|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP (3389/TCP)
port 3389 tcp · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Preuve honeypot — Sonde RDP (3389/TCP)
Connexion détectée sur le port 3389 (TCP) du capteur simulé.
Service
RDP
Payload
���itV����[lI��}�D�n��>�*���9tP Y���e�$ ��Jը�`gH�n��֣���Ѽ�O� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde RDP (3389/TCP) » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
���itV����[lI��}�D�n��>�*���9tP Y���e�$ ��Jը�`gH�n��֣���Ѽ�O� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
���itV����[lI��}�D�n��>�*���9tP Y���e�$ ��Jը�`gH�n��֣���Ѽ�O� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / w� 62.3.50.33 � # 6 4
Meta JSON brut
{"protocol_emulated":true,"bytes_in":1541,"payload_entropy":7.71840776248467,"port_category":"registered","org":"Pakistan Telecommunication Company Limited","service":"rdp","app_proto":"rdp","asn":17557,"country":"PK","dst_port":3389,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"5cb9b53baf1209ea6c81c49a02d920dd293de6a4","event_fingerprint":"707be242ce71f14fac23ca7fdd82d854dc2752d8","classification_reason":"Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":42},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"rdp","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PK","asn":17557,"org":"Pakistan Telecommunication Company Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"caf8b055a194a64ec0fd106426de5fa0","path_pattern_hash":"eb3d82ddd64e24c65658a8ee92a2ad53"},"target_context":{"dst_port":3389,"service":"rdp","service_name":"rdp","risk_score":42},"payload_snippet":"\…
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
��`����>G�� '��\����yc4(ͰqG �>�ۈ.vy�l .&䩲��%�� �,���� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde RDP » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
��`����>G�� '��\����yc4(ͰqG �>�ۈ.vy�l .&䩲��%�� �,���� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��`����>G�� '��\����yc4(ͰqG �>�ۈ.vy�l .&䩲��%�� �,���� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / w� 62.3.50.33 � # 6 4
Meta JSON brut
{"protocol_emulated":true,"bytes_in":1541,"payload_entropy":7.699572483411546,"port_category":"registered","org":"Pakistan Telecommunication Company Limited","service":"rdp","app_proto":"rdp","asn":17557,"country":"PK","dst_port":3389,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":45,"tag_count":3,"anomaly_count":0,"campaign_key":"5cb9b53baf1209ea6c81c49a02d920dd293de6a4","event_fingerprint":"707be242ce71f14fac23ca7fdd82d854dc2752d8","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0771"],"classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":45},"service_name":"rdp","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PK","asn":17557,"org":"Pakistan Telecommunication Company Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"aa56a76ccdf354ecc40502ea1813f4c9","path_pattern_hash":"5dd788b551ee7afb63321e74cfc538f6"},"target_context":{"dst_port":3389,"service":"rdp","service_name":"rdp","risk_score":45},"payload_snippet":"\u0016\u0003\u0001\u0006\u0000\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\ufffd\ufffd\ufffd\u0017\u…
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
�L�0I d&�z'� ��C gN� x��I��%W l�\ǎ#�gg���k� ��Ω��g���36��:� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde RDP » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
�L�0I d&�z'� ��C gN� x��I��%W l�\ǎ#�gg���k� ��Ω��g���36��:� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�L�0I d&�z'� ��C gN� x��I��%W l�\ǎ#�gg���k� ��Ω��g���36��:� <�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / w� 62.3.50.33 � # 6 4
Meta JSON brut
{"protocol_emulated":true,"bytes_in":1541,"payload_entropy":7.695843362225089,"port_category":"registered","org":"Pakistan Telecommunication Company Limited","service":"rdp","app_proto":"rdp","asn":17557,"country":"PK","dst_port":3389,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":45,"tag_count":3,"anomaly_count":0,"campaign_key":"5cb9b53baf1209ea6c81c49a02d920dd293de6a4","event_fingerprint":"707be242ce71f14fac23ca7fdd82d854dc2752d8","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0771"],"classification_reason":"Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":45},"service_name":"rdp","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PK","asn":17557,"org":"Pakistan Telecommunication Company Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"a4969792ed35aa413ef6d024c7599fe8","path_pattern_hash":"5dd788b551ee7afb63321e74cfc538f6"},"target_context":{"dst_port":3389,"service":"rdp","service_name":"rdp","risk_score":45},"payload_snippet":"\u0016\u0003\u0001\u0006\u0000\u0001\u0000\u0005\ufffd\u0003\u0003L\u000f\ufffd0I\fd&\ufffd\u000fz'…
|