Détails IP 62.60.130.219

Synthèse exécutive

Profil de menace

Score de risque —

Première observation 29/06/2026 04:48 UTC

Dernière observation 18/07/2026 21:59 UTC

Événements (période) 201

MITRE ATT&CK principal —

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

ssh_probe

Comparaison ASN / FAI

ASN 215930 · 62.60.130.0/24 · RIPENCC — 5 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 201 événements sur la période pour cette IP.

62.60.130.237 Sonde HTTP 18/07/2026 15:50 UTC
62.60.130.29 Sonde SMTP 21/02/2026 11:13 UTC
62.60.130.243 Sonde SMTP 16/01/2026 18:43 UTC
62.60.130.235 Sonde SMTP 08/01/2026 09:52 UTC
62.60.130.5 tcp 06/01/2026 11:34 UTC

IPs apparentées

Même FAI Cipher Operations Doo Beograd - Novi Beograd — corrélation indicative.

62.60.130.237 Sonde HTTP
62.60.130.29 Sonde SMTP
62.60.130.243 Sonde SMTP
62.60.130.235 Sonde SMTP
62.60.130.5 tcp

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

201 événement(s) — page 1/5

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 21:59:03 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��HU��<&<Jhcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��HU��<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|��HU��<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��HU��<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��HU��<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.847595295760167, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c80845d728470c7a046a88e9d0733bbf", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "11ec9442b5da87ea378bc17e86e620f6747b0d06", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffdHU\ufffd\ufffd\ufffd<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\ufffd\ufffd\ufffd\u001fHU\ufffd\ufffd\ufffd<&<J\u001a\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffdHU\ufffd\ufffd\ufffd<&<Jhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 21:44:05 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�nQ&�?��0��^y�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�nQ&�?��0��^y�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�nQ&�?��0��^y�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�nQ&�?��0��^y�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�nQ&�?��0��^y�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.844006327701735, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "02b28852b4021e023f8db9ea3cd66c85", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "57a40c4cdd8683dbb2af17623aed654ba6c794aa", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffd\u000e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdnQ&\ufffd?\ufffd\ufffd\ufffd0\ufffd\ufffd^y\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 21:13:17 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�y�)>T��_a��hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�y�)>T��_a��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|�y�)>T��_a��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�y�)>T��_a��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�y�)>T��_a��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.847266028377079, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ea4f166f1d6acf9fe133cdfef4903fde", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "310214446c4e7f9307e261ef2f677af1c506e751", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdy\ufffd)>T\ufffd\ufffd\ufffd\ufffd\ufffd_a\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 21:02:59 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�6�<�=�0��W��(hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�6�<�=�0��W��(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�6�<�=�0��W��(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�6�<�=�0��W��(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�6�<�=�0��W��(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.846252630078531, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "818405b610cac2f2617da7d6ee770588", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4ff37d36614a54a77f7da3b98621685853894b6a", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd6\ufffd<\ufffd=\ufffd0\ufffd\ufffdW\ufffd\ufffd(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0000\ufffd6\ufffd<\ufffd=\ufffd0\u0004\ufffd\ufffdW\ufffd\ufffd(\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd6\ufffd<\ufffd=\ufffd0\ufffd\ufffdW\ufffd\ufffd(hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 20:11:34 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|1��7@$oZ�?�i��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|1��7@$oZ�?�i��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|1��7@$oZ�?�i��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|1��7@$oZ�?�i��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|1��7@$oZ�?�i��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.8401079174201085, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1e3cad11a40fb6fe5c037eb52479886", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c8ba6cf3b2940106a5e3b7e4f5a06b34da8b2ec9", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|1\ufffd\ufffd7@$oZ\ufffd?\ufffdi\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00141\u0005\ufffd\ufffd7@$o\u0015Z\ufffd?\ufffdi\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|1\ufffd\ufffd7@$oZ\ufffd?\ufffdi\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 19:35:26 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|Q��d��~6u֛-�~hcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|Q��d��~6u֛-�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|Q��d��~6u֛-�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|Q��d��~6u֛-�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|Q��d��~6u֛-�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.837032767418441, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f464f58ce3c603e9c3ace3c7f720161d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f2785a0c554a3f297e36eb282e1d0a19652bfa14", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b-\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b\b-\ufffd~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|Q\ufffd\ufffdd\ufffd\ufffd~6u\u059b-\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 19:30:18 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|C��s��,(O�G�$Dhcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|C��s��,(O�G�$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|C��s��,(O�G�$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|C��s��,(O�G�$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|C��s��,(O�G�$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.844453776784976, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "30e74a9d0199f62ca0e63655a254529e", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e1393b6a11c230ba1eadd9900f1bc5f22fcc744", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$D\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|C\ufffd\ufffd\ufffds\ufffd\ufffd,(O\ufffdG\ufffd$Dhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 15:53:32 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|E��md{r��^�7�phcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|E��md{r��^�7�phcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|E��md{r��^�7�phcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|E��md{r��^�7�phcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|E��md{r��^�7�phcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.84043140976122, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "78cf33f14eee83bc32e5eb97c7f089fc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4e41b5c4764092c47ebcbc2eaa3d790abb0da1c0", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|E\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdphcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u001fE\u000e\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdp\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|E\ufffd\ufffdmd{r\ufffd\ufffd^\ufffd7\ufffdphcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 