Méthode
—
Port
22
Chemin / cible
—
Confiance classification
71%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.9.6
Meta JSON brut
{
"bytes_in": 22,
"payload_entropy": 3.879664004902593,
"port_category": "well_known",
"org": "Tencent Building, Kejizhongyi Avenue",
"service": "ssh",
"app_proto": "ssh",
"asn": 132203,
"country": "SG",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 14,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4b687cfbd2a2f5b43a89ec258bffd822ae9203ba",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 132203,
"org": "Tencent Building, Kejizhongyi Avenue",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6c435cd5755c7361597477daa7a2618",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.71,
"classification_confidence": 0.71,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "SSH-2.0-libssh_0.9.6\r\n",
"event_signature": "b1d7930aae50e69d6cdb7ea262079e9ed7b39238",
"ban_policy": "advisory_monitor",
"tags_list": [
"ssh_banner",
"ssh_libssh"
]
}
|