18/07/2026 15:53:32 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY | E��md{r��^�7�p hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY | E��md{r��^�7�p hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY | E��md{r��^�7�p hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
| E��md{r��^�7�p hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY | E��md{r��^�7�p hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.84043140976122,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "78cf33f14eee83bc32e5eb97c7f089fc",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e41b5c4764092c47ebcbc2eaa3d790abb0da1c0",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|E\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdphcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|E\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdphcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 15:38:02 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�� �`� |WN�e� � hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�� �`� |WN�e� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�� �`� |WN�e� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
RDP TPKT header
PuTTY SSH client
SSH-2.0 banner RFC4253
ET H.323 setup
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�� �`�
|WN�e� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�� �`� |WN�e� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.83927412195538,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0348",
"pat-0389",
"pat-0391",
"pat-0868",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"RDP TPKT header",
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"ET H.323 setup",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0348",
"pat-0389",
"pat-0391",
"pat-0868",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ec6fd1862ad6ad85823698bfdb5c3a4e",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48219206b8ac1d8a08433e9e4eca973054dcfba6",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd`\ufffd\r|WN\ufffde\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd`\ufffd\r|WN\ufffde\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 15:22:40 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |���(Ǣk4�]�X�5 hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |���(Ǣk4�]�X�5 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |���(Ǣk4�]�X�5 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|���(Ǣk4�]�X�5 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |���(Ǣk4�]�X�5 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.837663151301947,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afdb1ce857c7c2577f09af83baef6e63",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d9d32a70845c1cd782cf36bae7a9c26eae92a15",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd(\u01e2k4\ufffd]\ufffdX\ufffd5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd(\u01e2k4\ufffd]\ufffdX\ufffd5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 15:17:26 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��A�N��� ��U���� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��A�N��� ��U���� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��A�N��� ��U���� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��A�N���
��U���� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��A�N��� ��U���� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.847732616956547,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c710cbd7b4fa1865eadda43bfba15dbd",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66a2027c62c3532245142a237ee7bd7c607a01d9",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 15:12:14 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��*8��EbP�y<� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��*8��EbP�y<� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��*8��EbP�y<� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��*8��EbP�y<� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��*8��EbP�y<� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.842432628245259,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9af38d069c2fc826029d6c2e851d6101",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "532312f730a61d508957b892ecb36429566e3810",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd*8\ufffd\ufffdEbP\ufffdy<\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd*8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd*8\ufffd\ufffdEbP\ufffdy<\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 13:54:36 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�� 6�~}k���f<u� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�� 6�~}k���f<u� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�� 6�~}k���f<u� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�� 6�~}k���f<u� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�� 6�~}k���f<u� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.836652221183077,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb11ecedbd17886e5da05080f1403e23",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8d27ce0d7e9f07ddabc85bdee33221e1f45d8a6",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd6\ufffd~}k\ufffd\ufffd\ufffdf<u\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd6\ufffd~}k\ufffd\ufffd\ufffdf<u\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
18/07/2026 13:49:28 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |ʣ�|=2�I�����ڬ hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |ʣ�|=2�I�����ڬ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |ʣ�|=2�I�����ڬ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|ʣ�|=2�I�����ڬ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |ʣ�|=2�I�����ڬ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.852661950933548,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58ac454bb7d80da76a372158e98538c6",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4482200214c83aba87b31530e0c239646316ed32",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u02a3\ufffd|=2\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06achcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u02a3\ufffd|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u02a3\ufffd|=2\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06achcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 12:45:57 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��N������>6*y|J| hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��N������>6*y|J| hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��N������>6*y|J| hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��N������>6*y|J| hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��N������>6*y|J| hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.845976687022527,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "411ef998af3854747e5859914835d55b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fe9696e7a5c079a3009e1336f2dcdadbc35b55e",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y|J|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 11:53:51 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |⩚g`膪�} XJ[� hcurve25519-sha256,curve2551…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |⩚g`膪�} XJ[� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp38…