15:38:02 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��`� \|WN�e��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��`� \|WN�e��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��`� \|WN�e��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header PuTTY SSH client SSH-2.0 banner RFC4253 ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��`� \|WN�e��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��`� \|WN�e��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.83927412195538, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0348", "pat-0389", "pat-0391", "pat-0868", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "PuTTY SSH client", "SSH-2.0 banner RFC4253", "ET H.323 setup", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0389", "pat-0391", "pat-0868", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ec6fd1862ad6ad85823698bfdb5c3a4e", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "48219206b8ac1d8a08433e9e4eca973054dcfba6", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd`\ufffd\r\|WN\ufffde\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u0000\ufffd`\ufffd\r\|WN\ufffde\ufffd\u0000\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd`\ufffd\r\|WN\ufffde\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 15:22:40 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��(Ǣk4�]�X�5hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��(Ǣk4�]�X�5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|��(Ǣk4�]�X�5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��(Ǣk4�]�X�5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��(Ǣk4�]�X�5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.837663151301947, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "afdb1ce857c7c2577f09af83baef6e63", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d9d32a70845c1cd782cf36bae7a9c26eae92a15", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd(\u01e2k4\ufffd]\ufffdX\ufffd5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd(\u01e2k\u0001\u00054\ufffd]\ufffdX\ufffd5\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd(\u01e2k4\ufffd]\ufffdX\ufffd5hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 15:17:26 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��A�N�� U��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��A�N�� U��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��A�N�� U��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��A�N�� U��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��A�N�� U��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.847732616956547, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c710cbd7b4fa1865eadda43bfba15dbd", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "66a2027c62c3532245142a237ee7bd7c607a01d9", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdA\ufffdN\ufffd\ufffd\ufffd\n\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 15:12:14 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��*8��EbP�y<�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��8��EbP�y<�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��8��EbP�y<�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��8��EbP�y<�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��8��EbP�y<�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.842432628245259, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9af38d069c2fc826029d6c2e851d6101", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "532312f730a61d508957b892ecb36429566e3810", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd8\ufffd\ufffdEbP\ufffdy<\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd8\ufffd\ufffd\u0011EbP\u0012\ufffdy<\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd*8\ufffd\ufffdEbP\ufffdy<\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 13:54:36 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��6�~}k��f<u�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��6�~}k��f<u�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��6�~}k��f<u�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��6�~}k��f<u�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��6�~}k��f<u�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.836652221183077, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bb11ecedbd17886e5da05080f1403e23", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b8d27ce0d7e9f07ddabc85bdee33221e1f45d8a6", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd6\ufffd~}k\ufffd\ufffd\ufffdf<u\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u001c6\ufffd~}k\ufffd\ufffd\ufffdf\u0005<u\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd6\ufffd~}k\ufffd\ufffd\ufffdf<u\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "behavior_alert_count": 1, "behavior_priority": 84 }
18/07/2026 13:49:28 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|ʣ�\|=2�I��ڬhcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|ʣ�\|=2�I��ڬhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|ʣ�\|=2�I��ڬhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|ʣ�\|=2�I��ڬhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|ʣ�\|=2�I��ڬhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.852661950933548, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "58ac454bb7d80da76a372158e98538c6", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4482200214c83aba87b31530e0c239646316ed32", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u02a3\ufffd\|=2\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06achcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u02a3\ufffd\|=2\u001b\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06ac\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u02a3\ufffd\|=2\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\u06achcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 12:45:57 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��N��>6*y\|J\|hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��N��>6y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��N��>6y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��N��>6y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��N��>6y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.845976687022527, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "411ef998af3854747e5859914835d55b", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7fe9696e7a5c079a3009e1336f2dcdadbc35b55e", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6y\|J\|\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd>6*y\|J\|hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 11:53:51 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|⩚g`膪�}XJ[�hcurve25519-sha256,curve2551… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|⩚g`膪�}XJ[�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp38… Payload SSH-2.0-PUTTY \|⩚g`膪�}XJ[�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|⩚g`膪�}XJ[�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|⩚g`膪�}XJ[�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.855111309180342, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "97032a6cd125ceda7a324bbdf5de4ae2", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ae91e434d020b8a69f4399ad73204ab0ca1ce74d", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u2a5ag`\u81aa\ufffd}XJ[\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u2a5ag`\u81aa\ufffd}\u0017\u001eXJ[\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u2a5ag`\u81aa\ufffd}XJ[\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 11:48:38 