Indicator Types in ThreatStream

IP address associated with a system involved in a malicious activity.

Example: itype="actor_ip"

IPv6 address associated with a system involved in a malicious activity.

Example: itype="actor_ipv6"

Phone number associated with a threat actor.

Example: itype="actor_phone_number"

Subject from an email associated with a threat actor.

Example: itype="actor_subject"

Username associated with a threat actor.

Example: itype="actor_username"

Domain name associated with adware or other Potentially Unwanted Applications (PUA).

Example: itype="adware_domain"

Registry key associated with adware or other Potentially Unwanted Applications (PUA).

Example: itype="adware_registry_key"

IP address of the system on which anonymous proxy software is hosted.

Example: itype="anon_proxy"

IPv6 address of the system on which anonymous proxy software is hosted.

Example: itype="anon_proxy_ipv6"

IP address associated with commercial or free Virtual Private Networks (VPN).

Example: itype="anon_vpn"

IPv6 address associated with commercial or free Virtual Private Networks (VPN).

Example: itype:"anon_vpn_ipv6"

Domain name associated with a known Advanced Persistent Threat (APT) actor used for command and control, launching exploits, or data exfiltration.

Example: itype=" apt_domain"

Email address used by a known Advanced Persistent Threat (APT) actor for sending targeted, spear phishing emails.

Example: itype="apt_email"

Subject from an email associated with an Advanced Persistent Threat (APT) actor.

Example: itype="apt_email_subject_line"

Name of a file used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_file_name"

File path used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_file_path"

IP address associated with known Advanced Persistent Threat (APT) actor for command and control, data exfiltration, or targeted exploitation.

Example: itype="apt_ip"

IPv6 address associated with known Advanced Persistent Threat (APT) actor for command and control, data exfiltration, or targeted exploitation.

Example: itype="apt_ipv6"

MD5 or SHA hash of a malware sample used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_md5"

Mail transfer agent used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_mta"

Mutex used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_mutex"

Registry key used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_registry_key"

Description used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_service_description"

Service display name used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_service_displayname"

Service name used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_service_name"

SSDeep Hash used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_ssdeep"

Email subject line used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_subject"

User agent string used by a known Advanced Persistent Threat (APT) actor.

Example: itype="apt_ua"

URL used by a known Advanced Persistent Threat (APT) actor for command and control, launching web based exploits, or data exfiltration.

Example: itype=" apt_url"

Autonomous System Number

Example: itype="asn"

AWS account identifier potentially involved in malicious activities.

Example: itype="aws_account_id"

Trusted device identifier.

Example: itype="benign_device_id"

Allowlisted domain.

Example: itype="benign_domain"

Allowlisted email address.

Example: itype="benign_email"

Allowlisted hash value.

Example: itype="benign_hash"

Internal email address.

Example: itype="benign_internal_email"

Allowlisted IP address.

Example: itype="benign_ip"

Allowlisted URL.

Example: itype="benign_url"

Bitcoin wallet used in transactions.

Example: itype="bitcoin_wallet'

Domain name of an infected machine acting as an autonomous bot.

Example: itype="bot_domain"

IP address of an infected machine acting as an autonomous bot.

Example: itype="bot_ip"

IPv6 address of an infected machine acting as an autonomous bot.

Example: itype="bot_ipv6"

Hash related to a file used by an infected machine acting as an autonomous bot.

Example: itype="bot_md5"

URL of an infected machine acting as an autonomous bot.

Example: itype="bot_url"

User agent string used by a botnet for malicious activity.

Example: itype="botnet_user_agent"

Unique ID given to each browser extension, which is available in the Extension store of such browsers as Firefox, Chrome, and so on.

Example: itype="browser_extension_id"

IP address associated with password brute force activity.

Example: itype="brute_ip"

IPv6 address associated with password brute force activity.

Example: itype="brute_ipv6"

Domain name used by malware for command and control communication.

Example: itype="c2_domain"

DNS name used by malware for command and control communication.

Example: itype="c2_dns_name"

IP address used by malware for command and control communication.

Example: itype="c2_ip"

IPv6 address used by malware for command and control communication.

Example: itype="c2_ipv6"

URL used by malware for command and control communication.

Example: itype="c2_url"

Cloud VM or container instance identifier.

Example: itype="cloud_instance_id"

Cobalt Strike or malware identifier.

Example: itype="cobalt_strike_id"

Internal VPN exit node IP for remote employees.

Example: itype="corp_vpn_ip"

Domain of the system on which commercial proxy software is hosted.

