|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �r�\hoMήa]N�=�# �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �r�\hoMήa]N�=�# �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �r�\hoMήa]N�=�# �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�r�\hoMήa]N�=�# �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �r�\hoMήa]N�=�# �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.768336998672385,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25fa21fa8354c7cf5243d0c5c2d97a60",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "925cc91b80020f72f6602f56d7c4c16a9b3687a6",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdr\ufffd\\hoM\u03aea]N\ufffd=\ufffd#\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014r\ufffd\\hoM\u001a\u03aea]N\ufffd=\ufffd#\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdr\ufffd\\hoM\u03aea]N\ufffd=\ufffd#\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 13,
"ssh_auth_burst_rate": 1
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0
Payload
SSH-2.0-AsyncSSH_2.1.0
Pourquoi cette classification : Bannière client SSH reçue · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 24,
"payload_entropy": 3.7201755214643453,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4a45e4d33f97e8b4f72cec668436cd7874f21b44",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253"
],
"pattern_ids": [
"pat-0391"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a9a153066f82d9d0f12e1a026c6ec51",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 48
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26cd5e9d9e07e27ed4775b7d343e3aa8f288e53c",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0391",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 12,
"ssh_auth_burst_rate": 1.09
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �J� c�p|� ����2_ �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �J� c�p|� ����2_ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �J� c�p|� ����2_ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�J�
c�p|� ����2_ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �J� c�p|� ����2_ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.768571116540389,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4c75c96ef9c2067450238748a64c3fde",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfaf4a2ad8ab98d3e32b98d845342d976c75989d",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdJ\ufffd\rc\ufffdp|\ufffd\ufffd\ufffd\ufffd\ufffd2_\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014J\u0001\ufffd\rc\ufffdp|\ufffd\u000b\ufffd\ufffd\ufffd\ufffd2_\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdJ\ufffd\rc\ufffdp|\ufffd\ufffd\ufffd\ufffd\ufffd2_\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 19,
"ssh_auth_burst_rate": 1.58
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �%�s�q����ز&�l� �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �%�s�q����ز&�l� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �%�s�q����ز&�l� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�%�s�q����ز&�l� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �%�s�q����ز&�l� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 2072,
"payload_entropy": 4.776505842102022,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "64fb1540b0cb915f4e9b98b2b11520be",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a73354bde1c3a250bb38796b123035f39ba17c0f",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\u0017\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd%\ufffds\ufffdq\ufffd\ufffd\ufffd\ufffd\u0632&\ufffdl\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 19,
"ssh_auth_burst_rate": 1.58
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �=��φ^vJ(�b��A+� �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �=��φ^vJ(�b��A+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �=��φ^vJ(�b��A+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�=��φ^vJ(�b��A+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �=��φ^vJ(�b��A+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.776797783240781,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d3395e9fdb87d80928f59225b9c7d424",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "733f1f7fc9f1c37315159515e26e3703e604aaf5",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd=\ufffd\ufffd\u03c6^vJ(\ufffdb\ufffd\ufffdA+\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 18,
"ssh_auth_burst_rate": 2.25
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 � h���Q &�&t+� �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 � h���Q &�&t+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 � h���Q &�&t+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
� h���Q &�&t+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 � h���Q &�&t+� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.775295438558129,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d40a9d0ee4c954cbbcc98c8cb57936c",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39cbfc75954ab19e184c167d27105931736cda8d",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdh\ufffd\ufffd\ufffdQ&\ufffd&t+\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u001fh\ufffd\ufffd\ufffd\u000eQ\u0015\u001e&\ufffd&t+\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdh\ufffd\ufffd\ufffdQ&\ufffd&t+\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 20,
"ssh_auth_burst_rate": 1.33
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 � �4���f�hw���� �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 � �4���f�hw���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 � �4���f�hw���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
� �4���f�hw���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 � �4���f�hw���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.770703126579928,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "faa769853f9874990c563dfb7c8fba03",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e6cacbafa26ef0e3d54786c651273f12a9fb55b",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd4\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000b\ufffd\u00174\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd4\ufffd\ufffd\ufffdf\ufffdhw\ufffd\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 19,
"ssh_auth_burst_rate": 1.58
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ���ZZ���o;��� �curve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ���ZZ���o;��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2…
Payload
SSH-2.0-AsyncSSH_2.1.0 ���ZZ���o;��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
