|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Investiguer
Tags
net_rdp_cookie
rdp_cookie
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
*%� Cookie: mstshash=nmap �ۍ�=�}��f��oa���v/$M��K�τ� � ��2�9W-S>4�}D��C\/�b���sȹfE2Q � 3
Pourquoi cette classification : Négociation protocole RDP · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
UA nmap
Sigma nmap UA
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=nmap
�ۍ�=�}��f��oa���v/$M��K�τ� � ��2�9W-S>4�}D��C\/�b���sȹfE2Q � 3
Requête brute (extrait)
*%� Cookie: mstshash=nmap �ۍ�=�}��f��oa���v/$M��K�τ� � ��2�9W-S>4�}D��C\/�b���sȹfE2Q � 3 9 5 /�,�0 � �̨̩̪���������]�a�W�S�+�/ � ����������\�`�V�R�$�( k j�s�w � ��#�' g @�r�v � �� � 8 � �� � 2 � � E D ������Q ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000130ed00000123400021f080000000000",
"emulator_response_len": 19,
"bytes_in": 559,
"payload_entropy": 4.998128416929468,
"port_category": "registered",
"org": "Google LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 396982,
"country": "BE",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40bf2c34d73676fee23426938806aaa527b96fcb",
"event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0448",
"pat-0543",
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"UA nmap",
"Sigma nmap UA",
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0448",
"pat-0543",
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0faeed44e4ddab9324e3cc39555a051b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 50
},
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u06cd\ufffd=\ufffd}\ufffd\u0005\ufffdf\ufffd\ufffdo\u000ea\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\u0014\u0000\ufffd \ufffd\ufffd2\u0015\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE\u00072Q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u06cd\ufffd=\ufffd}\ufffd\u0005\ufffdf\ufffd\ufffdo\u000ea\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\u0014\u0000\ufffd \ufffd\ufffd2\u0015\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE\u00072Q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003\u00009\u00005\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u06cd\ufffd=\ufffd}\ufffd\u0005\ufffdf\ufffd\ufffdo\u000ea\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\u0014\u0000\ufffd \ufffd\ufffd2\u0015\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE\u00072Q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1737dce5ae0a61898a7d5f97cf34767e6a1f7460",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u06cd\ufffd=\ufffd}\ufffd\u0005\ufffdf\ufffd\ufffdo\u000ea\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\u0014\u0000\ufffd \ufffd\ufffd2\u0015\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE\u00072Q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "*%\ufffdCookie: mstshash=nmap\r\n\ufffd\u06cd\ufffd=\ufffd}\ufffd\ufffdf\ufffd\ufffdoa\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\ufffd \ufffd\ufffd2\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE2Q\ufffd3",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u06cd\ufffd=\ufffd}\ufffd\u0005\ufffdf\ufffd\ufffdo\u000ea\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\u0014\u0000\ufffd \ufffd\ufffd2\u0015\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE\u00072Q\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u00003",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*%\ufffdCookie: mstshash=nmap\r\n\ufffd\u06cd\ufffd=\ufffd}\ufffd\ufffdf\ufffd\ufffdoa\ufffd\ufffd\ufffdv\/$M\ufffd\ufffdK\ufffd\u03c4\ufffd\ufffd \ufffd\ufffd2\ufffd9W-S>4\ufffd}D\ufffd\ufffdC\\\/\ufffdb\ufffd\ufffd\ufffds\u0239fE2Q\ufffd3",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_rdp_cookie",
"rdp_cookie",
"rdp_emulated"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 16ee84a07b55074c
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
i eU ��random1random2random3random4 / 9 � 0 , *
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0348
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
i eU ��random1random2random3random4 /
9 � 0
, *
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 110,
"payload_entropy": 4.269606220838881,
"port_category": "registered",
"org": "Google LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 396982,
"country": "BE",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 48,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5cb9b53baf1209ea6c81c49a02d920dd293de6a4",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0348",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0348",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6",
"ja3": "16ee84a07b55074cb2751329bf1c8811",
"ja4": "011b865e5f91ae5e1836c88110724dcb",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja3": "771,47-10-19-57-4-255,13,,",
"tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb",
"tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 6,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 48
},
