GDIOCSpider: Extracting and Identifying IOCs from the GDriveverse
summary
GDIOCSpider is an open-source Python tool that crawls a Google Drive via user and service account auth, downloads each file temporarily, runs a configurable regex parser called IOCFlagger (loose or strict), types hits (IP, domain, hash, email, URL), defangs URLs, prints per-type counts and file locations, and exports full results to CSV. Config supports allow/deny lists, MIME types, and delimiters; demo runs and deletes temp downloads on completion.
AI-written summary · about
chapters (15)
- 0:00GDIOCSpider intro
- 1:05Indicator of compromise
- 2:07Google Drive IOC need
- 3:52GDIOCSpider file processing
- 4:54Extraction parameters
- 6:18IOC types and defanging
- 8:23Tool future improvements
- 8:44Live demo setup
- 10:07Running tool and output
- 13:13CSV data analysis
- 15:05Incident response use case
- 17:09Tool access and install
- 18:14Q&A: Dropbox integration
- 19:21Q&A: Direct file links
- 20:04Q&A: Password audit
related talks
23mGoogle Drive Hunter: Building the Tool Google Should’ve Built (Ayman Elsawah)
30mTrawling for IOCs: Catching C2 in a Sea of Data
37mAutomatic Extraction of Indicators of Compromise for Web App.
31mAttack Hunting with Threat Intelligence
39mBye-Bye DIY: Frictionless Security Operations with Google
22mTechnical Tracks
46mMastering Web Scraping: Unleash Your Data Extraction Wizardry!
13mIOCs Are Dead -- Long Live IOCs!