Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires)
Confiance classification
21%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "HostPapa",
"service": "socks",
"app_proto": "socks",
"asn": 36352,
"country": "US",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 9,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "d5fa5378f6d7bccc687c3cd1b0ebbae3bbdc37b7",
"event_fingerprint": "227802c9e8b004ddc46a9a61775741be25ea4d7f",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires)",
"confidence": 0.21,
"classification_confidence": 0.21,
"precision_score": 25,
"precision_signals": [
"Classification amont"
],
"risk_confidence_factor": 21,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 36352,
"org": "HostPapa",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1080,
"service": "socks"
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires)"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c776470c9813e84d2c0df73f7cc2aded2d85c50",
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
|