code: def expand_indicators(indicator):
          
          if indicator.count(' : ') > 0:
              # handle all multi-valued indicators types (file hashes and custom indicators)
              indicator_list = []
  
              # group 1 - lazy capture everything to first <space>:<space> or end of line
              iregx_pattern = r'^(.*?(?=\s\:\s|$))?'
              iregx_pattern += r'(?:\s\:\s)?'  # remove <space>:<space>
              # group 2 - look behind for <space>:<space>, lazy capture everything
              #           to look ahead (optional <space>):<space> or end of line
              iregx_pattern += r'((?<=\s\:\s).*?(?=(?:\s)?\:\s|$))?'
              iregx_pattern += r'(?:(?:\s)?\:\s)?'  # remove (optional <space>):<space>
              # group 3 - look behind for <space>:<space>, lazy capture everything
              #           to look ahead end of line
              iregx_pattern += r'((?<=\s\:\s).*?(?=$))?$'
              iregx = re.compile(iregx_pattern)
  
              indicators = iregx.search(indicator)
              if indicators is not None:
                  indicator_list = list(indicators.groups())
          else:
              # handle all single valued indicator types (address, host, etc)
              indicator_list = [indicator]
  
          return indicator_list
docs: Process indicators expanding file hashes/custom indicators into multiple entries.
  
          Args:
              indicator (string): " : " delimited string
          Returns:
              (list): a list of indicators split on " : ".