���ZZ���o;��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ���ZZ���o;��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.77795804172068,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d90584bfb7c868707f77558f33c73ae",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c035d19fce68c4dc2fb94b3c330392da0e6f565",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdZZ\ufffd\ufffd\ufffdo;\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffdZZ\ufffd\ufffd\u0006\ufffdo;\ufffd\ufffd\ufffd\u001c\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdZZ\ufffd\ufffd\ufffdo;\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 15,
"ssh_auth_burst_rate": 1.15
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0
Payload
SSH-2.0-AsyncSSH_2.1.0
Pourquoi cette classification : Bannière client SSH reçue · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 24,
"payload_entropy": 3.7201755214643453,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "afad6b519c202277d44b3624df77180bf7652e6b",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253"
],
"pattern_ids": [
"pat-0391"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a9a153066f82d9d0f12e1a026c6ec51",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 48
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48d81d8b9f65d80bc99b6c5c0a4f287de778cb48",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0391",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 19,
"ssh_auth_burst_rate": 1.46
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��ғ�*���!����D �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��ғ�*���!����D �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��ғ�*���!����D �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��ғ�*���!����D �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��ғ�*���!����D �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.782764213390163,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "746c108cb51a9917fcd47b0ee7b51596",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7589879fcd1aee1ec371d8702cee3458bd6af276",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffdD\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\u0013\ufffd\ufffd\ufffd\ufffdD\u0005\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\u0493\ufffd*\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffdD\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 14,
"ssh_auth_burst_rate": 1.17
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �w_C=�� ��x_��+ �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �w_C=�� ��x_��+ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �w_C=�� ��x_��+ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�w_C=�� ��x_��+ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �w_C=�� ��x_��+ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.778538881584098,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "82fb07f5d5c91eb37db29caa4a1030c8",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6a9781637064961cc8740da116143f1cef3ad73",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdw_C=\ufffd\ufffd\ufffd\ufffdx_\ufffd\ufffd+\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014w_C=\ufffd\ufffd\u001f\ufffd\u000e\ufffdx_\ufffd\ufffd\u0004+\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdw_C=\ufffd\ufffd\ufffd\ufffdx_\ufffd\ufffd+\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 16,
"ssh_auth_burst_rate": 1.33
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0
Payload
SSH-2.0-AsyncSSH_2.1.0
Pourquoi cette classification : Bannière client SSH reçue · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 24,
"payload_entropy": 3.7201755214643453,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4a45e4d33f97e8b4f72cec668436cd7874f21b44",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253"
],
"pattern_ids": [
"pat-0391"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a9a153066f82d9d0f12e1a026c6ec51",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 48
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26cd5e9d9e07e27ed4775b7d343e3aa8f288e53c",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 10,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0391",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 13,
"ssh_auth_burst_rate": 1.3
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��q�vf��ۻLl~�w �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��q�vf��ۻLl~�w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��q�vf��ۻLl~�w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��q�vf��ۻLl~�w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��q�vf��ۻLl~�w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.774105024204349,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b6ae6a2c97d1883f961f6643c731aa2",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7aaca9ebe3d972fc6171d0d0f379dc9c1414588",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdq\ufffdvf\ufffd\ufffd\u06fbLl~\ufffdw\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u000eq\ufffdvf\ufffd\u001a\ufffd\u06fbLl~\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdq\ufffdvf\ufffd\ufffd\u06fbLl~\ufffdw\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 8,
"ssh_auth_burst_rate": 1
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��ь� ޫ[�.|�8� �curve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��ь� ޫ[�.|�8� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��ь� ޫ[�.|�8� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��ь�
ޫ[�.|�8� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��ь� ޫ[�.|�8� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.774196216219977,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "257ad8f9f2a70c329b7dc867adfa743d",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "478b2c52e1c062dbd7f87aea8a07d09c2008002b",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\u044c\ufffd\n\u07ab[\ufffd.|\ufffd8\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u044c\ufffd\n\u07ab[\ufffd\u0014.|\ufffd8\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\u044c\ufffd\n\u07ab[\ufffd.|\ufffd8\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 6,
"ssh_auth_burst_rate": 1.2
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �h��>[�/�P*. ��v �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �h��>[�/�P*. ��v �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �h��>[�/�P*. ��v �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�h��>[�/�P*. ��v �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �h��>[�/�P*. ��v �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.773777815747971,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ad6d677c5aeef5a8047873fb78e62086",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6ae34bc8c391d238f593c2c62167720315887bf",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdh\ufffd\ufffd>[\ufffd\/\ufffdP*.\ufffd\ufffdv\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014h\ufffd\ufffd>[\ufffd\/\ufffdP*.\u001c\ufffd\ufffdv\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdh\ufffd\ufffd>[\ufffd\/\ufffdP*.\ufffd\ufffdv\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 6,
"ssh_auth_burst_rate": 0.46
