ThreatStream Indicator Types
This appendix lists the indicator types (iTypes) available to Anomali Security Analytics from Anomali ThreatStream.
Note: In ThreatStream, indicators have value types Domain, Email, Hash, IP, URL, and String. Security Analytics does not support correlation with indicators having String value types.
| Indicator Type | Name | Type | Severity | Description |
|---|---|---|---|---|
| actor_ip | Actor IP | IP | Low |
IP address associated with a system involved in malicious activity. Example: itype="actor_ip" |
| adware_domain | Adware Domain | Domain | Low |
Domain name associated with adware or other Potentially Unwanted Applications (PUA). Example: itype="adware_domain" |
| anon_proxy | Anonymous Proxy IP | IP | Low |
IP address of the system on which anonymous proxy software is hosted. Example: itype="anon_proxy" |
| anon_vpn | Anonymous VPN IP | IP | Low |
IP address associated with commercial or free Virtual Private Networks (VPN). Example: itype="anon_vpn" |
| apt_domain | APT Domain | Domain | Very High |
Domain name associated with a known Advanced Persistent Threat (APT) actor used for command and control, launching exploits, or data exfiltration. Example: itype=" apt_domain" |
| apt_email | APT Email | High |
Email address used by a known Advanced Persistent Threat (APT) actor for sending targeted, spear phishing emails. Example: itype="apt_email" |
|
| apt_ip | APT IP | IP | Very High |
IP address associated with known Advanced Persistent Threat (APT) actor for command and control, data exfiltration, or targeted exploitation. Example: itype="apt_ip" |
| apt_md5 | APT File Hash | Hash | Very High |
MD5 or SHA hash of a malware sample used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_md5" |
| apt_url | APT URL | URL | Very High |
URL used by a known Advanced Persistent Threat (APT) actor for command and control, launching web based exploits, or data exfiltration. Example: itype=" apt_url" |
| bot_domain | Infected Bot Domain Name | Domain | Low |
Domain name of an infected machine acting as an autonomous bot. Example: itype="bot_domain" |
| bot_ip | Infected Bot IP | IP | Low |
IP address of an infected machine acting as an autonomous bot. Example: itype="bot_ip" |
| bot_md5 | Infected Bot Hash | Hash | Low |
Hash related to a file used by an infected machine acting as an autonomous bot. Example: itype="bot_md5" |
| bot_url | Infected Bot URL | URL | Low |
URL of an infected machine acting as an autonomous bot. Example: itype="bot_url" |
| brute_ip | Brute Force IP | IP | Low |
IP address associated with password brute force activity. Example: itype="brute_ip" |
| c2_domain | Malware C&C Domain Name | Domain | High |
Domain name used by malware for command and control communication. Example: itype="c2_domain" |
| c2_ip | Malware C&C IP Address | IP | High |
IP address used by malware for command and control communication. Example: itype="c2_ip" |
| c2_url | Malware C&C URL | URL | High |
URL used by malware for command and control communication. Example: itype="c2_url" |
| comm_proxy_domain | Commercial Webproxy Domain | Domain | Low |
Domain of the system on which commercial proxy software is hosted. Example: itype="comm_proxy_domain" |
| compromised_domain | Compromised Domain | Domain | Low |
Domain name of website or server that has been compromised. Example: itype="compromised_domain" |
| compromised_email | Compromised Account Email | Low |
Email address that has been compromised and/or taken over by a threat actor. Example: itype="compromised_email" |
|
| compromised_ip | Compromised IP | IP | Low |
IP address of website or server that has been compromised. Example: itype="compromised_ip" |
| compromised_url | Compromised URL | URL | Medium |
URL of the website or server that has been compromised. Example: itype="compromised_url" |
| crypto_hash | Cryptocurrency Mining Software | Hash | High |
File hash for cryptocurrency mining software. Example: itype="crypto_hash" |
| crypto_ip | Cryptocurrency IP | IP | High |
IP address associated with a cryptocurrency mining software. Example: itype="crypto_ip" |
| crypto_pool | Cryptocurrency Pool Domain | Domain | High |
Domain for cryptocurrency pool. Example: itype="crypto_pool" |
| crypto_url | Cryptocurrency URL | URL | High |
URL where cryptocurrency mining software is hosted. Example: itype="crypto_url" |
| ddos_ip | DDOS IP | IP | Low |