Payload
SSH-2.0-PUTTY |⩚g`膪�} XJ[� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|⩚g`膪�} XJ[� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |⩚g`膪�} XJ[� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.855111309180342,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "97032a6cd125ceda7a324bbdf5de4ae2",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae91e434d020b8a69f4399ad73204ab0ca1ce74d",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u2a5ag`\u81aa\ufffd}XJ[\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u2a5ag`\u81aa\ufffd}XJ[\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 11:48:38 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY | %����a�E �d� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY | %����a�E �d� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY | %����a�E �d� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|
%����a�E �d� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY | %����a�E �d� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.842971661439484,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "77a04277b21e07bc02086886e399e733",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41b5e68354ec8b06fa64eef68360a68f23c20c65",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\r%\ufffd\ufffd\ufffd\ufffda\ufffdE\ufffdd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\r%\ufffd\ufffd\ufffd\ufffda\ufffdE\ufffdd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 11:12:05 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |K� M�S=U�i`k� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |K� M�S=U�i`k� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |K� M�S=U�i`k� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|K� M�S=U�i`k� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |K� M�S=U�i`k� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.836717367197503,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "09d649e15591174ccf42629032820b22",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4453921e467352dde25571959978c7aaaa093bee",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|K\ufffdM\ufffdS=U\ufffdi`k\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|K\ufffdM\ufffdS=U\ufffdi`k\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 06:12:49 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�����>�(� hcurve25519-sha256,curve255…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp3…
Payload
SSH-2.0-PUTTY |�����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�����>�(�
hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.849951868779991,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "368a45004861bf945597ee1a07683909",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b57c20aab8855a89131c30a26e7ca98b217da533",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\rhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\rhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 05:20:43 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |I������f�^�x��N hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |I������f�^�x��N hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |I������f�^�x��N hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|I������f�^�x��N hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |I������f�^�x��N hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.852443622075373,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d3364ba461f44b3b9313c9b74f3069f3",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efce0b2f5c7705fdfed1d8575f5f947dbe2f6ed7",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd^\ufffdx\ufffd\ufffdNhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd^\ufffdx\ufffd\ufffdNhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
18/07/2026 04:54:33 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |lL��� V�Jx�b�f�� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |lL��� V�Jx�b�f�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |lL��� V�Jx�b�f�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|lL��� V�Jx�b�f�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |lL��� V�Jx�b�f�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.846869311842255,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f10ec370814572351f4bbaecb532c66b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5853bf6162f7aa393a09249470dda1742c10937d",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 20:38:04 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�����Y �n9�c�� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�����Y �n9�c�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�����Y �n9�c�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�����Y �n9�c�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�����Y �n9�c�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.8427265247294065,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d94279d9268df96d732903eca6f8c06",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d34986018c95871b2b0b84a38f10cb79245cb30",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffdn9\ufffdc\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffdn9\ufffdc\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 20:22:11 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |m�[��C �Q�朥�~ hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |m�[��C �Q�朥�~ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |m�[��C �Q�朥�~ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|m�[��C �Q�朥�~ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |m�[��C �Q�朥�~ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.854356639204722,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5f14d61d740cd25286ccc050ee5a448b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07db8186091844e397625fee735cd240f38b955c",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|m\ufffd[\ufffd\ufffdC\ufffdQ\ufffd\u6725\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|m\ufffd[\ufffd\ufffdC\ufffdQ\ufffd\u6725\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 19:33:52 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�pp�Y��nt��L� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�pp�Y��nt��L� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�pp�Y��nt��L� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�pp�Y��nt��L� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�pp�Y��nt��L� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.835442324663536,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58effb708c141d022275738176363787",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bce1febb7a7ffc78b2089e7c70a93fd2a68d3ee4",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdpp\ufffdY\ufffd\ufffdnt\ufffd\ufffdL\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdpp\ufffdY\ufffd\ufffdnt\ufffd\ufffdL\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 19:27:09 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |����q�q.j:���!� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |����q�q.j:���!� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |����q�q.j:���!� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|����q�q.j:���!� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |����q�q.j:���!� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.845606627596731,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5d361d91ace443c9bd6e300daee77cad",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a9b891c4da8fb0106e932338606b318522e55d4",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffdq\ufffdq.j:\ufffd\ufffd\ufffd!\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffdq\ufffdq.j:\ufffd\ufffd\ufffd!\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 18:30:52 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |� ;�SR}g"����.? hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |� ;�SR}g"����.? hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |� ;�SR}g"����.? hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�
;�SR}g"����.? hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |� ;�SR}g"����.? hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.849369545380801,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a08b94a70c9dc18bd38a458c03857edc",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b07f6bb289abfcf32ee68a6232ffe365e1acb953",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 17:38:45 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��?��V �ZJ;�a��g hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��?��V �ZJ;�a��g hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��?��V �ZJ;�a��g hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��?��V
�ZJ;�a��g hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��?��V �ZJ;�a��g hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.84606361399407,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "430f4eae8f7f238312423138ebef0063",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b8e5934eb597e3cb4bfd6ed104058c5d68b0263",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 16:20:51 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |[�� (Ƥ ���D� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |[�� (Ƥ ���D� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |[�� (Ƥ ���D� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|[�� (Ƥ
���D� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |[�� (Ƥ ���D� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.853746658793475,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50d01ba9810599f4427af48c9c3de0d9",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53f25f35525b777a884c8d9299c0de54668e7911",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|[\ufffd\ufffd(\u01a4\n\ufffd\ufffd\ufffdD\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|[\ufffd\ufffd(\u01a4\n\ufffd\ufffd\ufffdD\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 16:03:44 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |� �V`��{�ߏ tk� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |� �V`��{�ߏ tk� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |� �V`��{�ߏ tk� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�
�V`��{�ߏ tk� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |� �V`��{�ߏ tk� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.85198168645638,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "82c0748e9f44a4d44f178ca63ea1ddd7",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "306875552610945454215b8490171b1791115ca6",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\ttk\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\ttk\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 12:52:31 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�l�W�2q�R��� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�l�W�2q�R��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |�l�W�2q�R��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�l�W�2q�R��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�l�W�2q�R��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.845925106670515,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "075057d941b50d121ae45453157738ce",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd96586479b0c9ddbf141fa9f654ad33c797fec0",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdl\ufffdW\ufffd2q\ufffdR\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdl\ufffdW\ufffd2q\ufffdR\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 12:26:15 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |o9W��Ϸ���i���9 hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |o9W��Ϸ���i���9 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |o9W��Ϸ���i���9 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|o9W��Ϸ���i���9 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |o9W��Ϸ���i���9 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.836974892327002,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b64547dcba017136bafd5b449751b14b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b4cb73e74ade76443a2fb0d0150f73fe648614c",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 12:04:56 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�� ��(�2��ب �p� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�� ��(�2��ب �p� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |�� ��(�2��ب �p� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�� ��(�2��ب �p� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�� ��(�2��ب �p� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.841910347637305,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d8144bb40f72fd23afe901af7968178f",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f9219a55cf06533a5eccdf7f6f3c7903eb1fab6a",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\ufffdp\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\ufffdp\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 11:28:25 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |%3_�z3V\�U�v{� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |%3_�z3V\�U�v{� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |%3_�z3V\�U�v{� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|%3_�z3V\�U�v{� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |%3_�z3V\�U�v{� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.848381919994971,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c25dc30700b91d152a84488cc4843c05",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9964b0e83d5ec25e4fdf1400ffa76db5572b5593",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|%3_\ufffdz3V\\\ufffdU\ufffdv{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|%3_\ufffdz3V\\\ufffdU\ufffdv{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 