Méthode
—
Port
22
Chemin / cible
—
Pourquoi cette classification : Type « ssh_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.9.6
��f�)K`=s.���W� (curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist
Requête brute (extrait)
SSH-2.0-libssh_0.9.6 ��f�)K`=s.���W� (curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 998,
"payload_entropy": 4.790595658363384,
"port_category": "well_known",
"org": "GoDaddy.com, LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 26496,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 27,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 141,
"precision_signals": [
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 26496,
"org": "GoDaddy.com, LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2f59483be451109848fdceb1b14c40c",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh"
},
"payload_preview": "SSH-2.0-libssh_0.9.6\r\n\u0000\u0000\u0003\ufffd\u0006\u0014\ufffdf\ufffd)K`=s\u0012\u0015.\ufffd\ufffd\ufffdW\ufffd\u0000\u0000\u0001(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist",
"request_sample": "SSH-2.0-libssh_0.9.6\r\n\u0000\u0000\u0003\ufffd\u0006\u0014\ufffdf\ufffd)K`=s\u0012\u0015.\ufffd\ufffd\ufffdW\ufffd\u0000\u0000\u0001(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-",
"payload_snippet": "SSH-2.0-libssh_0.9.6\r\n\u0000\u0000\u0003\ufffd\u0006\u0014\ufffdf\ufffd)K`=s\u0012\u0015.\ufffd\ufffd\ufffdW\ufffd\u0000\u0000\u0001(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.9.6\r\n\u0000\u0000\u0003\ufffd\u0006\u0014\ufffdf\ufffd)K`=s\u0012\u0015.\ufffd\ufffd\ufffdW\ufffd\u0000\u0000\u0001(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-",
"payload_snippet": "SSH-2.0-libssh_0.9.6\r\n\u0000\u0000\u0003\ufffd\u0006\u0014\ufffdf\ufffd)K`=s\u0012\u0015.\ufffd\ufffd\ufffdW\ufffd\u0000\u0000\u0001(curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist",
"classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fdcc83615e4b46f76500d634024955ae4d78b37c",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|