Example: itype="comm_proxy_domain"

IP address of the system on which commercial proxy software is hosted.

Example: itype="comm_proxy_ip"

IPv6 address associated with a commercial web proxy.

Example: itype="comm_proxy_ipv6"

Email address that has been compromised and/or taken over by a threat actor.

Example: itype="compromised_email"

Name of a compromised company.

Example: itype="compromised_company"

Domain name of website or server that has been compromised.

Example: itype="compromised_domain"

Email subject from a known compromised email address.

Example: itype="compromised_email_subject"

IP address of website or server that has been compromised.

Example: itype="compromised_ip"

IPv6 address of website or server that has been compromised.

Example: itype="compromised_ipv6"

Plaintext or hashed password value associated with a compromised credential record.

Example: itype="compromised_password"

Network port associated with a compromised device or session.

Example: itype="compromised_port"

Account information associated with a service account that has been compromised and/or taken over by a threat actor.

Example: itype="compromised_serv_account"

URL of the website or server that has been compromised.

Example: itype="compromised_url"

Username that has been compromised and/or taken over by a threat actor. Must have a length of 128 characters or less.

Example: itype="compromised_username"

File hash for cryptocurrency mining software.

Example: itype="crypto_hash"

IP address associated with a cryptocurrency mining software.

Example: itype="crypto_ip"

IPv6 address associated with a cryptocurrency mining software.

Example: itype="crypto_ipv6"

Domain for cryptocurrency pool.

Example: itype="crypto_pool"

URL where cryptocurrency mining software is hosted.

Example: itype="crypto_url"

Public or private cryptocurrency wallet key.

Example: itype="crypto_wallet"

Identifier for an internal customer account.

Example: itype="customer_account_id"

IP address associated with Distributed Denial of Service (DDoS) attacks.

Example: itype="ddos_ip"

IPv6 address associated with Distributed Denial of Service (DDoS) attacks.

Example: itype="ddos_ipv6"

Unique serial number of an endpoint, laptop, or mobile device.

Example: itype="device_serial_number"

Domain associated with disposable email activity.

Example: itype="disposable_email_domain"

Domain associated with a downloader, which is a type of malware that downloads and runs other malware.

Example: itype="downloader_domain"

Hash of a malicious file associated with a downloader, which is a type of malware that downloads and runs other malware.

Example: itype="downloader_hash"

IP address associated with a downloader, which is a type of malware that downloads and runs other malware.

Example: itype="downloader_ip"

IPv6 address associated with a downloader, which is a type of malware that downloads and runs other malware.

Example: itype="downloader_ipv6"

URL associated with a downloader, which is a type of malware that downloads and runs other malware.

Example: itype="downloader_url"

Domain name used for hosting Dynamic DNS services.

Example: itype="dyn_dns"

Email subject from a known compromised email attachment.

Example: itype="email_attachment_subject"

Internal identifier assigned to an employee.

Example: itype="employee_id"

Encrypted file extension used by malware.

Example: itype="encrypted_file_ext"

Domain name associated with the infrastructure used for data exfiltration.

Example: itype="exfil_domain"

IP address used for data exfiltration.

Example: itype="exfil_ip"

IPv6 address used for data exfiltration.

Example: itype="exfil_ipv6"

URL used for data exfiltration.

Example: itype="exfil_url"

Domain name associated with the web server hosting an exploit kit or launching web-based exploits.

Example: itype="exploit_domain"

IP address associated with the web server hosting an exploit kit or launching web-based exploits.

Example: itype="exploit_ip"

IPv6 address associated with the web server hosting an exploit kit or launching web-based exploits.

Example: itype="exploit_ipv6"

CVE identifier for a vulnerability being exploited.

Example: itype="exploit_cve_id"

Hash related to a file used to exploit a known vulnerability.

Example: itype="exploit_md5"

URL used for launching web-based exploits.

Example: itype="exploit_url"

Domain associated with a fraudulent activity.

Example: itype="fraud_domain"

Email address associated with a fraudulent activity.

Example: itype="fraud_email"

Subject from an email associated with fraud activity.

Example: itype="fraud_email_subject"

File name used in a fraud scheme.

Example: itype="fraud_file_name"

IP address associated with a fraudulent activity.

Example: itype="fraud_ip"

An IPv6 address associated with a fraudulent activity.

Example: itype="fraud_ipv6"

Hash associated with a fraudulent activity.

Example: itype="fraud_md5"

URL associated with a fraudulent activity.

Example: itype="fraud_url"

Domain associated with free email service activity.

Example: itype="free_email_domain"

Name of a frequently abused DNS provider.

Example: itype="freq_abused_dns_provider".

ID of the gaming device associated with a malicious activity.

Example: itype="gaming_device_id"

Name of the gaming device associated with a malicious activity.

Example: itype="gaming_device_name"

ID of the game associated with a malicious activity.

Example: itype="gaming_game_id"

Name of the game associated with a malicious activity.

Example: itype="gaming_game_name"

Country of the player associated with a malicious activity.

Example: itype="gaming_player_country"

Player's email address associated with a malicious activity.

Example: itype="gaming_player_email"

Player's ID associated with a malicious activity.

Example: itype="gaming_player_id"

Player's nickname associated with a malicious activity.

Example: itype="gaming_player_nickname"

Player's phone number associated with a malicious activity.

Example: itype="gaming_player_phone"

URL that can be used to provide IP Geo location services.

Example: itype="geolocation_url"

Name of general hacking software tools used by threat actors.

Example: itype="hack_tool"

MD5 or SHA hash of general hacking software tools used by threat actors.

Example: itype="hack_tool_md5"

User identity in an internal IAM system.

Example: itype="iam_user_id"

IP address observed to be connecting to the I2P (Invisible Internet Project) network.

Example: itype="i2p_ip"

IPv6 address observed to be connecting to the I2P (Invisible Internet Project) network.

Example: itype="i2p_ipv6"

Cryptographic hash of the image used for comparing two different images. It differs from typical MD5, SHA1, SHA2 hashes.

Example: itype="image_hash"

Domain associated with an information stealer.

Example: itype="infostealer_domain"

Hash of a malicious file associated with an information stealer.

Example: itype="infostealer_hash"

IP address associated with an information stealer.

Example: itype="infostealer_ip"

IPv6 address associated with an information stealer.

Example: itype="infostealer_ipv6"

URL associated with an information stealer.

Example: itype="infostealer_url"

Internal hostname or DNS record.

Example: itype="internal_dns_name"

Identifier for workstation, server, or Cloud VM.

Example: itype="internal_host_id"

Internal support or security ticket ID.

Example: itype="internal_ticket_id"

Domain associated with malware targeting Internet of Things devices.

Example: itype="iot_domain"

Hash of a malicious sample targeting Internet of Things devices.

Example: itype="iot_hash"

IP address associated with malware targeting Internet of Things devices.

Example: itype="iot_ip"

IPv6 associated with malware targeting Internet of Things devices.

Example: itype="iot_ipv6"

URL associated with malware targeting Internet of Things devices and services.

Example: itype="iot_url"

URL that can be used to provide IP checking services, such as echoing the Internet facing IP address of the client.

Example: itype="ipcheck_url"

TLS Client/Server fingerprint.

Example: itype="ja3_md5"

TLS Client/Server fingerprint.

Example: itype="ja4_tls_fingerprint"

Domain contacted by malware sample; could be for command and control commands, or to check if the client is online.

Example: itype="mal_domain"

Email address used to send malware through malicious links or attachments.

Example: itype="mal_email"

Subject from an email associated with malware activity.

Example: itype="mal_email_subject"

File name of malware sample.

Example: itype="mal_file_name"

File path of malware sample.

Example: itype="mal_file_path"

HTTP header related to malicious requests.

Example: itype="mal_http_header"

IP address contacted by malware sample; could be for command and control commands, or to check if the client is online.

Example: itype="mal_ip"

IPv6 address contacted by malware sample; could be for command and control commands, or to check if the client is online.

Example: itype="mal_ipv6"

MD5 or SHA hash of malware sample.

Example: itype="mal_md5"

Mutex of malware sample.

Example: itype="mal_mutex"

Malware-associated network port or IP-port composite value.

Example: itype="mal_port"

Registry key of malware sample.

Example: itype="mal_registry_key"

IP address of a malicious relay server.

Example: itype="mal_relay_server_ip"

IPv6 address of a malicious relay server.

Example: itype="mal_relay_server_ipv6"

Service description associated with the malware sample.

Example: itype="mal_service_description"

Service display name associated with the malware sample.

Example: itype="mal_service_displayname"

Service name associated with the malware sample.

Example: itype="mal_service_name"

SMTP header related to a malicious email activity.

Example: itype="mal_smtp_header"

SSDeep Hash associated with the malware sample.

Example: itype="mal_ssdeep"

MD5 or SHA hash of SSL certificate associated with malware or botnet activities.

Example: itype="mal_sslcert_sha1"

User agent string used by malware sample when communicating via HTTP.

Example: itype="mal_ua"

URL contacted by malware sample when run on an infected host.

Example: itype="mal_url"

A wildcard domain associated with malware activities.

Example: itype="mal_wildcard_domain"

A wildcard URL associated with malware activities.

itype="mal_wildcard_url"

Indicator related to mobile malware.

Example: itype="mobile_malware"

Recently registered domain with insufficient history to fully evaluate.

Example: itype="new_domain"

IP addressed associated with a peer-to-peer command and control infrastructure.

Example: itype="p2pcnc"

IPv6 addressed associated with a peer-to-peer command and control infrastructure.

Example: itype="p2pcnc_ipv6"

Domain name of a website which is currently parked.

Example: itype="parked_domain"

IP addressed used for parking newly registered or inactive domain names.

Example: itype="parked_ip"

IPv6 addressed used for parking newly registered or inactive domain names.

Example: itype="parked_ipv6"

URL of a website that is currently parked.

Example: itype="parked_url"

URL that can be used for sharing pastes or text content anonymously.

Example: itype="pastesite_url"

Domain used to perform phishing or spear phishing attacks or contained in a phishing email.

Example: itype="phish_domain"

Email address associated with sending phishing or spear phishing emails to victims.

Example: itype="phish_email"

Subject from an email associated with phishing activity.

Example: itype="phish_email_subject"

File name used in a phishing attack.

Example: itype="phish_file_name"

Identifier for phishing victims.

Example: itype="phishing_target"

IP address that has been used to perform phishing or spear phishing or is contained in a phishing email.

Example: itype="phish_ip"

IPv6 address that has been used to perform phishing or spear phishing or is contained in a phishing email.

Example: itype="phish_ipv6"

Hash related to a file used to perform phishing or spear phishing attacks or contained in a phishing email.

Example: itype="phish_md5"

URL used to perform phishing or spear phishing attacks or contained in a phishing email.

Example: itype="phish_url"

Email of a user who was a victim of a phishing attack.

Example: itype="phish_victim_email"

Phone number used in fraudulent activities.

Example: itype="phone_number"

Unique user ID from a specific platform.

Example: itype="platform_uid"

Domain associated with malware targeting Point of Sales systems.

Example: itype="pos_domain"

Malicious file hash targeting Point of Sales systems.

Example: itype="pos_hash"

IP address associated with malware targeting Point of Sale systems.

Example: itype="pos_ip"

IPv6 address associated with malware targeting Point of Sales systems.

Example: itype="pos_ipv6"

URL associated with malware targeting Point of Sales systems.

Example: itype="pos_url"

IP address hosting open or anonymous proxy software. Allows user to hide their IP address from target.

Example: itype="proxy_ip"

IPv6 address hosting open or anonymous proxy software. Allows user to hide their IP address from target.

Example: itype="proxy_ipv6"

Domain associated with ransomware.

Example: itype="ransomware_domain"

File hash of a malicious ransomware sample.

Example: itype="ransomware_hash"

IP address associated with ransomware.

Example: itype="ransomware_ip"

IPv6 address associated with ransomware.

Example: itype="ransomware_ipv6"

Group associated with ransomware.

Example: itype="ransomware_group"

URL associated with ransomware.

Example: itype="ransomware_url"

Domain of a ransomware victim.

Example: itype="ransomware_victim_domain"

Name of a ransomware victim.

Example: itype="ransomware_victim_name"

URL of a ransomware victim.

Example: itype="ransomware_victim_url"

File hash of rootkit malware that provides root-level access to an attacker.

Example: itype="rootkit_hash"

IP address observed to perform port scanning and vulnerability scanning activities.

Example: itype="scan_ip"

IPv6 address observed to perform port scanning and vulnerability scanning activities.

Example: itype="scan_ipv6"

Temporary authentication token for session management.

Example: itype="session_token"

Domain name that researchers or security companies typically sinkhole.

Example: itype="sinkhole_domain"

IP address that is known to be used to sinkhole malicious domain names.

Example: itype="sinkhole_ip"

IPv6 address that is known to be used to sinkhole malicious domain names.

Example: itype="sinkhole_ipv6"

Name of the social forum associated with a malicious activity.

Example: itype="social_forum_name"

Name of the social media associated with a malicious activity.

Example: itype="social_media_name"

URL related to social media activity. This indicator type is provided by select feeds and cannot be imported through the ThreatStream user interface.

Example: itype="social_media_url"

Messaging service used for malicious activity.

Example: itype="social_messaging services"

Malicious domain name contained in the SPAM email messages.

Example: itype="spam_domain"

Email address that has been observed sending SPAM emails.