IP address associated with Distributed Denial of Service (DDoS) attacks. Example: itype="ddos_ip" |
| disposable_email_domain | Disposable Email Domain | Domain | Low |
Domain associated with disposable email activity. Example: itype="disposable_email_domain" |
| downloader_domain | Downloader Domain | Domain |
Domain associated with a downloader, which is a type of malware that downloads and runs other malware. Example: itype="downloader_domain" |
|
| downloader_hash | Downloader File Hash | Hash | High |
Hash of a malicious file associated with a downloader, which is a type of malware that downloads and runs other malware. Example: itype="downloader_hash" |
| downloader_ip | Downloader IP | IP | High |
IP address associated with a downloader, which is a type of malware that downloads and runs other malware. Example: itype="downloader_ip" |
| downloader_url | Downloader URL | URL | High |
URL associated with a downloader, which is a type of malware that downloads and runs other malware. Example: itype="downloader_url" |
| dyn_dns | Dynamic DNS | Domain | Low |
Domain name used for hosting Dynamic DNS services. Example: itype="dyn_dns" |
| exfil_domain | Data Exfiltration Domain | Domain | High |
Domain name associated with the infrastructure used for data exfiltration. Example: itype="exfil_domain" |
| exfil_ip | Data Exfiltration IP | IP | High |
IP address used for data exfiltration. Example: itype="exfil_ip" |
| exfil_url | Data Exfiltration URL | URL | High |
URL used for data exfiltration. Example: itype="exfil_url" |
| exploit_domain | Exploit Kit Domain | Domain | Very High |
Domain name associated with the web server hosting an exploit kit or launching web-based exploits. Example: itype="exploit_domain" |
| exploit_ip | Exploit Kit IP | IP | High |
IP address associated with the web server hosting an exploit kit or launching web-based exploits. Example: itype="exploit_ip" |
| exploit_md5 | Exploit Hash | Hash | Low |
Hash related to a file used to exploit a known vulnerability. Example: itype="exploit_md5" |
| exploit_url | Exploit Kit URL | URL | Very High |
URL used for launching web-based exploits. Example: itype="exploit_url" |
| fraud_domain | Fraud Domain | Domain | High |
Domain associated with fraudulent activity. Example: itype="fraud_domain" |
| fraud_email | Fraud Email | Low |
Email address associated with fraudulent activity. Example: itype="fraud_email" |
|
| fraud_ip | Fraud IP Address | IP | High |
IP address associated with fraudulent activity. Example: itype="fraud_ip" |
| fraud_md5 | Fraud Hash | Hash | Very High |
Hash associated with fraudulent activity. Example: itype="fraud_md5" |
| fraud_url | Fraud URL | URL | Medium |
URL associated with fraudulent activity. Example: itype="fraud_url" |
| free_email_domain | Free Email Domain | Domain | Low |
Domain associated with free email service activity. Example: itype="free_email_domain" |
| geolocation_url | IP Geolocation URL | URL | Low |
URL that can be used to provide IP Geo location services. Example: itype="geolocation_url" |
| hack_tool_md5 | Hack Tool File Hash | Hash | Very High |
MD5 or SHA hash of general hacking software tools used by threat actors. Example: itype="hack_tool_md5" |
| i2p_ip | I2P IP Address | IP | Low |
IP address observed to be connecting to the I2P (Invisible Internet Project) network. Example: itype="i2p_ip" |
| infostealer_domain | Information Stealer Domain | Domain | Very High |
Domain associated with an information stealer. Example: itype="infostealer_domain" |
| infostealer_hash | Information Stealer File Hash | Hash | Very High |
Hash of a malicious file associated with an information stealer. Example: itype="infostealer_hash" |
| infostealer_ip | Information Stealer IP | IP | Very High |
IP address associated with an information stealer. Example: itype="infostealer_ip" |
| infostealer_url | Information Stealer URL | URL | Very High |
URL associated with an information stealer. Example: itype="infostealer_url" |
| iot_domain | Internet of Things Malicious Domain | Domain | Medium |
Domain associated with malware targeting Internet of Things devices. Example: itype="iot_domain" |
| iot_hash | Internet of Things Malicious File Hash | Hash | High |
Hash of a malicious sample targeting Internet of Things devices. Example: itype="iot_hash" |
| iot_ip | Internet of Things Malicious IP | IP | Medium |
