Right-click Analyst's IOC Navigator
RAIN is a small Chromium extension for analysts who are tired of copying the same indicator into five different tabs.
Highlight an IP, domain, URL, hash, account, CVE, or User-Agent string. RAIN cleans up common defanging, works out what you selected, and sends it to the hunting tool you choose. For Microsoft Defender, it can open Advanced Hunting and insert a ready-to-review KQL query.
It is named after a particularly relentless miniature dachshund. Small, fast, and unwilling to let go of a scent.
- Hunts selected text from the right-click menu, floating button, keyboard shortcut, or side panel.
- Refangs indicators such as
hxxps://evil[.]example/pathbefore searching. - Recognises IPv4, IPv6, domains, URLs, MD5, SHA-1, SHA-256, accounts, email addresses, CVEs, and common User-Agent strings.
- Opens individual tools or uses Yeet Search to open a whole category in one collapsed tab group.
- Inserts customisable KQL into Microsoft Defender Advanced Hunting. RAIN never runs the query for you.
- Keeps templates and settings in local extension storage. There is no RAIN account, backend, or telemetry.
Install RAIN from the Chrome Web Store.
- Download the latest package from GitHub Releases and extract it, or clone this repository.
- Open
chrome://extensionsoredge://extensions. - Enable Developer mode.
- Choose Load unpacked and select the RAIN folder.
- Refresh any tabs that were already open.
RAIN requires Chrome 116 or another compatible Chromium browser.
Select an indicator, then use whichever route suits the page:
- Right-click and choose RAIN - Hunt IOC.
- Click the dachshund button that appears beside selected text.
- Press the hunt shortcut (
Alt+Rby default). - Open the RAIN side panel and paste an indicator manually.
If a site replaces the browser's context menu, hold Shift while right-clicking to get the native menu back.
RAIN's classification is only a starting point. The hunt menu lets you switch the indicator type before opening a tool.
| Indicator | Tools |
|---|---|
| IP | Talos, VirusTotal, URLScan, AbuseIPDB, Shodan, Censys, Defender AHQ |
| Domain or URL | VirusTotal, URLScan, Talos, URLVoid, MXToolbox, Crt.sh, Censys, Defender AHQ |
| File hash | VirusTotal, Hybrid Analysis, AlienVault OTX, Defender AHQ |
| Account or email | Have I Been Pwned, Defender AHQ |
| CVE | NIST NVD, CISA KEV, MITRE CVE, Defender AHQ |
| User-Agent | Defender AHQ, CyberChef, Google, GitHub |
| Anything | CyberChef |
Choosing a Defender hunt opens the Advanced Hunting page and inserts a KQL query after the editor loads.
- The query is inserted, not executed. Read it before pressing Run.
- You need an active Defender session with access to Advanced Hunting.
- Templates for each indicator type can be changed from RAIN's options page.
- Keep the documented placeholder as a standalone quoted value or bare token. RAIN places the indicator in a separately escaped KQL string declaration so selected text cannot change the query structure.
RAIN runs a content script on pages you visit so it can show the floating hunt button, read selected text when you invoke the shortcut, and restore the native context menu. It also runs inside frames because security portals and document applications often put useful text there.
RAIN does not collect telemetry or send data to its own service. Settings stay in local extension storage. An indicator leaves the browser only when you deliberately open one of the listed third-party services.
The only site where RAIN injects anything is https://security.microsoft.com, and the injected action only fills the Advanced Hunting editor.
The full details are in the privacy policy.
Public reputation services receive the indicator you submit. Avoid sending internal hostnames, employee accounts, or sensitive incident indicators to public tools unless that fits your team's policy. The dachshund cannot un-bark.
- RAIN is missing from a page: refresh tabs that were open before installation. Chromium also blocks extensions on browser pages, the Web Store, and some built-in viewers.
- A site has its own right-click menu: hold Shift while right-clicking, use the floating button, or use the shortcut.
- The shortcut does nothing: another extension or the browser may already use it. Change it at
chrome://extensions/shortcuts. - No KQL appears in Defender: make sure you are signed in and that the Advanced Hunting editor has loaded.
- The side panel opens without your selection: some canvas-based applications and protected browser pages do not expose selected text. Paste the indicator into the panel instead.
Issues and pull requests are welcome. Good places to start are missing defang patterns, hunting tools that would be useful to other analysts, and browser pages where one of the hunt surfaces behaves badly.
Please keep additions focused. RAIN is meant to stay small.
RAIN is a hobby project. If it saves you a few minutes during triage and you feel like supporting it:
