What Are Cyber Threat Indicators and Defensive Measures?

According to the Cybersecurity Information Sharing Act of 2015 (CISA), the term “cyber threat indicator” means information that is necessary to describe or identify

• (A) malicious reconnaissance, including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability;
• (B) a method of defeating a security control or exploitation of a security vulnerability;
• (C) a security vulnerability, including anomalous activity that appears to indicate the existence of a security vulnerability;
• (D) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability;
• (E) malicious cyber command and control;
• (F) the actual or potential harm caused by an incident, including a description of the information exfiltrated as a result of a particular cybersecurity threat;
• (G) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or
• (H) any combination thereof.

The term “defensive measure” means an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that detects, prevents, or mitigates a known or suspected cybersecurity threat or security vulnerability. However, the term “defensive measure” does not include a measure that destroys, renders unusable, provides unauthorized access to, or substantially harms an information system or data on an information system not belonging to—

• the private entity operating the measure; or
• another entity or federal entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure.

We encourage you to share any information that falls within the definitions above of a cyber threat indicator or defensive measure. All cyber threat indicators and defensive measures submitted through this system by a non-federal entity as defined in CISA are deemed submitted under section 104(c) and 105(c)(1)(B) of CISA. Please do not submit personal information not directly related to a cybersecurity threat using this form. For more information about sharing cyber threat indicators and defensive measures with the Federal Government under CISA, see https://www.cisa.gov/ais.

Using the Cyber Threat Indicator and Defensive Measure Submission System

Please answer the questions as completely and accurately as possible. Questions that must be answered are marked with a red asterisk. This website uses Secure Sockets Layer (SSL) / Transport Layer Security (TLS) to provide secure communications. This method of communication is much more secure than unencrypted email.

If there is malware associated with this cyber threat indicator, please share that separately via the US-CERT Malware Submission site. Fields marked (*) are required.

To submit a cyber threat indicator or defensive measure by email, please send an encrypted email to the DHS Indicator Submission Inbox (cisaservicedesk@cisa.dhs.gov). The PGP/GPG key is available at http://www.us-cert.gov/contact-us