IP address associated with malware targeting Internet of Things devices. Example: itype="iot_ip" |
| iot_url | Internet of Things Malicious URL | URL | Medium |
URL associated with malware targeting Internet of Things devices and services. Example: itype="iot_url" |
| ipcheck_url | IP Check URL | URL | Low |
URL that can be used to provide IP checking services, such as echoing the Internet facing IP address of the client. Example: itype="ipcheck_url" |
| ja3_md5 | JA3/JA3S TLS Fingerprint | Hash | Medium |
TLS Client/Server fingerprint. Example: itype="ja3_md5" |
| mal_domain | Malware Domain | Domain | Very High |
Domain contacted by malware sample; could be for command and control commands, or to check if the client is online. Example: itype="mal_domain" |
| mal_email | Malware Email | Low |
Email address used to send malware through malicious links or attachments. Example: itype="mal_email" |
|
| mal_ip | Malware IP | IP | Very High |
IP address contacted by malware sample; could be for command and control commands, or to check if the client is online. Example: itype="mal_ip" |
| mal_md5 | Malware File Hash | Hash | Very High |
MD5 or SHA hash of malware sample. Example: itype="mal_md5" |
| mal_sslcert_sha1 | SSL Certificate Hash | Hash | High |
MD5 or SHA hash of SSL certificate associated with malware or botnet activities. Example: itype="mal_sslcert_sha1" |
| mal_url | Malware URL | URL | Very High |
URL contacted by malware sample when run on an infected host. Example: itype="mal_url" |
| p2pcnc | Peer-to-Peer C&C IP Address | IP | Medium |
IP addressed associated with a peer-to-peer command and control infrastructure. Example: itype="p2pcnc" |
| parked_domain | Parked Domain | Domain | Low |
Domain name of a website which is currently parked. Example: itype="parked_domain" |
| parked_ip | Domain Parking IP | IP | Low |
IP addressed used for parking newly registered or inactive domain names. Example: itype="parked_ip" |
| parked_url | Parked URL | URL | Low |
URL of a website that is currently parked. Example: itype="parked_url" |
| pastesite_url | Paste Site URL | URL | Low |
URL that can be used for sharing pastes or text content anonymously. Example: itype="pastesite_url" |
| phish_domain | Phishing Domain | Domain | Very High |
Domain used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_domain" |
| phish_email | Phishing Email Address | Very High |
Email address associated with sending phishing or spear phishing emails to victims. Example: itype="phish_email" |
|
| phish_ip | Phishing IP Address | IP | Very High |
IP address that has been used to perform phishing or spear phishing or is contained in a phishing email. Example: itype="phish_ip" |
| phish_md5 | Phishing File Hash | Hash | Very High |
Hash related to a file used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_md5" |
| phish_url | Phishing URL | URL | Very High |
URL used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_url" |
| phish_victim_email | Phishing Victim Email | Low |
Email of a user who was a victim of a phishing attack. Example: itype="phish_victim_email" |
|
| pos_domain | Point of Sale Malicious Domain | Domain | Medium |
Domain associated with malware targeting Point of Sales systems. Example: itype="pos_domain" |
| pos_hash | Point of Sale Malicious File Hash | Hash | High |
Malicious file hash targeting Point of Sales systems. Example: itype="pos_hash" |
| pos_ip | Point of Sale Malicious IP | IP | Medium |
IP address associated with malware targeting Point of Sale systems. Example: itype="pos_ip" |
| pos_url | Point of Sale Malicious URL | URL | Medium |
URL associated with malware targeting Point of Sales systems. Example: itype="pos_url" |
| proxy_ip | Open Proxy IP | IP | Low |
IP address hosting open or anonymous proxy software. Allows user to hide their IP address from target. Example: itype="proxy_ip" |
| ransomware_domain | Ransomware Domain | Domain | Very High |
Domain associated with ransomware. Example: itype="ransomware_domain" |
| ransomware_hash | Ransomware File Hash | Hash | Very High |
File hash of a malicious ransomware sample. Example: itype="ransomware_hash" |
| ransomware_ip | Ransomware IP | IP | Very High |
IP address associated with ransomware. Example: itype="ransomware_ip" |
| ransomware_url | Ransomware URL | URL | Very High |
URL associated with ransomware. Example: itype="ransomware_url" |
