GitHub
Home / Documentation / Infrastructure Category - Event Types

Complete reference for compromised infrastructure types including botnets and compromised servers

Infrastructure Category

Compromised systems and malicious infrastructure including botnets, command & control servers, and compromised hosts being used for malicious activities.

Field Legend

  • 🟠 Mandatory - MUST be present in all valid reports
  • 🟢 Recommended - SHOULD be included when information is available
  • 🔵 Optional - MAY be included for additional context

botnet

Use Case: Reports of systems participating in botnets (e.g., Mirai, Emotet, Conficker). Used by ISPs, security researchers, and botnet tracking organizations to identify infected devices and coordinate cleanup efforts.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T14:00:00Z",
  🟠 "reporter": {
    "org": "Botnet Tracking Service",
    "contact": "[email protected]",
    "domain": "security.example"
  },
  🟠 "sender": {
    "org": "Botnet Tracking Service",
    "contact": "[email protected]",
    "domain": "security.example"
  },
  🟠 "source_identifier": "192.0.2.88",
  🟠 "category": "infrastructure",
  🟠 "type": "botnet",

  🟢 "source_port": 35412,
  🟢 "evidence_source": "honeypot",
  🟢 "evidence": [
    {
      "content_type": "application/json",
      "description": "Botnet command traffic capture",
      "payload": "eyJjMl9zZXJ2ZXIiOiIxOTIuMC4yLjEwMCIsInBvcnQiOjg4ODh9"
    }
  ],
  🔵 "confidence": 0.96,

  🔵 "tags": ["botnet:mirai", "device:iot"],
  🔵 "description": "IoT device infected with Mirai botnet variant"
}

Schema

compromised_server

Use Case: Reports of compromised servers being used for malicious purposes including command & control, malware hosting, phishing, or spam relay. Used by hosting providers and system administrators to identify and remediate compromised infrastructure.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T16:30:00Z",
  🟠 "reporter": {
    "org": "Threat Intelligence Platform",
    "contact": "[email protected]",
    "domain": "threat.example"
  },
  🟠 "sender": {
    "org": "Threat Intelligence Platform",
    "contact": "[email protected]",
    "domain": "threat.example"
  },
  🟠 "source_identifier": "198.51.100.150",
  🟠 "category": "infrastructure",
  🟠 "type": "compromised_server",

  🟢 "source_port": 443,
  🟢 "evidence_source": "threat_intelligence",
  🟢 "evidence": [
    {
      "content_type": "text/plain",
      "description": "C2 server communication logs",
      "payload": "QzIgc2VydmVyIGNvbW11bmljYXRpb24gZGV0ZWN0ZWQ="
    }
  ],
  🔵 "confidence": 0.93,

  🔵 "tags": ["compromise:c2_server", "malware:emotet"],
  🔵 "description": "Compromised web server acting as Emotet C2"
}

Schema