|
|
TCP |
7443 · HTTP
|
http
|
Sonde HTTPS alternatif (7443/TCP)
port 7443 tcp · via HTTP:7443 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
Découverte
Accès
Protocole
GET / UA curl/7.74.0
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7443
Chemin / cible
/
Preuve honeypot — Sonde HTTPS alternatif (7443/TCP)
Connexion détectée sur le port 7443 (TCP) du capteur simulé.
Pourquoi cette classification : Type « Sonde HTTPS alternatif (7443/TCP) » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/7.74.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7443
User-Agent: curl/7.74.0
Connection: close
Accept-Encoding: gzip
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":4,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"17bdda463fb70d98be11139377c20587f74ff713","http_host_hash":"3207cc58a88e4dd65c61f1b1f14e699cc0722bbe","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":true,"http_ua_is_browser":false,"bytes_in":108,"payload_entropy":4.947741354344798,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"http","app_proto":"http","asn":45102,"country":"DE","dst_port":7443,"risk_waf":32,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":30,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":0,"protocol":43,"novelty":30},"risk_score":38,"tag_count":5,"anomaly_count":1,"campaign_key":"2375e62a68e65b640c8435301d8ff3dcb1464add","event_fingerprint":"4971ce9f3b709ff7e8cb26068596f8e524aea88b","classification_reason":"Type \u00ab port_7443_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.63,"classification_confidence":0.63,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":32,"classification":38,"behavior":0,"geo":0,"…
|
|
|
TCP |
7443 · ORACLE EM
|
oracle-em
|
Sonde PostgreSQL
postgres probe · via ORACLE EM:7443 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 19e29534fd49dd27
Émulateur
ORACLE-EM
WAF
—
Recommandation
Surveiller
Tags
net_oracle_tns_probe
oracle_em_emulated
oracle_em_payload
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7443
Chemin / cible
—
Service
ORACLE EM
Payload
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �<'�Vʑ�t���m-�߅��@���+33�:�H
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":243,"payload_entropy":5.917995008383122,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"oracle-em","app_proto":"oracle-em","asn":45102,"country":"DE","dst_port":7443,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":35,"tag_count":4,"anomaly_count":0,"campaign_key":"4f4acff4c9041c67c73fa498ee94611b63a0dc4b","event_fingerprint":"3f1d4b52645bcd9531502ab86dc099f88926bef6","classification_reason":"Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0369"],"kb_rule_ids":["pat-0369"],"matched_patterns":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"matched_pattern_names":["PostgreSQL startup","STUN binding","Minecraft varint handshake","SOCKS5 greeting","SIP TLS ClientHello","TFTP RRQ"],"pattern_ids":["pat-0369","pat-0771","pat-0554","pat-0567","pat-0578","pat-0536"],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":30,"novel…
|