|
|
TCP |
8099 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8099 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
GET / UA Mozilla/5.0 zgrab/0.x
Émulateur
HTTP
WAF
9
Recommandation
Surveiller
Tags
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8099
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 71%
Confiance classification
71%
Risque capteur
Moyen
· 40
Confiance : Confiance 71 % — Score WAF 44 · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 zgrab/0.x
Règles WAF
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8099
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b4be00556d7e6bfe311880770d4e1c76ac6f59e","http_host_hash":"611196ff5d5ba8288e3fb0ff9b6947637bff1fee","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":112,"payload_entropy":5.083704646093297,"port_category":"registered","org":"Microsoft Corporation","service":"http","app_proto":"http","asn":8075,"country":"US","dst_port":8099,"risk_waf":44,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":2,"risk_breakdown":{"waf":44,"classification":38,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":40,"tag_count":2,"anomaly_count":0,"campaign_key":"203cdfd3eb5edaa6c141e2f129f87597ea96e30d","event_fingerprint":"2bdb0d4c8a4869d311dfaefaa91a46379e4531fe","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"http_ua_hash":"ef60d663d36db05cc1e68077f8a0f3fa","payload_hash":"a87cd0f5e4f3799152f2ec37a15175fd","path_pattern_hash":"8a5edab282632443219e051e4ade2d1d"},"service_name":"http","target_context":{"dst_port":8099,"service":"http","service_name":"http","risk_score":40},"payload_preview":"GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8099\r\nUser-Agent: Mozilla\/5.0 zgrab\/0.x\r…
|
|
|
TCP |
6666 · IRC ALT
|
irc-alt
|
Botnet Mozi
mozi pattern · via IRC ALT:6666 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
Commande
Protocole
Émulateur
IRC-ALT
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6666
Chemin / cible
—
Service
IRC ALT
Payload
GET / HTTP/1.1 Host: 62.3.50.33:6666 User-Agent: Mozilla/5.0 zgrab/0.x Accept: */* Accept-Encoding: gzip
Pourquoi cette classification : Type « Botnet Mozi » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
Commande & contrôle
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6666
User-Agent: Mozilla/5.0 zgrab/0.x
Accept: */*
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a","emulator_response_len":50,"bytes_in":112,"payload_entropy":5.026878503445081,"port_category":"registered","org":"Microsoft Corporation","service":"irc-alt","app_proto":"irc-alt","asn":8075,"country":"US","dst_port":6666,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":20,"risk_granularity":1.2,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":36,"tag_count":3,"anomaly_count":0,"campaign_key":"4f7c3ab365e93e64642626d8022529f85e6ef8fd","event_fingerprint":"a2e3ff84a0de47045d6d72fd913f09153edfbe30","classification_reason":"Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":36},"named_classification_skipped":false,"service_name":"irc-alt","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"0b3c455f8cb688d168022623712a5337","path_pattern_hash":"762d384fab941f6d0c2239f19994f30e"},"target_context":{"dst_port…
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
Découverte
Accès
Protocole
SSH SSH-2.0-Go ��[n�k��KZX�/� � curve25519-sha256,curve255…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go ��[n�k��KZX�/� � curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp3…
Payload
SSH-2.0-Go ��[n�k��KZX�/� � curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
Upstream
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
��[n�k��KZX�/� � curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-
Requête brute (extrait)
SSH-2.0-Go ��[n�k��KZX�/� � curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a","emulator_response_len":39,"bytes_in":1196,"payload_entropy":4.85826754184968,"port_category":"well_known","org":"Microsoft Corporation","service":"ssh","app_proto":"ssh","asn":8075,"country":"US","dst_port":22,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.3,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":25},"risk_score":50,"tag_count":5,"anomaly_count":0,"campaign_key":"9a91c35ff8553fc24795f9eaf93692ffdae1839c","event_fingerprint":"bc4e3fa786c83e0db7c1c892cb0c288f6b14388f","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":137,"precision_signals":["INT-ssh-libssh-ua","pat-0391","INT-upstream"],"kb_rule_ids":["INT-ssh-libssh-ua","pat-0391","INT-upstream"],"matched_patterns":["pat-0391","pat-0536"],"matched_pattern_names":["SSH-2.0 banner RFC4253","TFTP RRQ"],"pattern_ids":["pat-0391","pat-0536"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":25,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datac…
|
|
|
TCP |
8090 · HTTP ALT 8090
|
http-alt-8090
|
Sonde HTTP 8090
http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
HTTP-ALT-8090
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8090
Chemin / cible
—
Pourquoi cette classification : Type « Sonde HTTP 8090 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Microsoft Corporation","service":"http-alt-8090","app_proto":"http-alt-8090","asn":8075,"country":"US","dst_port":8090,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"074fcf7b6621f792f12eafd4c85696050ae26041","event_fingerprint":"73de1024b23993e40693db328fc9a5b5266e5167","classification_reason":"Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0},"named_classification_skipped":false,"service_name":"http-alt-8090","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"ced820066cc8b42921bb5be056a…
|