|
|
TCP |
2086 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:2086 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
Découverte
Accès
Protocole
JA3 7587a1ac9a4f17b4
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2086
Chemin / cible
—
Service
TLS
Payload
M�L�=}" )�?9�7��@�H���-�3�Э � ��rgЩ����[�2o��<(�� e L� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
M�L�=}" )�?9�7��@�H���-�3�Э � ��rgЩ����[�2o��<(�� e L� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
M�L�=}" )�?9�7��@�H���-�3�Э � ��rgЩ����[�2o��<(�� e L� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / �� � h2http/1.1 1 6 4
Meta JSON brut
{"tls_ja3_hash":"7587a1ac9a4f17b4e4e5fe226716f4df","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":8,"tls_alpn":["h2","http\/1.1"],"bytes_in":1551,"payload_entropy":7.706468859236395,"port_category":"registered","org":"Hybula B.V.","service":"tls","app_proto":"tls","asn":57706,"country":"NL","dst_port":2086,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":2.5,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":35,"tag_count":3,"anomaly_count":0,"campaign_key":"d56f9be6fee8395bc77695e4b529822e28e9256d","event_fingerprint":"c6659bc367daa2d09a63a989feb87795459f4d63","classification_confidence":0.58,"confidence":0.58,"precision_signals":["pat-0771"],"classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":35,"correlation_boost":8},"service_name":"tls","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":57706,"org":"Hybula B.V.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","payload_hash":"261ec43ccdd9ba86a559af6e78bc8eff","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c"},"target_context":{"dst_port":2086,"service":"tls","service_name":"tls","risk_score":…
|
|
|
TCP |
2087 · CPANEL WHM
|
cpanel-whm
|
Sonde cPanel
cpanel probe · via CPANEL WHM:2087 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
CPANEL-WHM
WAF
—
Recommandation
Surveiller
Tags
cpanel_whm_emulated
cpanel_whm_payload
net_cpanel_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2087
Chemin / cible
—
Service
CPANEL WHM
Payload
�Y^X z[���I ��ĹؙY{Wv��v6{��\ � ����e,�� ~8��k� �%w*&��a #=l <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde cPanel » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
�Y^X z[���I ��ĹؙY{Wv��v6{��\ � ����e,�� ~8��k� �%w*&��a #=l <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�Y^X z[���I ��ĹؙY{Wv��v6{��\ � ����e,�� ~8��k� �%w*&��a #=l <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / �� � h2http/1.1 1 6 4
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e","emulator_response_len":125,"bytes_in":1551,"payload_entropy":7.713281403741051,"port_category":"registered","org":"Hybula B.V.","service":"cpanel-whm","app_proto":"cpanel-whm","asn":57706,"country":"NL","dst_port":2087,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":45,"tag_count":4,"anomaly_count":0,"campaign_key":"51584d32aeb6bcba72953119cc78a0e0836a8f64","event_fingerprint":"bd94c1be47794e5b05816ea1bc287e14296ba082","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0771"],"classification_reason":"Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":45},"service_name":"cpanel-whm","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":57706,"org":"Hybula B.V.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"7ae875515ce29f5a197e963ffe0f2c26","…
|
|
|
TCP |
2375 · DOCKER
|
docker
|
Sonde API Docker
docker api probe · via DOCKER:2375 · (sonde / probe)
|
Élevée
|
Faible · 23
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
DOCKER
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_emulated
docker_payload
http_get_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2375
Chemin / cible
—
Service
DOCKER
Payload
GET /info HTTP/1.1 Host: 62.3.50.33:2375 User-Agent: curl/8.14.1 Accept: */*
Pourquoi cette classification : Type « Sonde API Docker » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 23
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /info HTTP/1.1
Host: 62.3.50.33:2375
User-Agent: curl/8.14.1
Accept: */*
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234","emulator_response_len":162,"bytes_in":83,"payload_entropy":4.936988269463899,"port_category":"registered","org":"Hybula B.V.","service":"docker","app_proto":"docker","asn":57706,"country":"NL","dst_port":2375,"risk_waf":8,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":23,"tag_count":5,"anomaly_count":0,"campaign_key":"8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3","event_fingerprint":"00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e","classification_reason":"Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":23},"named_classification_skipped":false,"service_name":"docker","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"NL","asn":57706,"org":"Hybula B.V.","is_datacenter":false,"is_tor_hint":false},"fingerpri…
|