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \| %��a�E�d�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \| %��a�E�d�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \| %��a�E�d�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \| %��a�E�d�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \| %��a�E�d�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.842971661439484, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "77a04277b21e07bc02086886e399e733", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "41b5e68354ec8b06fa64eef68360a68f23c20c65", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\r%\ufffd\ufffd\ufffd\ufffda\ufffdE\ufffdd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011\u0011\r%\ufffd\ufffd\ufffd\ufffda\ufffd\u0011E\u001d\ufffdd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\r%\ufffd\ufffd\ufffd\ufffda\ufffdE\ufffdd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 11:12:05 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|K�M�S=U�i`k�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|K�M�S=U�i`k�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|K�M�S=U�i`k�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|K�M�S=U�i`k�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|K�M�S=U�i`k�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.836717367197503, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "09d649e15591174ccf42629032820b22", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4453921e467352dde25571959978c7aaaa093bee", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|K\ufffdM\ufffdS=U\ufffdi`k\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014K\ufffd\u0000\u0010M\ufffdS=U\b\u0005\ufffdi`k\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|K\ufffdM\ufffdS=U\ufffdi`k\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 06:12:49 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|����>�(� hcurve25519-sha256,curve255… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp3… Payload SSH-2.0-PUTTY \|����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|����>�(� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.849951868779991, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "368a45004861bf945597ee1a07683909", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b57c20aab8855a89131c30a26e7ca98b217da533", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\rhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u0010\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\r\f\u0015\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\uf011\ufffd\ufffd\ufffd>\ufffd(\ufffd\rhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 05:20:43 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|I��f�^�x��Nhcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|I��f�^�x��Nhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|I��f�^�x��Nhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|I��f�^�x��Nhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|I��f�^�x��Nhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.852443622075373, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3364ba461f44b3b9313c9b74f3069f3", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "efce0b2f5c7705fdfed1d8575f5f947dbe2f6ed7", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd^\ufffdx\ufffd\ufffdNhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0001\ufffd^\ufffdx\ufffd\ufffdN\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|I\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd^\ufffdx\ufffd\ufffdNhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
18/07/2026 04:54:33 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|lL�� V�Jx�b�f��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|lL�� V�Jx�b�f��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|lL�� V�Jx�b�f��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|lL�� V�Jx�b�f��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|lL�� V�Jx�b�f��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.846869311842255, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f10ec370814572351f4bbaecb532c66b", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5853bf6162f7aa393a09249470dda1742c10937d", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|lL\ufffd\ufffd\ufffd V\ufffdJx\ufffdb\ufffdf\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 20:38:04 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��Y �n9�c��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��Y �n9�c��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��Y �n9�c��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��Y �n9�c��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��Y �n9�c��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.8427265247294065, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d94279d9268df96d732903eca6f8c06", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0d34986018c95871b2b0b84a38f10cb79245cb30", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffdn9\ufffdc\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffd\u0007n9\ufffd\u0013c\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd\ufffdY \ufffdn9\ufffdc\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 20:22:11 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|m�[��C �Q�朥�~hcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|m�[��C �Q�朥�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|m�[��C �Q�朥�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|m�[��C�Q�朥�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|m�[��C �Q�朥�~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.854356639204722, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f14d61d740cd25286ccc050ee5a448b", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07db8186091844e397625fee735cd240f38b955c", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|m\ufffd[\ufffd\ufffdC\ufffdQ\ufffd\u6725\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014m\ufffd[\ufffd\ufffdC\u000b\ufffdQ\ufffd\u6725\ufffd\u0002~\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|m\ufffd[\ufffd\ufffdC\ufffdQ\ufffd\u6725\ufffd~hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 19:33:52 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�pp�Y��nt��L�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�pp�Y��nt��L�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�pp�Y��nt��L�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�pp�Y��nt��L�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�pp�Y��nt��L�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.835442324663536, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "58effb708c141d022275738176363787", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bce1febb7a7ffc78b2089e7c70a93fd2a68d3ee4", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdpp\ufffdY\ufffd\ufffdnt\ufffd\ufffdL\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdpp\u001a\u0013\ufffdY\ufffd\ufffdnt\ufffd\u000f\ufffdL\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdpp\ufffdY\ufffd\ufffdnt\ufffd\ufffdL\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 19:27:09 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��q�q.j:��!�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��q�q.j:��!�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��q�q.j:��!�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��q�q.j:��!�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��q�q.j:��!�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.845606627596731, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5d361d91ace443c9bd6e300daee77cad", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a9b891c4da8fb0106e932338606b318522e55d4", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffdq\ufffdq.j:\ufffd\ufffd\ufffd!\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\u0014q\ufffdq.j:\ufffd\ufffd\ufffd!