09:05:15 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��ًw���J�;V��L" hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��ًw���J�;V��L" hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |��ًw���J�;V��L" hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��ًw���J�;V��L" hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��ًw���J�;V��L" hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.860772080457562,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e22f016351fad3f271e5009413966001",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfbdc6de9a61569f49069b558e2b14e9d0194c69",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 08:54:51 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |&��o���j� hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |&��o���j� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |&��o���j� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|&��o���j� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |&��o���j� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.847341726014627,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2d5e89be81b28253297524ac97f38b5",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a26c92b5fd1c8edec9d005b284a8c46c766e176",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|&\ufffd\ufffdo\ufffd\ufffd\ufffdj\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|&\ufffd\ufffdo\ufffd\ufffd\ufffdj\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 08:18:18 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |���N�3� q� ��o � hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |���N�3� q� ��o � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |���N�3� q� ��o � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|���N�3� q� ��o
� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |���N�3� q� ��o � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.850134535888863,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7fd6abbe0a7ead409cb69107a8f4fc4a",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "996d30d4e3c48183218b69c831a965628545b4b4",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffdN\ufffd3\ufffdq\ufffd\ufffd\ufffdo\r\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffdN\ufffd3\ufffdq\ufffd\ufffd\ufffdo\r\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 07:20:49 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |h$��{�i��N��� hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |h$��{�i��N��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |h$��{�i��N��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|h$��{�i��N��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |h$��{�i��N��� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.8506895525379985,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a7ad14c3c5a5f78439f5912db9998e40",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e50ff1a9ba51f0a28ae44303362656775adbc224",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 07:10:10 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��������,����P� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��������,����P� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��������,����P� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��������,����P� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��������,����P� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.852326723694155,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6c27fda5b6c9b01c1935a582a87cf4d4",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25c91c05730f69317468fed2c7da10c023eb9801",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdP\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdP\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
17/07/2026 00:10:20 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |*3��E���r�21�� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |*3��E���r�21�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |*3��E���r�21�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|*3��E���r�21�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |*3��E���r�21�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.839454448563342,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e4221048afb854b51d5dece7b1622ab0",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9881030231f69f5eb6c7f1639e4bddf363e86efe",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|*3\ufffd\ufffdE\ufffd\ufffd\ufffdr\ufffd21\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014*3\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|*3\ufffd\ufffdE\ufffd\ufffd\ufffdr\ufffd21\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 22:04:14 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |;3b���է;֚�H�k hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |;3b���է;֚�H�k hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |;3b���է;֚�H�k hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|;3b���է;֚�H�k hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |;3b���է;֚�H�k hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.844009645012764,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "36fba4d533c033be7a60f5fdd3221332",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b436982e2ac811cf89fc003be9647f5b214c44c",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffdH\ufffdkhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffdH\ufffdkhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 15:22:40 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��Naj��uM#� � hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��Naj��uM#� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��Naj��uM#� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��Naj��uM#� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��Naj��uM#� � hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.843170630368789,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ab17a68bd5bf0dbd0a4f34b7f0ec85cc",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4fb74bdac2c5c922373a34a590907bc2249927c3",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdNaj\ufffd\ufffduM#\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdNaj\ufffd\ufffduM#\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 13:58:20 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |>������uO��ϴ� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |>������uO��ϴ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |>������uO��ϴ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|>������uO��ϴ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |>������uO��ϴ� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.855876927819724,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "07fcc26b75cdf775505addbe278046ed",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82565842141ac0501c2ad28be6f5685f9178cd0a",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduO\ufffd\ufffd\u03f4\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduO\ufffd\ufffd\u03f4\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 