Méthode
—
Port
2525
Chemin / cible
—
Confiance classification
71%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.9.6
Meta JSON brut
{
"bytes_in": 22,
"payload_entropy": 3.879664004902593,
"port_category": "registered",
"org": "GoDaddy.com, LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 26496,
"country": "SG",
"risk_waf": 0,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_breakdown": {
"waf": 0,
"classification": 30,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 8,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c39e8ccf813c56df4d79c64bebc0b1bc7a1d0d45",
"event_fingerprint": "fbcd176559a24e0470ce268b04406fa70b0b470d",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 26496,
"org": "GoDaddy.com, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6c435cd5755c7361597477daa7a2618",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 2525,
"service": "ssh"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "SSH-2.0-libssh_0.9.6\r\n",
"event_signature": "cbaaa78d93645b854e93ac43c1ef29e6706a30ba",
"ban_policy": "advisory_monitor",
"tags_list": [
"ssh_banner",
"ssh_libssh"
]
}
|