| rootkit_hash | Rootkit File Hash | Hash | Very High |
File hash of rootkit malware that provides root-level access to an attacker. Example: itype="rootkit_hash" |
| scan_ip | Scanning IP | IP | Medium |
IP address observed to perform port scanning and vulnerability scanning activities. Example: itype="scan_ip" |
| sinkhole_domain | Sinkhole Domain | Domain | Low |
Domain name that researchers or security companies typically sinkhole. Example: itype="sinkhole_domain" |
| sinkhole_ip | Sinkhole IP | IP | Low |
IP address that is known to be used to sinkhole malicious domain names. Example: itype="sinkhole_ip" |
| social_media_url | Social Media URL | URL | Medium |
URL related to social media activity. This indicator type is provided by select feeds and cannot be imported through the ThreatStream user interface. Example: itype="social_media_url" |
| spam_domain | Spam Domain | Domain | Low |
Malicious domain name contained in the SPAM email messages. Example: itype="spam_domain" |
| spam_email | Spammer Email Address | Low |
Email address that has been observed sending SPAM emails. Example: itype="spam_email" |
|
| spam_ip | Spammer IP | IP | Low |
IP address that is known to send SPAM emails. Example: itype="spam_ip" |
| spam_url | Spam URL | URL | Low |
Malicious URL contained in the SPAM email messages. Example: itype="spam_url" |
| speedtest_url | Speed Test URL | URL | Low |
URL that can be used to run internet speed tests or bandwidth measurements of the client's network connection. Example: itype="speedtest_url" |
| ssh_ip | SSH Brute Force IP | IP | Low |
IP addresses associated with SSH brute force attempts. Example: itype="ssh_ip" |
| suppress | Suppress | n/a | n/a |
Not a true indicator type. Used by Arcsight for suppressing false positives. Default Severity: n/a Example: itype="suppress" |
| suspicious_domain | Suspicious Domain | Domain | Medium |
Domain name that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_domain" |
| suspicious_email | Suspicious Email | Low |
Email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_email" |
|
| suspicious_ip | Suspicious IP | IP | Medium |
IP address that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_ip" |
| suspicious_reg_email | Suspicious Registrant Email | Low |
Registrant email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_reg_email" |
|
| suspicious_url | Suspicious URL | URL | Medium |
URL that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_url" |
| tor_ip | TOR Node IP | IP | Low |
IP address operating as part of The Onion Router (TOR) Network, also know as a TOR exit node. Example: itype="tor_ip" |
| torrent_tracker_url | Torrent Tracker URL | URL | Low |
URL used for tracking bittorrent file transfer activity. Example: itype="torrent_tracker_url" |
| trojan_domain | Trojan Domain | Domain | High |
Domain associated with Trojan malware that disguises as a legitimate code or software. Example: itype="trojan_domain" |
| trojan_hash | Trojan File Hash | Hash | High |
File hash associated with Trojan malware that disguises as a legitimate code or software. Example: itype="trojan_hash" |
| trojan_ip | Trojan IP Address | IP | High |
IP address associated with Trojan malware that disguises as a legitimate code or software. Example: itype="trojan_ip" |
| trojan_url | Trojan URL | URL | High |
URL associated with a Trojan malware that disguises as a legitimate code or software. Example: itype="trojan_url" |
| vpn_domain | Anonymous VPN Domain | Domain | Low |
Domain name associated with commercial or free Virtual Private Networks (VPN). Example: itype="vpn_domain" |
| vps_ip | Cloud Server IP | IP | Low |
IP address that is used for hosting Virtual Private Servers (VPS) or other server rentals. Example: itype="vps_ip" |
| vuln_risk_score | Vulnerability Risk Score | String | Low |
Risk score for a vulnerability. Example: itype="vuln_risk_score" |
| whois_bulk_reg_email | Whois Bulk Registrant Email | Low |
Registrant email address associated with privacy domain purchased from Whois. Example: itype="whois_bulk_reg_email" |
|
| whois_privacy_domain | Whois Privacy Email Domain | Domain | Low |
Privacy domain purchased from Whois. Example: itype="whois_privacy_domain" |
| whois_privacy_email | Whois Privacy Email | Low |
Email address associated with a privacy domain purchased from Whois. Example: itype="whois_privacy_email" |