13:21:25 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�U����eQ��� 2�6 hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�U����eQ��� 2�6 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�U����eQ��� 2�6 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�U����eQ��� 2�6 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�U����eQ��� 2�6 hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.844338182630515,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "132dc0b1d0dac8fdf29927c8dc8ca37e",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e19b88b3d86a9318167c99ca20e6165cac34645",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdU\ufffd\ufffd\ufffd\ufffdeQ\ufffd\ufffd\ufffd2\ufffd6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdU\ufffd\ufffd\ufffd\ufffdeQ\ufffd\ufffd\ufffd2\ufffd6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 06:53:05 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�jEi\���\� �*� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�jEi\���\� �*� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |�jEi\���\� �*� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�jEi\���\� �*� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�jEi\���\� �*� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.8515463213177865,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1bacc80cf0a92ba39656cab6667a5fbc",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d94d279c0b7013c3c68c70770cd17e207ed28095",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdjEi\\\ufffd\ufffd\ufffd\\\ufffd\ufffd*\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd*\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdjEi\\\ufffd\ufffd\ufffd\\\ufffd\ufffd*\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 06:32:17 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |oCY?����ڙ~H�w�I hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |oCY?����ڙ~H�w�I hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |oCY?����ڙ~H�w�I hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|oCY?����ڙ~H�w�I hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |oCY?����ڙ~H�w�I hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.8500643563596215,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "644acfcbff25af4456fcd2a4e0617632",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55be587e9ac31d0db239df8a6a39fa97dbae80ad",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdIhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdIhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 06:11:26 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�p��o��EyX��d'N+ hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�p��o��EyX��d'N+ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�p��o��EyX��d'N+ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�p��o��EyX��d'N+ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�p��o��EyX��d'N+ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.839025326255535,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "239d1ef11e7d67bbb744ad023911a1dc",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b02009362e47394bdbe1663b5d3f204b5d6e4e6",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 05:55:45 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�䃙����o&��Gd hcurve25519-sha256,curve255…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�䃙����o&��Gd hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp3…
Payload
SSH-2.0-PUTTY |�䃙����o&��Gd hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�䃙����o&��Gd hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�䃙����o&��Gd hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.8454598823534605,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86c67427b45aba4cc8f1b8a80e554c10",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7899baccf16f2958646e78f6ce1272b72e13f6e7",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 05:24:25 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |ϭ��v�ojk�m�}� hcurve25519-sha256,curve25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |ϭ��v�ojk�m�}� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp…
Payload
SSH-2.0-PUTTY |ϭ��v�ojk�m�}� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|ϭ��v�ojk�m�}� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |ϭ��v�ojk�m�}� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.840596039589942,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b89e42e8a19b933f6860ef035aa5b84c",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31e39936cb41a85f664209a197bf9861187001e4",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd}\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd}\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
16/07/2026 04:42:35 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�6��� ���J�Q� hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�6��� ���J�Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |�6��� ���J�Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�6��� ���J�Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�6��� ���J�Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.856601715468601,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f7d613d5d310d5d4929a0bac016e79b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "069f59539574fc9be2c2f1ee21de16ba754df576",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 20:29:17 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�x�8.2�|W>��5�JS hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�x�8.2�|W>��5�JS hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�x�8.2�|W>��5�JS hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�x�8.2�|W>��5�JS hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�x�8.2�|W>��5�JS hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.83131549389031,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cced192065bf5ffd48591022a741072d",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c779545e7419af4352ba4b0bd251a5d1b6f7055",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffdx\ufffd8.2\ufffd|W>\ufffd\ufffd5\ufffdJShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 19:26:34 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |M+��h.\���d�b�� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |M+��h.\���d�b�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |M+��h.\���d�b�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|M+��h.\���d�b�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |M+��h.\���d�b�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.838330021916192,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "471b5a24317cfcd9aa809973560184ec",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ac518c7cf8c4e83b72f72414c93ad34e5f810995",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|M+\ufffd\ufffdh.