File Indicators Feed — Spectra Intelligence

The Malicious File Indicator feeds provide continuous streams of newly detected malware samples, AV scan results, and classification changes from the Spectra Intelligence system.

Common Use Cases

Get newly detected malware

• Malware detection feed (TCF-0101) - Continuous list of samples with at least one AV detection.
• Platform-filtered malware detection feeds (TCF-0102-0106) - Malware detections filtered by platform: Android (TCF-0102), macOS (TCF-0103), Linux (TCF-0104), documents (TCF-0105), or any of 18 supported platforms including Windows (TCF-0106).

Track all scanned files

• New files (first scan) (TCF-0107) - Files scanned for the first time in the system.
• New files (first and rescan) (TCF-0108) - All files scanned or rescanned.

Monitor classification changes

• Files with detection changes (TCF-0109) - Files showing detection changes between AV scans.
• Malware presence change events feed (TCF-0111) - New malicious samples, false positives, and threat name changes.

Overlap Between Feeds

Several of these feeds return the same records. Knowing where they overlap helps you avoid ingesting the same data twice.

• Use the Malicious Files Feed (TCF-0101) for detections across all platforms, and the Platform-Filtered Malware Feeds (TCF-0102-0106) when you only need detections for specific platforms.
• TCF-0101 lists samples with at least one antivirus detection, which isn't the same as a ReversingLabs malicious verdict. For samples that ReversingLabs classifies as malicious, use the NEW_MALICIOUS events in the Malware Presence Change Events Feed (TCF-0111).
• The New Files Feed (First and Rescan) (TCF-0108) contains every record from the New Files Feed (First Scan) (TCF-0107), because it includes first scans as well as rescans.
• The Daily File Indicators Feed (TCF-0109) also includes first scans, so it overlaps TCF-0107 and TCF-0108 for those records. For samples with detection changes, it lists which scanners changed (changed_result_scanners), not each scanner's result.
• TCF-0107, TCF-0108, and TCF-0109 carry hashes and file type only, with no classification. TCF-0111 carries the ReversingLabs classification and threat name.

Feeds for Broad File Coverage

To track malicious, suspicious, and benign files, along with changes in antivirus detections and ReversingLabs classifications, combine the following feeds:

• TCF-0108 for all scanned files, first scans and rescans
• TCF-0109 for antivirus detection changes
• TCF-0111 for ReversingLabs classification changes
• TCF-0501 for trusted benign files
• TCF-0502 for files that changed from benign to malicious or suspicious

Other feeds fit narrower use cases:

• TCF-0107 if you only need files scanned for the first time
• TCF-0101 if you want samples with antivirus detections without looking up every hash
• TCF-0102 through TCF-0106 if you only need detections for specific platforms

TCF-0108 is the largest of these feeds and carries no classification. To classify its records, you need a file reputation lookup (TCA-0101) for each hash.

All Malicious File Indicator Feeds

📄️TCF-0101 — Malware Detection Feed

Consume TCF-0101 to receive a continuous stream of new samples with at least one AV scanner detection, including file hashes, file type, and targeted platform.

📄️TCF-0102-0106 — Platform-Filtered Malware

Spectra Intelligence feeds TCF-0102 to TCF-0106 deliver new malware detections by platform: Android, macOS, Linux, documents, and 14 more platform values.

📄️TCF-0107 — New Files (First Scan)

Consume TCF-0107 to receive a continuous stream of file hashes scanned for the first time in Spectra Intelligence; records are retained for 365 days.

📄️TCF-0108 — New Files (First and Rescan)

Consume TCF-0108 to receive a continuous list of Spectra Intelligence samples that have been scanned for the first time or rescanned; records retained for 365 days.

📄️TCF-0109 — Files with Detection Changes

Consume TCF-0109 to receive a continuous list of Spectra Intelligence samples showing detection changes between multi-AV scan reports; records retained for 365 days.

📄️TCF-0111 — Malware Presence Change Events

Consume TCF-0111 for new malicious samples, false positive reclassifications, and threat name changes from the malware presence change events feed.