|
|
TCP |
3306 · MYSQL
|
mysql
|
Sonde MySQL
mysql probe · via MYSQL:3306 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
MYSQL
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
mysql_emulated
mysql_handshake
net_mysql_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3306
Chemin / cible
—
Service
MYSQL
Payload
7 ך�� � admin.$cmd hello
Pourquoi cette classification : Poignée de main MySQL · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Db Mysql Auth
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
7 ך�� � admin.$cmd hello
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400",
"emulator_response_len": 60,
"bytes_in": 55,
"payload_entropy": 3.0380606433664847,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "mysql",
"app_proto": "mysql",
"asn": 211298,
"country": "GB",
"dst_port": 3306,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 48,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "77b329c1aac0f444c630cdd8a795579db51a6194",
"event_fingerprint": "7e64d2ea7efbfd080eb620b69c685e7503a67a61",
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"kb_rule_ids": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"matched_patterns": [
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "mysql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "de5bc6bd810c0a643b1c55cd7fc091a1",
"path_pattern_hash": "f92b97805e8111d6d69ad0f096b65c87"
},
"target_context": {
"dst_port": 3306,
"service": "mysql",
"service_name": "mysql",
"risk_score": 48
},
"payload_preview": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"request_sample": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "430312b7c1d22c8edaadb8c02ce1f3ad42743c71",
"protocol_details": {
"mysql_auth_fr": "Handshake MySQL (auth)",
"payload_preview": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 3306,
"service": "mysql",
"service_label_fr": "MYSQL"
},
"evidence_snippet": "7\u05da\ufffd\ufffd\ufffdadmin.$cmdhello",
"attack_vector": "mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)",
"target_port_label": "3306 \u00b7 MYSQL",
"emulator_service": "mysql",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"classification_reason_label_fr": "Poign\u00e9e de main MySQL \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "mysql",
"service_label_fr": "MYSQL",
"dst_port": 3306,
"protocol_emulated": true,
"tags_summary": [
"INT-DB-mysql-auth",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Db Mysql Auth",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "8.0.32-MySQL",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mysql_auth_fr": "Handshake MySQL (auth)",
"payload_preview": "7\u0000\u0000\u0000\u05da\ufffd\ufffd\u0000\u0000\u0000\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0000",
"port": 3306,
"service": "mysql",
"service_label_fr": "MYSQL"
},
"attack_vector": "mysql probe \u00b7 via MYSQL:3306 \u00b7 (sonde \/ probe)",
"evidence_snippet": "7\u05da\ufffd\ufffd\ufffdadmin.$cmdhello",
"target_port_label": "3306 \u00b7 MYSQL",
"emulator_service": "mysql",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mysql",
"service_banner": "8.0.32-MySQL",
"service_os": "linux",
"dst_port": "3306"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"mysql_emulated",
"mysql_handshake",
"net_mysql_probe"
]
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PostgreSQL startup
ET H.323 setup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�b�v��s������oف�����u� G�I��P � &��J�)�Lfa��U]fF`�-�ʟ�*,I� <�+�/�,�0̨̩� ��
� � � / 5��
�$�(�#�' < =��
Requête brute (extrait)
�b�v��s������oف�����u� G�I��P � &��J�)�Lfa��U]fF`�-�ʟ�*,I� <�+�/�,�0̨̩� �� � � � / 5�� �$�(�#�' < =�� � � + 3 & $ ���c20|;� �r�� �
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 271,
"payload_entropy": 5.740228424355123,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "rdp",
"app_proto": "rdp",
"asn": 211298,
"country": "GB",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5cb9b53baf1209ea6c81c49a02d920dd293de6a4",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0348",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0348",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"PostgreSQL startup",
"ET H.323 setup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0369",
"pat-0868",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dc8d273ae3be6b87f3c2aff000be3dc4",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 48
},
"payload_preview": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffdb\u0013\ufffdv\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0641\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\tG\ufffdI\ufffd\u0002\ufffdP \ufffd\t&\ufffd\b\ufffdJ\ufffd)\u0019\ufffdLfa\ufffd\ufffdU]fF`\ufffd-\ufffd\u029f\ufffd*,I\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"request_sample": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffdb\u0013\ufffdv\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0641\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\tG\ufffdI\ufffd\u0002\ufffdP \ufffd\t&\ufffd\b\ufffdJ\ufffd)\u0019\ufffdLfa\ufffd\ufffdU]fF`\ufffd-\ufffd\u029f\ufffd*,I\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdc20|;\ufffd\u0000\ufffdr\ufffd\ufffd \ufffd\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffdb\u0013\ufffdv\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0641\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\tG\ufffdI\ufffd\u0002\ufffdP \ufffd\t&\ufffd\b\ufffdJ\ufffd)\u0019\ufffdLfa\ufffd\ufffdU]fF`\ufffd-\ufffd\u029f\ufffd*,I\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffdb\u0013\ufffdv\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0641\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\tG\ufffdI\ufffd\u0002\ufffdP \ufffd\t&\ufffd\b\ufffdJ\ufffd)\u0019\ufffdLfa\ufffd\ufffdU]fF`\ufffd-\ufffd\u029f\ufffd*,I\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011\u0000\u0005\u0000\u0004\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u000b\n\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0003\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdc20|;\ufffd\u0000\ufffdr\ufffd\ufffd \ufffd\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0001\n\u0001\u0000\u0001\u0006\u0003\u0003\ufffdb\u0013\ufffdv\ufffd\ufffds\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\u0641\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\tG\ufffdI\ufffd\u0002\ufffdP \ufffd\t&\ufffd\b\ufffdJ\ufffd)\u0019\ufffdLfa\ufffd\ufffdU]fF`\ufffd-\ufffd\u029f\ufffd*,I\ufffd\u0000<\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\b\ufffd\u0012\u0000\n\ufffd$\ufffd(\ufffd#\ufffd'\u0000<\u0000=\ufffd\u0007\ufffd\u0011",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d212420b2be63b02e94c421b357526d052c1f71e",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated",
"tls_clienthello"
]
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Investiguer
Tags
net_rdp_cookie
rdp_cookie
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
,'� Cookie: mstshash=eltons
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 44,
"payload_entropy": 4.01001258430054,
"port_category": "registered",
"org": "Driftnet Ltd",
"service": "rdp",
"app_proto": "rdp",
"asn": 211298,
"country": "GB",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40bf2c34d73676fee23426938806aaa527b96fcb",
"event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 211298,
"org": "Driftnet Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "04bb535988b111c42fa8d956c9af3ed3",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=eltons\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6fe4bc36e9f23e2e3342853af0e58d1e92e4e31e",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_rdp_cookie",
"rdp_cookie",
"rdp_emulated"
]
}
|
|
|
TCP |
22
|
ssh
|
ssh attack
|
Élevée
|
Élevé · 72
|
|
Étape
—
WAF
—
Recommandation
—
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|