\\\ufffd\ufffd\ufffdd\ufffdb\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 12:41:09 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |��r����Q(�K��Q� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |��r����Q(�K��Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |��r����Q(�K��Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|��r����Q(�K��Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |��r����Q(�K��Q� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.841926429565413,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "60539015e63f6949529056e28a2788bd",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "524675842d35a9a977210b2ad9b32ecdae51c858",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffd\u0006\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdQ(\ufffdK\ufffd\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 11:54:24 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |-Os�l-��2e}3a hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |-Os�l-��2e}3a hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |-Os�l-��2e}3a hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|-Os�l-��2e}3a hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |-Os�l-��2e}3a hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
"emulator_response_len": 39,
"bytes_in": 1423,
"payload_entropy": 4.8195356225145645,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e43e5ccd08e5a01daf3aa9840ebeb312",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2762987800c59608f89e1a29bf049e604f30cb90",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|-Os\ufffdl-\ufffd\ufffd2e}3ahcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014-\u0011O\u0002s\ufffdl-\ufffd\ufffd2e}3a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|-Os\ufffdl-\ufffd\ufffd2e}3ahcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 10:03:01 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |���4�X��h&`��~� hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |���4�X��h&`��~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |���4�X��h&`��~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|���4�X��h&`��~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |���4�X��h&`��~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.852427594157005,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "081cc44235a65505101f7e505e1284a2",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f9f1a2b804401dbdaf83f370154bc0987e13f3a",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd4\ufffdX\ufffd\ufffdh&`\ufffd\ufffd~\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd\ufffd\ufffd4\ufffdX\ufffd\u0015\ufffdh&`\ufffd\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd\ufffd\ufffd4\ufffdX\ufffd\ufffdh&`\ufffd\ufffd~\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 03:58:10 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�{Xd #<,�CR pZf hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�{Xd #<,�CR pZf hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |�{Xd #<,�CR pZf hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�{Xd #<,�CR pZf hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�{Xd #<,�CR pZf hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1423,
"payload_entropy": 4.8370843893624125,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "102519badc3893de7fa5ec62d541093c",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca1ca30ea92cc6e472b09c54d76586035f603c4f",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd{Xd#<,\ufffdCRpZfhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\ufffd{\u000eXd\u001f#<,\ufffdCR\u001epZf\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd{Xd#<,\ufffdCRpZfhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 03:01:31 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |�,d�ܭZ�P. hcurve25519-sha256,curve2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |�,d�ܭZ�P. hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…
Payload
SSH-2.0-PUTTY |�,d�ܭZ�P. hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|�,d�ܭZ�P. hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |�,d�ܭZ�P. hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1423,
"payload_entropy": 4.837935040959767,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9e0b94d972090a13af732a29aee6748b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aba6fcb9ad85c331257f0d3fc2d71cc596f4884d",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd,d\ufffd\u072dZ\ufffdP.hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014\u0016\ufffd,d\ufffd\u0004\u072dZ\ufffd\u0019P\u001a.\u0016\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|\ufffd,d\ufffd\u072dZ\ufffdP.hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}
15/07/2026 00:47:39 UTC
TCP
22 · SSH
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-PUTTY |M�^ ��C��M���� U hcurve25519-sha256,curve…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-PUTTY |M�^ ��C��M���� U hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis…
Payload
SSH-2.0-PUTTY |M�^ ��C��M���� U hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Client SSH libssh/paramiko (scanner)
pat-0389
pat-0391
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PuTTY SSH client
SSH-2.0 banner RFC4253
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-PUTTY
|M�^ ��C��M���� U hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
Requête brute (extrait)
SSH-2.0-PUTTY |M�^ ��C��M���� U hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1423,
"payload_entropy": 4.850140839940414,
"port_category": "well_known",
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"service": "ssh",
"app_proto": "ssh",
"asn": 215930,
"country": "IR",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"matched_patterns": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"matched_pattern_names": [
"PuTTY SSH client",
"SSH-2.0 banner RFC4253",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0389",
"pat-0391",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "IR",
"asn": 215930,
"org": "Cipher Operations Doo Beograd - Novi Beograd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "499a7759c12fa6b32b8f479860ac116f",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"evidence": {
"request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman",
"payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "486e9dfa810b2a837985883c97b51d5195d069a7",
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-PUTTY\r\n|M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdUhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0389",
"pat-0391",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0389",
"pat-0391",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005|\u0005\u0014M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffd\u001cU\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-PUTTY\r\n|M\ufffd^ \ufffd\ufffdC\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdUhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
]
}