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��ύs���߯$P� �curve25519-sha256,c…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��ύs���߯$P� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-ni…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��ύs���߯$P� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��ύs���߯$P� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��ύs���߯$P� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.778434980629049,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e91ec894118c511034fe963548fc7625",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd0da923a3c482d35630263372508499fb2a069b",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ue206\ufffd\u03cds\ufffd\ufffd\ufffd\u07ef$P\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��������5��+ B�� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��������5��+ B�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��������5��+ B�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��������5��+ B�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��������5��+ B�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.775658055237351,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88dd86cdd26eff8f8d3e9ae2d9ba725f",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f883ea308e610f3b8c9338c2e26099b6f51a22ef",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ B\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ \u0000B\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd+ B\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 6,
"ssh_auth_burst_rate": 0.54,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��kx/�(�� 0K���M; �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��kx/�(�� 0K���M; �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��kx/�(�� 0K���M; �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��kx/�(�� 0K���M; �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��kx/�(�� 0K���M; �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.779299183526683,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9067f675a83ea88e8f0bc30e07b7b678",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2d7c9ea84d623834cb7af9ae96b37ba825e9cc4e",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdkx\/\ufffd(\ufffd\ufffd0K\ufffd\ufffd\ufffdM;\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdkx\/\ufffd(\ufffd\ufffd\f0K\ufffd\ufffd\ufffdM;\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdkx\/\ufffd(\ufffd\ufffd0K\ufffd\ufffd\ufffdM;\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 8,
"ssh_auth_burst_rate": 0.73
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �� ic������P>a �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �� ic������P>a �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �� ic������P>a �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�� ic������P>a
�curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �� ic������P>a �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 2072,
"payload_entropy": 4.7697113713680945,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2c5e718a931d5665a21504440318e914",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eed14f266a0e40ad23c8a60278f0b15d55e7c79f",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdic\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP>a\r\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u001fic\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffdP>a\r\u000e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdic\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP>a\r\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 7,
"ssh_auth_burst_rate": 0.7
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��?�X��IT �Y �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��?�X��IT �Y �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��?�X��IT �Y �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��?�X��IT
�Y �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��?�X��IT �Y �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.782764213390163,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e08a9d168a61928cb831e48ab3fb50a5",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "374ac9b2f238b0544e0f00380ceb239744010b3c",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd?\ufffdX\u058b\ufffd\ufffdIT\n\ufffdY\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u000f\ufffd?\ufffdX\u058b\u0017\ufffd\ufffdIT\n\ufffdY\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd?\ufffdX\u058b\ufffd\ufffdIT\n\ufffdY\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 17,
"ssh_auth_burst_rate": 1.13
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ����(D�[L�< ��^p �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ����(D�[L�< ��^p �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ����(D�[L�< ��^p �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
����(D�[L�<
��^p �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ����(D�[L�< ��^p �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 2072,
"payload_entropy": 4.779271408664598,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88d9e844c98301dca28d87aca4aed781",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b0e9164ce70ea884cdb856a1154f04b533e419f",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\ufffd\u0015(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd(D\ufffd[L\ufffd<\n\ufffd\ufffd^p\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 15,
"ssh_auth_burst_rate": 1.25
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �Z/�C�C?���L= �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �Z/�C�C?���L= �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �Z/�C�C?���L= �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�Z/�C�C?���L= �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �Z/�C�C?���L= �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.77913980460429,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dbdf8629c88f6b11f56cab0c6b971fef",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d271ee92b3ee572a730f41255843f446e3dbc6aa",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdZ\/\ufffdC\ufffdC?\ufffd\ufffd\ufffdL=\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0004Z\/\ufffdC\u0006\u0007\ufffdC?\ufffd\ufffd\u0006\ufffdL=\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdZ\/\ufffdC\ufffdC?\ufffd\ufffd\ufffdL=\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 16,
"ssh_auth_burst_rate": 1.33
