|
|
TCP |
5986 · WINRM
|
winrm
|
Sonde PostgreSQL
postgres probe · via WINRM:5986 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 795bc7ce13f60d61
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
tls_clienthello
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5986
Chemin / cible
—
Service
WINRM
Payload
� �̸��]� 3� ���Y��k�0���;Fxl h���/�+�0�,���'�#�� �(�$�� � � � g k 3 9 � � < = / 5�
Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �̸��]� 3� ���Y��k�0���;Fxl h���/�+�0�,���'�#�� �(�$��
� � � g k 3 9 � � < = / 5�
Requête brute (extrait)
� �̸��]� 3� ���Y��k�0���;Fxl h���/�+�0�,���'�#�� �(�$�� � � � g k 3 9 � � < = / 5� 2� 8 @ f j � � 5 �
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"15030300020228","emulator_response_len":7,"bytes_in":207,"payload_entropy":4.906710824452266,"port_category":"registered","org":"Google LLC","service":"winrm","app_proto":"winrm","asn":396982,"country":"US","dst_port":5986,"risk_waf":8,"risk_classification":36,"risk_behavior":0,"risk_geo":40,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":36,"behavior":0,"geo":40,"protocol":36,"novelty":15},"risk_score":40,"tag_count":4,"anomaly_count":0,"campaign_key":"b3e6906c1792c2768b074023d1d184a2dfc6e7ff","event_fingerprint":"de62a3d1efb52e02f0717b258a9e7d3a40cdb938","classification_reason":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0369"],"kb_rule_ids":["pat-0369"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":36,"behavior":0,"geo":40,"protocol":36,"novelty":15,"risk_score":40},"named_classification_skipped":false,"service_name":"winrm","risk_confidence_factor":49,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"count…
|
|
|
TCP |
5986 · WINRM
|
winrm
|
Sonde PostgreSQL
postgres probe · via WINRM:5986 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 19e29534fd49dd27
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
tls_clienthello
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5986
Chemin / cible
—
Service
WINRM
Payload
� ��p����DA�y�f[z#D)�������Q�>�r E;�E��{B�}1�����S�mw������Ԯ; &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��p����DA�y�f[z#D)�������Q�>�r E;�E��{B�}1�����S�mw������Ԯ; &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ��p����DA�y�f[z#D)�������Q�>�r E;�E��{B�}1�����S�mw������Ԯ; &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �m��C�l �ً/E�h��T\��g�>Y&c *
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"15030300020228","emulator_response_len":7,"bytes_in":243,"payload_entropy":5.863048967049488,"port_category":"registered","org":"Google LLC","service":"winrm","app_proto":"winrm","asn":396982,"country":"US","dst_port":5986,"risk_waf":8,"risk_classification":36,"risk_behavior":0,"risk_geo":40,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":36,"behavior":0,"geo":40,"protocol":36,"novelty":15},"risk_score":40,"tag_count":4,"anomaly_count":0,"campaign_key":"b3e6906c1792c2768b074023d1d184a2dfc6e7ff","event_fingerprint":"de62a3d1efb52e02f0717b258a9e7d3a40cdb938","classification_reason":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0369"],"kb_rule_ids":["pat-0369"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":36,"behavior":0,"geo":40,"protocol":36,"novelty":15,"risk_score":40},"named_classification_skipped":false,"service_name":"winrm","risk_confidence_factor":49,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"count…
|