|
|
TCP |
10443 · HTTPS
|
https
|
Sonde Minecraft
minecraft probe · via HTTPS:10443 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10443
Chemin / cible
—
Service
HTTPS
Payload
��D5 �BH�FRfd̬KQE��V'FPŻW�j^�E �qv����C !���l����ߍj�x�B P* $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « Sonde Minecraft » (signaux protocolaires) · confiance 42%
Confiance classification
42%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 42 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��D5 �BH�FRfd̬KQE��V'FPŻW�j^�E �qv����C !���l����ߍj�x�B P* $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
��D5 �BH�FRfd̬KQE��V'FPŻW�j^�E �qv����C !���l����ߍj�x�B P* $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ %8`j�j mp�?����
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":517,"payload_entropy":3.82990132683012,"port_category":"registered","org":"BL Networks","service":"https","app_proto":"https","asn":399629,"country":"NL","dst_port":10443,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":33,"novelty":0},"risk_score":45,"tag_count":3,"anomaly_count":0,"campaign_key":"bf82ed4958219b6801f74213ab3f101ded76679b","event_fingerprint":"0ce879e35222bcf244eb8071cb051f2e9c4aa580","classification_reason":"Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%","confidence":0.42,"classification_confidence":0.42,"precision_score":50,"precision_signals":["pat-0554"],"kb_rule_ids":["pat-0554"],"matched_patterns":["pat-0554","pat-0578","pat-0536"],"matched_pattern_names":["Minecraft varint handshake","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0554","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":33,"novelty":0,"risk_score":45},"named_classification_skipped":false,"service_name":"https","risk_confidence_factor":42,"city":null,"is_datacenter":false,"is_t…
|
|
|
TCP |
541 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:541 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 4b510481e2e54d59
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
541
Chemin / cible
—
Service
TLS
Payload
����>Jq���w��{��У�3Q�sb�3/� }�b$��*ݨ���S�8�{ �^��tY��ۦ� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
����>Jq���w��{��У�3Q�sb�3/� }�b$��*ݨ���S�8�{ �^��tY��ۦ� $�,�0�+�/̨̩�$�(�#�' � � k g � �
Requête brute (extrait)
����>Jq���w��{��У�3Q�sb�3/� }�b$��*ݨ���S�8�{ �^��tY��ۦ� $�,�0�+�/̨̩�$�(�#�' � � k g � � http/1.1 1 * ( + - 3 & $ X]P�� <v/l� Z>�
Meta JSON brut
{"tls_ja3_hash":"4b510481e2e54d5956f56d2177fb122d","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":2,"tls_alpn":["http\/1.1"],"bytes_in":517,"payload_entropy":3.8159714645566267,"port_category":"well_known","org":"BL Networks","service":"tls","app_proto":"tls","asn":399629,"country":"NL","dst_port":541,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":0,"risk_boost":6,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0},"risk_score":35,"tag_count":3,"anomaly_count":0,"campaign_key":"150bf166282327f621d57f915351379f5b31ba7f","event_fingerprint":"e36b1c27318ea28716e54a964ab1c3061c69c76d","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0,"risk_score":35},"service_name":"tls","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":399629,"org":"BL Networks","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"4b510481e2e54d5956f56d2177fb122d","payload_hash":"071aed457fa755f66e3ad96536e010fc","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c"},"target_context":{"dst_port":541,"service":"tls","service_name":"tls","risk_score":35},"payload_snippet":"\u0016\u0…
|