IndicatorType

API_KEY

An API key being used within malware

string

'JH52anj9snaQ'

BANNER

A banner reply from a server

string

'Apache/2.2.22 (Ubuntu) Server at localhost Port 80'

COOKIE_NAME

The name of an HTTP cookie used.

string

'login_name'

DEBUG_STRING

A text string found in a binary file

string

'd:\admin\projects\test\test.pdb'

DIRECTORY_QUERIED

A string of a file path queried by a process

string

'C:\Windows\tmp'

EMAIL_ADDRESS

A valid email address

string

'postmaster@facebook.com'

FILE_DELETED

File deleted by a process

string

'C:\Temp\bot.exe'

FILE_NAME

A file name on a system, can include the path

string

'C:\Temp\bot.exe'

FILE_READ

File read by a process

string

'C:\Temp\bot.exe'

GET_PARAM

An HTTP GET query parameter name

string

'search'

HASH_MD5

An MD5 hash of a file, string, etc

string

286755fad04869ca523320acce0dc6a4

HASH_TMK

A TMK hash of a video

string

Binary format documented at

HASH_SHA256

A SHA256 hash of a file, string, etc.

string

6b3a55e0261b0304143f805a24924d0c1c44524821305f31d9277843b8a10f4e

HASH_VIDEO_MD5

An MD5 Hash of a video file.

string

460ecaeb03f4870b1db43eda1c7faed7

HTTP_REQUEST

The raw DELETE, GET, HEAD or POST.

string

GET /index.html HTTP/1.1

IP_SUBNET

A CIDR Mask, version agnostic.

string

128.0.0.0/24 or fe80::202:c9ff:fe54:5952/64

LATITUDE

The latitude for a location, as degrees dotted decimal.

float

37.484924

LOCATION

The name of a physical location. Note that there is a separate field COUNTRY.

string

Menlo Park, CA

MALWARE_NAME

The common name for a piece of malware.

string

Zeus

MEMORY_PROTECT

The process file name that had memory permissions altered.

string

C:\Temp\bot.exe

MUTANT_CREATED

Mutex created by a process.

string

bot-installed

NAME_SERVER

The host name that belongs to a name server.

string

ns1.facebook.com

PASSWORD

A password value, must be provided as an MD5 hash.

string

PAYLOAD_DATA

A piece of malicious content (e.g. an image or a document), Base64 encoded.

string

POST_DATA

Data sent in a POST request.

string

bot_id=1234&field2=Microsoft%20Windows

REFERER

The URI appearing in an HTTP referrer header.

string

http://www.facebook.com/

REGISTRY_KEY

The name of a registry key in Microsoft Windows.

string

HKEY_USERS\Software\Microsoft\Visual Basic

REG_KEY_DELETED

Registry key deleted.

string

HKEY_USERS\Software\Microsoft\Visual Basic

REG_KEY_MONITORED

Registry key monitored.

string

HKEY_USERS\Software\Microsoft\Visual Basic

REG_KEY_VALUE_CREATED

Registry key value created.

string

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

REG_KEY_VALUE_MODIFIED

Registry key value modified.

string

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SIGNATURE

The signature string for detecting a threat.

string

TELEPHONE

The full, international version of a telephone number

string

+12225551212

TREND_QUERY

Rules to match text. JSON serialized string. Once deserialized,

• "and" is a list of conditions, ALL of which should match
• each AND condition is a JSON object with a single "or" key.
• The value of the "or" key is a list of keywords or Regular expressions, ANY of these causes a match.
• Regular expressions begin with "regex-", all other terms are keywords.
• "not"is a list of keywords, ANY of which should prevent a match.

Example: The sample to the right would match content that either contains the substring foo or matches the regular expression .*bar.*, and also contains the substring zed but does not contain either the substring baz or ler

JSON-Serialized string

{
    "and": [
        {"or": ["foo", "regex-/.*bar.*/"]},
        {"or": ["zed"]},
    ],
    "not": [
        "baz",
        "ler",
    ]
}

USER_AGENT

A browser`s user agent string.

string

Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0

WEBSTORAGE_KEY

The name of a key used in HTML5 local or session storage.

string

malware_session_data

WHOIS_NAME

The name in whois information.

string

Domain Administrator

WHOIS_ADDR2

The second address line in whois information.

string

Menlo Park, CA 94025