Skip to main content

What are the credential search parameters of Threat Hunting?

Updated over a week ago

In this article, you'll find the credential search parameters, along with usage examples for each. If you have any questions, please contact our support team.

Attention: Credentials containing passwords with fewer than 4 digits are automatically disregarded and are not registered as detections on the Axur platform.


How to search for credential information?

Parameter

Description

Example

leakFormat

Format in which the leak was found

leakFormat="COMBOLIST"
leakFormat="STEALER LOG"
leakFormat="TABLE"

detectionDate

Date when the credential was detected

detectionDate=YYYY-MM-DD

detectionDate>=YYYY-MM-DDThh:mm

detectionDate<=YYYY-MM-DDThh:mm:ss

detectionDate>=YYYY-MM-DD AND detectionDate<=YYYY-MM-DD

user

User associated with the credential

emailDomain

Email domain

emailDomain=example.com

emailDomain=(example1.com OR example2.com)

emailHost

Email host

emailHost=support.example.com

emailHost=(support.example.com OR mkt.example.com OR ti.example.com)

emailTld

Top-level domain (TLD) of the email

emailTld=com

userType

Type of user

userType=EMAIL

userType=PHONE

userType=USERNAME

password

Password associated with the credential

password=123456789

passwordHasLetter

Indicates if the password contains letters

passwordHasLetter=true

passwordHasLetter=false

passwordHasLowerCase

Indicates if the password contains lowercase letters

passwordHasLowerCase=true

passwordHasLowerCase=false

passwordHasUpperCase

Indicates if the password contains uppercase letters

passwordHasUpperCase=true

passwordHasUpperCase=false

passwordHasNumber

Indicates if the password contains numbers

passwordHasNumber=true

passwordHasNumber=false

passwordHasSpecialChar

Indicates if the password contains special characters

passwordHasSpecialChar=true

passwordHasSpecialChar=false

passwordLength

Length of the password in characters

passwordLength=8

passwordLength>=12

passwordType

Type of stored password

passwordType=BCRYPT

passwordType=MD5

passwordType=MYSQL323

passwordType=PBKDF2

passwordType=PLAIN

passwordType=SHA1

passwordType=SHA256

passwordType=SHA384

passwordType=SHA512


How to search for access information?

Parameter

Description

Example

accessDomain

Domain associated with the credential

accessDomain=example.com

accessHost

Specific access host

accessHost=login.example.com

accessTld

Top-level domain (TLD) of access

accessTld=com

accessUrl

Access URL of the credential

accessUrl=example.com

accessAppId

App ID for access (Google Play IDs only)

accessAppId="br.com.example.app"


How to search for leak source information?

Parameter

Description

Example

sourceName

Name of the source where the credential was exposed

sourceName=Deep/Dark Web

sourceName=Deep/Dark Web - Telegram

sourceName=Deep/Dark Web - WhatsApp

sourceName=IntelX

sourceName=mega

sourceName=paste.ee

sourceName=pastebin

sourceUrl

URL of the source where the credential was found

sourceUrl=example.com

sourceUrl=breachforums.st

sourceUrl=leakbase.io

sourceUrl=*


How to search for file information?

Parameter

Description

Usage Examples

fileName

Name of the file

fileName="filename.txt"

filePath

Path of the file

filePath="50 000 000 Link Login Pass 10.rar"


If you have any questions, feel free to reach out at [email protected] 😊

Did this answer your question?