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b139bc66408450bd456536f9ed44afe045185d85",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0348",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0348",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002",
"tls_ja3": "16ee84a07b55074cb2751329bf1c8811",
"tls_ja4": "011b865e5f91ae5e1836c88110724dcb",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Investiguer
Tags
net_rdp_cookie
rdp_cookie
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Pourquoi cette classification : Négociation protocole RDP · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0348
pat-0352
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
RDP negotiation
ET H.323 setup
Mumble ping
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000130ed00000123400021f080000000000",
"emulator_response_len": 19,
"bytes_in": 11,
"payload_entropy": 1.6729330318733675,
"port_category": "registered",
"org": "Google LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 396982,
"country": "BE",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40bf2c34d73676fee23426938806aaa527b96fcb",
"event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0348",
"pat-0352"
],
"kb_rule_ids": [
"pat-0348",
"pat-0352"
],
"matched_patterns": [
"pat-0348",
"pat-0352",
"pat-0868",
"pat-0768",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"RDP negotiation",
"ET H.323 setup",
"Mumble ping",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0352",
"pat-0868",
"pat-0768",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6771a78868614c6768349c36da4591da",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5b36a4270d4869f12077671ad4144b3f1d04dbf",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "\ufffd",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0348",
"pat-0352"
],
"tags_summary_labels_fr": [
"pat-0348",
"pat-0352"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_rdp_cookie",
"rdp_cookie",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Investiguer
Tags
net_rdp_cookie
rdp_cookie
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
*%� Cookie: mstshash=nmap
Pourquoi cette classification : Négociation protocole RDP · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0347
pat-0348
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP NTLM hash
RDP TPKT header
ET H.323 setup
UA nmap
Sigma nmap UA
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
*%� Cookie: mstshash=nmap
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "030000130ed00000123400021f080000000000",
"emulator_response_len": 19,
"bytes_in": 42,
"payload_entropy": 4.01673557728311,
"port_category": "registered",
"org": "Google LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 396982,
"country": "BE",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40bf2c34d73676fee23426938806aaa527b96fcb",
"event_fingerprint": "ad5bc6c1132c10ce0e88d551a1bd2cf31dc3757e",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 116,
"precision_signals": [
"pat-0347",
"pat-0348"
],
"kb_rule_ids": [
"pat-0347",
"pat-0348"
],
"matched_patterns": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0448",
"pat-0543",
"pat-0554"
],
"matched_pattern_names": [
"RDP NTLM hash",
"RDP TPKT header",
"ET H.323 setup",
"UA nmap",
"Sigma nmap UA",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0347",
"pat-0348",
"pat-0868",
"pat-0448",
"pat-0543",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0b433ea46fa14da59e4ac0ed3d8d3eac",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 50
},
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"payload_snippet": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb99f72760209f0afed0e18f1a3575a66cdc27be",
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "*%\ufffdCookie: mstshash=nmap",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via RDP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0347",
"pat-0348"
],
"tags_summary_labels_fr": [
"pat-0347",
"pat-0348"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0003\u0000\u0000*%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=nmap\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*%\ufffdCookie: mstshash=nmap",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_rdp_cookie",
"rdp_cookie",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde port 3389/TCP
port 3389 tcp · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Preuve honeypot — Sonde port 3389/TCP
Connexion détectée sur le port 3389 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3389_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Google LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 396982,
"country": "BE",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aa4bea48009056c8c3884e795b29aa79232ecca7",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_reason": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "rdp",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "eb3d82ddd64e24c65658a8ee92a2ad53"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d8d4f39783aca29ac10813e5aedff8182459974",
"protocol_details": {
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3389 tcp \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|