Méthode
—
Port
3389
Chemin / cible
—
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
0+� Cookie: mstshash=62.3.50.33
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000130ed000001234000200080000000000",
"emulator_response_len": 19,
"bytes_in": 48,
"payload_entropy": 4.266541406655651,
"port_category": "registered",
"org": "CTG Server Limited",
"service": "rdp",
"app_proto": "rdp",
"asn": 152194,
"country": "SG",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 30,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40bf2c34d73676fee23426938806aaa527b96fcb",
"event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0554"
],
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 152194,
"org": "CTG Server Limited",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "71bd0ef0842290fe9953cf87b8905003",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp"
},
"payload_preview": "\u0003\u0000\u00000+\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=62.3.50.33\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u00000+\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=62.3.50.33\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u00000+\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=62.3.50.33\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u00000+\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=62.3.50.33\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u00000+\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=62.3.50.33\r\n\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "411cb5205578ad74190f9dab9769769dfbcfde83",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_cookie",
"rdp_cookie",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|