|
|
TCP |
1433
|
mssql
|
mssql attack
|
Élevée
|
Faible · 17
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Confiance classification
65%
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
� � q �% � ��� V t x x
� � � � )�^� � W I N - I M S 3 0 T U K 4 7 0 s a
Meta JSON brut
{
"bytes_in": 204,
"payload_entropy": 3.663974332174781,
"port_category": "registered",
"org": "IDC, China Telecommunications Corporation",
"service": "mssql",
"app_proto": "mssql",
"asn": 23724,
"country": "CN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 55,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 17,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "08ce6d36cde748a2bacce17179d1ae7b9608bf34",
"event_fingerprint": "742842b8f210737d76b726b0f091d06c1f6686da",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 23724,
"org": "IDC, China Telecommunications Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "94882d2dd698234a8bca8dc149f46787",
"path_pattern_hash": "05beb1c8908102eab4c1215a377d31b7"
},
"target_context": {
"dst_port": 1433,
"service": "mssql"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.65,
"classification_confidence": 0.65,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0010\u0001\u0000\ufffd\u0000\u0000\u0001\u0000\ufffd\u0000\u0000\u0000\u0001\u0000\u0000q\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0007\ufffd%\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u0003\u0000\b \ufffd\ufffd\ufffd\u0004\b\u0000\u0000V\u0000\u000f\u0000t\u0000\u0002\u0000x\u0000\u0000\u0000x\u0000\r\u0000\ufffd\u0000\u000f\u0000\u0000\u0000\u0000\u0000\ufffd\u0000\u0004\u0000\ufffd\u0000\u0000\u0000\ufffd\u0000\u0006\u0000\u0000\f)\ufffd^\ufffd\u0000\u0000\u0000\u0000\ufffd\u0000\u0000\u0000W\u0000I\u0000N\u0000-\u0000I\u0000M\u0000S\u00003\u00000\u0000T\u0000U\u0000K\u00004\u00007\u00000\u0000s\u0000a\u0000",
"event_signature": "124cd8d0018f492ca8fa931d5a71350bb2747a45",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
1433
|
mssql
|
mssql attack
|
Élevée
|
Faible · 17
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1433
Chemin / cible
—
Confiance classification
65%
Tactiques MITRE
TA0001
TA0002
User-Agent
—
Règles WAF
—
Payload (extrait)
) � U �2
Meta JSON brut
{
"bytes_in": 41,
"payload_entropy": 2.824666483818309,
"port_category": "registered",
"org": "IDC, China Telecommunications Corporation",
"service": "mssql",
"app_proto": "mssql",
"asn": 23724,
"country": "CN",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 55,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 55,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 17,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "08ce6d36cde748a2bacce17179d1ae7b9608bf34",
"event_fingerprint": "742842b8f210737d76b726b0f091d06c1f6686da",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 23724,
"org": "IDC, China Telecommunications Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ff244534712b5d5a7fed941e5e8b690c",
"path_pattern_hash": "05beb1c8908102eab4c1215a377d31b7"
},
"target_context": {
"dst_port": 1433,
"service": "mssql"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.65,
"classification_confidence": 0.65,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "\u0012\u0001\u0000)\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\u0001\u0003\u0000\u001d\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000\u0000\ufffd2\u0000\u0000",
"event_signature": "4a1161a655efbb5191f230ce9fdf25083a420bbe",
"ban_policy": "advisory_monitor"
}
|