diff --git a/pkgs/development/python-modules/iocextract/default.nix b/pkgs/development/python-modules/iocextract/default.nix
new file mode 100644
index 000000000000..46ff17b9894b
--- /dev/null
+++ b/pkgs/development/python-modules/iocextract/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, regex
+}:
+
+buildPythonPackage rec {
+  pname = "iocextract";
+  version = "1.15.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "InQuest";
+    repo = "python-iocextract";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-muto8lr3sP44bLFIoAuPeS8pRv7pNP1JFKaAJV01TZY=";
+  };
+
+  propagatedBuildInputs = [
+    regex
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "iocextract"
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
+  meta = with lib; {
+    description = "Module to extract Indicator of Compromises (IOC)";
+    homepage = "https://github.com/InQuest/python-iocextract";
+    changelog = "https://github.com/InQuest/python-iocextract/releases/tag/v${version}";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cca980259525..c6fd775006e6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8606,6 +8606,8 @@ with pkgs;
 
   ioccheck = callPackage ../tools/security/ioccheck { };
 
+  iocextract = with python3Packages; toPythonApplication iocextract;
+
   ioping = callPackage ../tools/system/ioping { };
 
   ior = callPackage ../tools/system/ior { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b54543c3c4a7..702326b9d3c8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4800,6 +4800,8 @@ self: super: with self; {
 
   iocapture = callPackage ../development/python-modules/iocapture { };
 
+  iocextract = callPackage ../development/python-modules/iocextract { };
+
   ionhash = callPackage ../development/python-modules/ionhash { };
 
   iotawattpy = callPackage ../development/python-modules/iotawattpy { };