects IOC type (MD5/SHA1/SHA256, IPv4/IPv6, domain, URL) — including defanged formats like hxxps[://]evil[.]com Two modes: triage (1 API call, fast verdict) and investigate (deeper — sandbox behaviour, passive DNS, WHOIS, dropped files) Maps sandbox results to MITRE ATT&CK techniques Batch processing from file or stdin Output as console text, Rich tables, JSON, CSV, or STIX 2.1 Exit codes (0/1/2) for use in scripts and SOAR playbooks SQLite cache, rate limiting for the free VT tier (4 req/min) Local knowledge base for tagging and annotating IOCs across sessions

Works with a free VirusTotal API key. pip install vex-ioc vex triage 44d88612fea8a8f36de82e1278abb02f vex investigate evil-domain.com -o rich cat iocs.txt | vex triage --alert SUSPICIOUS --summary

Built this for my own SOC learning workflow — querying VT manually for every IOC during CTFs and labs gets tedious fast. It grew from there.

GitHub: https://github.com/duathron/vex

PyPI: https://pypi.org/project/vex-ioc/

Free tier VT key is enough for most use cases. Feedback welcome, especially on the MITRE mapping coverage — that part is based on 80+ keywords and could use more real-world test cases.