Example: itype="spam_email"

Subject from an email associated with spam activity.

Example: itype="spam_email_subject"

IP address that is known to send SPAM emails.

Example: itype="spam_ip"

IPv6 address that is known to send SPAM emails.

Example: itype="spam_ipv6"

Mail transfer agent known to be associated with SPAM emails.

Example: itype="spam_mta"

Malicious URL contained in the SPAM email messages.

Example: itype="spam_url"

URL that can be used to run internet speed tests or bandwidth measurements of the client's network connection.

Example: itype="speedtest_url"

IP addresses associated with SSH brute force attempts.

Example: itype="ssh_ip"

IPv6 addresses associated with SSH brute force attempts.

Example: itype="ssh_ipv6"

Serial number unique to the TLS certificate issuer that identifies the entity being signed.

Example: itype="ssl_cert_serial_number"

Identifier for an active SSO session.

Example: itype="sso_session_id"

Not a true indicator type. Used by Arcsight for suppressing false positives.

Default severity: n/a

Example: itype="suppress"

IPv6 address related to alert suppression.

Example: itype="suppress_ipv6"

Suspected DNS name used by malware for command and control communication.

Example: itype="suspected_c2_dns_name"

Command-line arguments used in execution.

Example: itype="suspicious_cmd_line"

Domain name that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="suspicious_domain"

Email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="suspicious_email"

Email subject from a suspicious email address.

Example: itype="suspicious-email_subject"

IP address that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="suspicious_ip"

IPv6 address related to a suspcious activity.

Example: itype="suspicious_ipv6"

Hash related to a suspicious activity.

Example: itype="suspicious_md5"

Registrant email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="suspicious_reg_email"

A wildcard domain that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="sus_wildcard_domain"

A wildcard URL that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="sus_wildcard_url"

URL that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet.

Example: itype="suspicious_url"

Telegram user or group ID.

Example: itype="telegram_id"

Hostname associated with a threat actor.

Example: itype="threat_actor_hostname"

IP address operating as part of The Onion Router (TOR) Network, also know as a TOR exit node.

Example: itype="tor_ip"

IPv6 address operating as part of The Onion Router (TOR) Network, also know as a TOR exit node.

Example: itype="tor_ipv6"

URL used for tracking bittorrent file transfer activity.

Example: itype="torrent_tracker_url"

TOX messaging platform ID.

Example: itype="tox_id"

Domain associated with Trojan malware that disguises as a legitimate code or software.

Example: itype="trojan_domain"

File hash associated with Trojan malware that disguises as a legitimate code or software.

Example: itype="trojan_hash"

IP address associated with Trojan malware that disguises as a legitimate code or software.

Example: itype="trojan_ip"

IPv6 address associated with a Trojan malware that disguises as a legitimate code of software.

Example: itype="trojan_ipv6"

URL associated with a Trojan malware that disguises as a legitimate code or software.

Example: itype="trojan_url"

Twitter handle or social media identifier.

Example: itype="twitter_handle"

Token used for session tracking.

Example: itype="visitor_token"

Domain name associated with commercial or free Virtual Private Networks (VPN).

Example: itype="vpn_domain"

IP address that is used for hosting Virtual Private Servers (VPS) or other server rentals.

Example: itype="vps_ip"

IPv6 address that is used for hosting Virtual Private Servers (VPS) or other server rentals.

Example: itype="vps_ipv6"

Risk score for a vulnerability.

Example: itype="vuln_risk_score"

Address of a known malicious smart contract.

Example: itype="web3_attack_vector"

Wallet address involved in fraudulent or malicious transactions.

Example: itype="web3_compromised_wallet"

Detection of tampering attempts on decentralized DNS (for example, ENS).

Example: itype="web3_dns_hijacking"

Code pattern within dApps or smart contracts vulnerable to attacks.

Example: itype="web3_exploitable_code"

Address of a known malicious smart contract.

Example: itype="web3_malicious_contract"

Identifier of a fraudulent or scam-related token contract.

Example: itype="web3_malicious_token"

Domain or URL used for Web3 phishing attacks.

Example: itype="web3_phishing_domain"

Transaction behavior indicative of exploits or attacks.

Example: itype="web3_suspicious_pattern"

Registrant email address associated with privacy domain purchased from Whois.

Example: itype="whois_bulk_reg_email"

Privacy domain purchased from Whois.

Example: itype="whois_privacy_domain"

Email address associated with a privacy domain purchased from Whois.

Example: itype="whois_privacy_email"

XAMPP/Jabber messaging ID.

Example: itype="xampp_jabber_id"