|
|
TCP |
6379 · REDIS
|
redis
|
Injection commande Redis
redis command injection · via REDIS:6379 · (tentative d'exploit)
|
Élevée
|
Moyen · 47
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
Commande Redis : *1
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Service
REDIS
Redis
Commande Redis : *1
Payload
*1 $4 PING
Pourquoi cette classification : Type « Injection commande Redis » (signaux protocolaires) · confiance 61%
Confiance classification
61%
Risque capteur
Moyen
· 47
Confiance : Confiance 61 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-fb-011
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Motifs de détection (base)
Redis PING
User-Agent
—
Règles WAF
—
Payload (extrait)
*1
$4
PING
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a","emulator_response_len":34,"bytes_in":14,"payload_entropy":3.128085278891395,"port_category":"registered","org":"SPARKED HOST LLC","service":"redis","app_proto":"redis","asn":397032,"country":"FR","dst_port":6379,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":47,"tag_count":2,"anomaly_count":0,"campaign_key":"b10303bd0e441f9f60f46376cbc4ca72292b5068","event_fingerprint":"9c536ce82edfb6f83700eeb7934e9ac49a41747b","classification_reason":"Type \u00ab redis_command_injection \u00bb (signaux protocolaires) \u00b7 confiance 61%","confidence":0.61,"classification_confidence":0.61,"precision_score":72,"precision_signals":["pat-fb-011"],"kb_rule_ids":["pat-fb-011"],"matched_patterns":["pat-fb-011"],"matched_pattern_names":["Redis PING"],"pattern_ids":["pat-fb-011"],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":47},"named_classification_skipped":false,"classification_parent":"redis_probe","service_name":"redis","risk_confidence_factor":61,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"FR","asn":397032,"org":"SPARKED HOST LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint"…
|
|
|
TCP |
8443 · HTTPS
|
https
|
Sonde HTTP
Sonde HTTP · via HTTPS:8443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
� ����c��^Õ$j�]Q�5o��[�oCPb z �QW�����\U����ϐ�c3�X}h�����j �+�/�,�0̨̩� �� � T �
Pourquoi cette classification : Type « Sonde HTTP » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����c��^Õ$j�]Q�5o��[�oCPb z �QW�����\U����ϐ�c3�X}h�����j �+�/�,�0̨̩� ��
� T �
Requête brute (extrait)
� ����c��^Õ$j�]Q�5o��[�oCPb z �QW�����\U����ϐ�c3�X}h�����j �+�/�,�0̨̩� �� � T � � http/1.1 + 3����2��wae���$�&So�L���Ǩ�|C��T �e�
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":1472,"payload_entropy":7.753278664232301,"port_category":"registered","org":"SPARKED HOST LLC","service":"https","app_proto":"https","asn":397032,"country":"FR","dst_port":8443,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":40,"tag_count":3,"anomaly_count":0,"campaign_key":"841a7de3c3cbd932ffe2df923d0bb6a948309046","event_fingerprint":"48aa5a12dd4150e072f6d3dd03f9143ac67f8d69","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"FR","asn":397032,"org":"SPARKED HOST LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"9a669da5ea21c28bec683252db8af8b9","path_pattern_hash":"4154520a4208b3f021f35a6cc1dd98ae"},"service_name":"https","target_context":{"dst_port":8443,"service":"https","service_name":"https","risk_score":40},"payload_snippet":"\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006c\ufffd\ufffd\u0002\u0006\u0003^\u00d5$j\ufffd]Q\ufffd5o\ufffd\u000f\ufffd[\ufffdoCPb\u000bz \ufffd\bQW\ufffd\ufffd\ufffd\u0007\ufffd\ufffd\\U\ufffd\ufffd\ufffd\u…
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
Découverte
Accès
Protocole
SSH SSH-2.0-Go �˥�S�����E� �� curve25519-sha256,curve25519…
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-Go �˥�S�����E� �� curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384…
Payload
SSH-2.0-Go �˥�S�����E� �� curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-
Pourquoi cette classification : Bannière client SSH reçue · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
Upstream
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-Go
�˥�S�����E� �� curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-
Requête brute (extrait)
SSH-2.0-Go �˥�S�����E� �� curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a","emulator_response_len":39,"bytes_in":1196,"payload_entropy":4.865269536944137,"port_category":"well_known","org":"SPARKED HOST LLC","service":"ssh","app_proto":"ssh","asn":397032,"country":"FR","dst_port":22,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.3,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":25},"risk_score":48,"tag_count":5,"anomaly_count":0,"campaign_key":"9a91c35ff8553fc24795f9eaf93692ffdae1839c","event_fingerprint":"bc4e3fa786c83e0db7c1c892cb0c288f6b14388f","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%","confidence":0.95,"classification_confidence":0.95,"precision_score":79,"precision_signals":["INT-ssh-libssh-ua","INT-upstream"],"kb_rule_ids":["INT-ssh-libssh-ua","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":25,"risk_score":48},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"FR","asn":397032,"org":"SPARKED HOST LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b378e963a8623108ca0b255e1f5b7cf4","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_cont…
|