|
|
TCP |
5986 · WINRM
|
winrm
|
Sonde WinRM
winrm probe · via WINRM:5986 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 35fa0a83e466acbe
Émulateur
WINRM
WAF
—
Recommandation
Surveiller
Tags
net_winrm_probe
tls_clienthello
winrm_emulated
winrm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5986
Chemin / cible
—
Service
WINRM
Payload
� �� ��M5�xlW8,n+�e�ٝg�s��J#Ǚ�a ���FS���a ��D��|�?%~��s�(�;�fR�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « Sonde WinRM » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� ��M5�xlW8,n+�e�ٝg�s��J#Ǚ�a ���FS���a ��D��|�?%~��s�(�;�fR�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �� ��M5�xlW8,n+�e�ٝg�s��J#Ǚ�a ���FS���a ��D��|�?%~��s�(�;�fR�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �Ӡ���XMY��}3�J���i������ʓ�{`'
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"15030300020228","emulator_response_len":7,"bytes_in":243,"payload_entropy":5.899766779811637,"port_category":"registered","org":"Microsoft Corporation","service":"winrm","app_proto":"winrm","asn":8075,"country":"US","dst_port":5986,"risk_waf":8,"risk_classification":62,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":24,"tag_count":4,"anomaly_count":0,"campaign_key":"b3e6906c1792c2768b074023d1d184a2dfc6e7ff","event_fingerprint":"de62a3d1efb52e02f0717b258a9e7d3a40cdb938","classification_reason":"Type \u00ab winrm_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":62,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"winrm","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"9e2c82ffb3d7b36db3cceaf6eb646f6d","path_pattern_hash":"a98d2328dfdc853a4ac94ea7611b67e5","ja3":"35fa0a83e466acbec1cfbb9016d550ab","ja4":"7b5e3a15097abc10f88e98257ea51010","tls_version":"0x0303","tls_cipher_count"…
|
|
|
TCP |
7000 · CASSANDRA JMX
|
cassandra-jmx
|
Sonde Cassandra
cassandra probe · via CASSANDRA JMX:7000 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
CASSANDRA-JMX
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7000
Chemin / cible
—
Pourquoi cette classification : Type « Sonde Cassandra » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"4f4b0d0a","emulator_response_len":4,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Microsoft Corporation","service":"cassandra-jmx","app_proto":"cassandra-jmx","asn":8075,"country":"US","dst_port":7000,"risk_waf":8,"risk_classification":55,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":8,"classification":55,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"0f2b3f688e52b847eec81bfc3a7ca929d263c647","event_fingerprint":"0515a90696fafcab67973d1c4c56caf19b56703e","classification_reason":"Type \u00ab cassandra_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":55,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":34},"named_classification_skipped":false,"service_name":"cassandra-jmx","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"4ab235198c4b31da3311b42124ef3494"},"target_context":{"dst_port":7000,"service":"cassandra-jmx","service_name":"cassandra-jmx","risk_score":34},"attack_stage":"probe","mitre_tact…
|
|
|
TCP |
25565 · MINECRAFT
|
minecraft
|
Sonde Minecraft
minecraft probe · via MINECRAFT:25565 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
MINECRAFT
WAF
—
Recommandation
Surveiller
Tags
minecraft_emulated
net_minecraft_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25565
Chemin / cible
—
Service
MINECRAFT
Payload
�aaac�
Pourquoi cette classification : Type « Sonde Minecraft » (signaux protocolaires) · confiance 67%
Confiance classification
67%
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Upstream
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"ff787b2276657273696f6e223a7b226e616d65223a22312e32302e34222c2270726f746f636f6c223a3736357d2c22706c6179657273223a7b226d6178223a32302c226f6e6c696e65223a337d2c226465736372697074696f6e223a7b2274657874223a22486f6e6579706f74204d696e656372616674227d7d","emulator_response_len":122,"bytes_in":13,"payload_entropy":3.0269868333592873,"port_category":"registered","org":"Microsoft Corporation","service":"minecraft","app_proto":"minecraft","asn":8075,"country":"US","dst_port":25565,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":45,"tag_count":2,"anomaly_count":0,"campaign_key":"8be6ef7fabefbad597e63a337cf1c4019124c274","event_fingerprint":"693ecbb9a1e86d78b2b00f4d400ad992bafdc5d5","classification_reason":"Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%","confidence":0.67,"classification_confidence":0.67,"precision_score":75,"precision_signals":["pat-0554","INT-upstream"],"kb_rule_ids":["pat-0554","INT-upstream"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":45},"named_classification_skipped":false,"service_name":"minecraft","risk_confid…
|
|
|
TCP |
5800
|
—
|
Sonde port 5800
Sonde port · port 5800 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5800
Chemin / cible
—
Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Meta JSON brut
{"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Microsoft Corporation","service":null,"app_proto":null,"asn":8075,"country":"US","dst_port":5800,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"5c67bb6434a94dc920e707aa0b53ca870b0346bb","event_fingerprint":"378a38e20b012996744d4458dfc435e9ec8050c5","classification_confidence":0.5,"confidence":0.5,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"US","asn":8075,"org":"Microsoft Corporation","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":5800,"risk_score":44},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_family":["scanner"],"recommended_client_action":"monitor","policy_mode":"intelligence","sensor_role":"threat_intelligence","event_signature":"02a5a040b9c1c2e92313f44a794a621ce8d06efb","protocol_details":{…
|