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��$�jA���h�k�T �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��$�jA���h�k�T �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��$�jA���h�k�T �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��$�jA���h�k�T �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��$�jA���h�k�T �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.778649907980807,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c28fe4003bb9b5707741986abfbc4846",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "814e127bc9df5279f8dd2a5e9c6c60f788f8f145",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd$\ufffdjA\ufffd\ufffd\ufffdh\ufffdk\ufffdT\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd$\ufffdjA\ufffd\ufffd\ufffd\u0019h\ufffdk\ufffd\u0005T\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd$\ufffdjA\ufffd\ufffd\ufffdh\ufffdk\ufffdT\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 15,
"ssh_auth_burst_rate": 1.36
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��*ϭ�Ԭ|T�e�1{D, �curve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��*ϭ�Ԭ|T�e�1{D, �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��*ϭ�Ԭ|T�e�1{D, �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��*ϭ�Ԭ|T�e�1{D, �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��*ϭ�Ԭ|T�e�1{D, �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.770811420792082,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5be8e11b486b5a9376993fd74f86aff1",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec6a50b4419a5df2f8a46776a3c2dc9ee89b7d92",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd*\u03ed\ufffd\u052c|T\ufffde\ufffd1{D,\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 16,
"ssh_auth_burst_rate": 1.14
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �-���E����h�?gm� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �-���E����h�?gm� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �-���E����h�?gm� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�-���E����h�?gm� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �-���E����h�?gm� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.7686961634101275,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "55d06400e2f1416d299677a65355eb95",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b16b201aae9a812bfea65ba5fde2cbf6bf038b46",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd-\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffdh\ufffd?gm\ufffd \ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 15,
"ssh_auth_burst_rate": 1.15
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �=�L��������!� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �=�L��������!� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �=�L��������!� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�=�L��������!� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �=�L��������!� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 2072,
"payload_entropy": 4.781022108914083,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "17088ddb408ec909ec4d2e1705b0544b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a385f9fac086b132493bfef41f54acbd38f79d85",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd=\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014=\ufffd\u0016L\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\u0001\ufffd!\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd=\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 13,
"ssh_auth_burst_rate": 1.08
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��LL��'`�����w �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��LL��'`�����w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��LL��'`�����w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��LL��'`�����w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��LL��'`�����w �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.779504132549349,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d6691641c22ece8bcc1ee40a68130f81",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61c2a611b8bf9fdcf37c1088af5653b83dcbc7c3",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdLL\ufffd\ufffd'`\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffdLL\u0004\ufffd\ufffd'\u0011`\ufffd\ufffd\u0003\ufffd\ufffd\ufffdw\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffdLL\ufffd\ufffd'`\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 14,
"ssh_auth_burst_rate": 1.17
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��� KH.���x�c��� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce_burst
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��� KH.���x�c��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��� KH.���x�c��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��� KH.���x�c��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��� KH.���x�c��� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.7719338589122975,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "8b55d35021455ff2f1458b0d04ed69bb38e1a8a1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "be0071d0c2655b56dfd664c15b0f5890",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2fe9374e53db8e6e00024ea49c6dcf1d8d25b6d",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdKH.\ufffd\ufffd\ufffdx\ufffdc\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\ufffd\u001dKH.\ufffd\ufffd\ufffdx\ufffd\u001bc\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdKH.\ufffd\ufffd\ufffdx\ufffdc\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce_burst",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 9,
"ssh_auth_burst_rate": 1.12,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Rafale auth
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �ZR��V�:�(���� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_bruteforce
net_ssh_probe
redis_rdb_sync
ssh_banner
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �ZR��V�:�(���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 �ZR��V�:�(���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�ZR��V�:�(���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �ZR��V�:�(���� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.783729464355414,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6a9e8c6dd866ba027a24b6eaeae78f724f91aa1",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "056797e01ce16e83109ca525920d69d7",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66b19ee2fbd080b0c6a4c33429c170b1f7f6e709",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdZR\ufffd\ufffdV\ufffd:\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ZR\ufffd\u0010\ufffdV\ufffd\u001a:\ufffd\u0017(\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdZR\ufffd\ufffdV\ufffd:\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_bruteforce",
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"ssh_auth_burst": true,
"ssh_auth_burst_count": 8,
"ssh_auth_burst_rate": 0.61,
"behavior_alert_count": 2,
"behavior_priority": 96
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��6�9�S��,w��h�� �curve25519-sha…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��6�9�S��,w��h�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sh…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��6�9�S��,w��h�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��6�9�S��,w��h�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��6�9�S��,w��h�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.766647274333973,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79152879243ee853702f977a70136516",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d58a8a97e6aa7c3dbe3584d85c07965b931198a9",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd6\ufffd9\ufffdS\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd6\ufffd9\ufffdS\u0007\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd6\ufffd9\ufffdS\ufffd\ufffd,w\ufffd\ufffdh\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ��|ᣂ���d��Վ� �curve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ��|ᣂ���d��Վ� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-…
Payload
SSH-2.0-AsyncSSH_2.1.0 ��|ᣂ���d��Վ� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
��|ᣂ���d��Վ� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ��|ᣂ���d��Վ� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 2072,
"payload_entropy": 4.779218227887742,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e511883c18a32b2cb6dbed19c6e4b2de",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f01bf4ec868d2d06c356840b5da443b68d9e6d9",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\ufffd\u054e\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\u001b\ufffd\u054e\u0019\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd|\u18c2\ufffd\ufffd\ufffdd\ufffd\ufffd\u054e\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �ti��#��ީ��B�\ �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �ti��#��ީ��B�\ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �ti��#��ީ��B�\ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�ti��#��ީ��B�\ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �ti��#��ީ��B�\ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.776311329692384,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b77c346b17fb2d1d9e29dc97e509b58",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d0dc0cf619c89c77f79ce38e147335813db0326",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\ufffdB\ufffd\\\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014ti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\u0016\ufffdB\ufffd\u000e\\\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdti\ufffd\ufffd#\ufffd\ufffd\u07a9\ufffd\ufffdB\ufffd\\\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �.7��e�[��Q�x~� �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �.7��e�[��Q�x~� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 �.7��e�[��Q�x~� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�.7��e�[��Q�x~� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �.7��e�[��Q�x~� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 2072,
"payload_entropy": 4.773707580314933,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "46d289b1f14c79bad63013ce66ccca99",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87889c18e8a089cf42f183fe236e29ae09b7948c",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd.7\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014.\u00157\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd.7\ufffd\ufffde\ufffd[\ufffd\ufffdQ\ufffdx~\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ���r� Ƙ×o�� �curve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ���r� Ƙ×o�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-…
Payload
SSH-2.0-AsyncSSH_2.1.0 ���r� Ƙ×o�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
���r�
Ƙ×o�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ���r� Ƙ×o�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.775568823263255,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f24522aa4cd5aa71bc55939ff10e892",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51503a7a75e34e5919757864361d6c610386aea8",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdr\ufffd\r\u0198\u00d7o\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\ufffd\u0018\ufffdr\ufffd\r\u0011\u0198\u00d7o\ufffd\ufffd\u001e\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffdr\ufffd\r\u0198\u00d7o\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 ����ҙH� �~ �curve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 ����ҙH� �~ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha…
Payload
SSH-2.0-AsyncSSH_2.1.0 ����ҙH� �~ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
����ҙH� �~
�curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 ����ҙH� �~ �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 2072,
"payload_entropy": 4.7804693835146,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4b5cb1313344cad56c4ad12f3515354",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c001530146d0a3f2751ebef70d8091480231596",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd\u0499H\ufffd\ufffd~\n\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014\u0006\u0011\ufffd\ufffd\ufffd\u0499\u0016H\ufffd\u001c\ufffd~\u0007\n\u0004\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffd\ufffd\ufffd\ufffd\u0499H\ufffd\ufffd~\n\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-AsyncSSH_2.1.0 �I��8ĪپZU|�� �curve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
redis_rdb_sync
ssh_banner
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-AsyncSSH_2.1.0 �I��8ĪپZU|�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2…
Payload
SSH-2.0-AsyncSSH_2.1.0 �I��8ĪپZU|�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-AsyncSSH_2.1.0
�I��8ĪپZU|�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp
Requête brute (extrait)
SSH-2.0-AsyncSSH_2.1.0 �I��8ĪپZU|�� �curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 2072,
"payload_entropy": 4.78089701757372,
"port_category": "well_known",
"org": "Viettel Group",
"service": "ssh",
"app_proto": "ssh",
"asn": 7552,
"country": "VN",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b79541c18ca7fba693622e6daf5f513567e113dd",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 7552,
"org": "Viettel Group",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cfe22d5b6784f8aae6d0a5ebb3985896",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"evidence": {
"request_sample": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-excha",
"payload_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eed5458b5444bd1d5ff988711b5be370b6bb833e",
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdI\ufffd\ufffd8\u012a\u067eZU|\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"payload_preview": "SSH-2.0-AsyncSSH_2.1.0\r\n\u0000\u0000\b\ufffd\u0006\u0014I\ufffd\ufffd8\u012a\u067eZ\u0007\u0002U|\ufffd\ufffd\f\u0000\u0000\u0001\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-AsyncSSH_2.1.0\r\n\ufffdI\ufffd\ufffd8\u012a\u067eZU|\ufffd\ufffd\ufffdcurve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"redis_rdb_sync",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
|