\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffdq\ufffdq.j:\ufffd\ufffd\ufffd!\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 18:30:52 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|� ;�SR}g"��.?hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|� ;�SR}g"��.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|� ;�SR}g"��.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|� ;�SR}g"��.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|� ;�SR}g"��.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.849369545380801, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a08b94a70c9dc18bd38a458c03857edc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b07f6bb289abfcf32ee68a6232ffe365e1acb953", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\n;\ufffdSR}g\"\ufffd\ufffd\ufffd\ufffd.?hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 17:38:45 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��?��V �ZJ;�a��ghcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��?��V �ZJ;�a��ghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��?��V �ZJ;�a��ghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��?��V �ZJ;�a��ghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��?��V �ZJ;�a��ghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.84606361399407, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "430f4eae8f7f238312423138ebef0063", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8b8e5934eb597e3cb4bfd6ed104058c5d68b0263", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdg\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd?\ufffd\ufffdV\n\ufffdZJ;\ufffda\ufffd\ufffdghcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 16:20:51 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|[��(Ƥ ��D�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|[��(Ƥ ��D�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|[��(Ƥ ��D�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|[��(Ƥ ��D�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|[��(Ƥ ��D�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.853746658793475, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "50d01ba9810599f4427af48c9c3de0d9", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "53f25f35525b777a884c8d9299c0de54668e7911", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|[\ufffd\ufffd(\u01a4\n\ufffd\ufffd\ufffdD\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014[\ufffd\ufffd\u001e(\u01a4\u000f\u0013\n\u0014\ufffd\ufffd\ufffdD\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|[\ufffd\ufffd(\u01a4\n\ufffd\ufffd\ufffdD\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 16:03:44 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|� �V`��{�ߏ tk�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|� �V`��{�ߏ tk�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|� �V`��{�ߏ tk�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|� �V`��{�ߏ tk�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|� �V`��{�ߏ tk�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.85198168645638, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "82c0748e9f44a4d44f178ca63ea1ddd7", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "306875552610945454215b8490171b1791115ca6", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\ttk\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\t\u0012tk\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\r\ufffdV`\ufffd\ufffd{\ufffd\u07cf\ttk\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 12:52:31 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�l�W�2q�R��hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�l�W�2q�R��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|�l�W�2q�R��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�l�W�2q�R��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�l�W�2q�R��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.845925106670515, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "075057d941b50d121ae45453157738ce", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd96586479b0c9ddbf141fa9f654ad33c797fec0", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdl\ufffdW\ufffd2q\ufffdR\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0010\ufffdl\ufffdW\u0001\ufffd2\u001aq\ufffdR\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdl\ufffdW\ufffd2q\ufffdR\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 12:26:15 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|o9W��Ϸ��i��9hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|o9W��Ϸ��i��9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|o9W��Ϸ��i��9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|o9W��Ϸ��i��9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|o9W��Ϸ��i��9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.836974892327002, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b64547dcba017136bafd5b449751b14b", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b4cb73e74ade76443a2fb0d0150f73fe648614c", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffd\u0007i\ufffd\ufffd\ufffd9\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|o9W\ufffd\ufffd\u03f7\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd9hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 12:04:56 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�� (�2��ب�p�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�� (�2��ب�p�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|�� (�2��ب�p�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��(�2��ب�p�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�� (�2��ب�p�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.841910347637305, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8144bb40f72fd23afe901af7968178f", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9219a55cf06533a5eccdf7f6f3c7903eb1fab6a", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\ufffdp\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\f\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\u001d\ufffdp\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd(\ufffd2\ufffd\ufffd\u0628\ufffdp\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 11:28:25 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|%3_�z3V\�U�v{�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|%3_�z3V\�U�v{�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|%3_�z3V\�U�v{�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|%3_�z3V\�U�v{�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|%3_�z3V\�U�v{�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.848381919994971, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c25dc30700b91d152a84488cc4843c05", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9964b0e83d5ec25e4fdf1400ffa76db5572b5593", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|%3_\ufffdz3V\\\ufffdU\ufffdv{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014%3_\ufffdz3V\\\ufffdU\ufffdv\u0006{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|%3_\ufffdz3V\\\ufffdU\ufffdv{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 09:05:15 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��ًw��J�;V��L"hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��ًw��J�;V��L"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|��ًw��J�;V��L"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��ًw��J�;V��L"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��ًw��J�;V��L"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.860772080457562, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e22f016351fad3f271e5009413966001", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dfbdc6de9a61569f49069b558e2b14e9d0194c69", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\u064bw\ufffd\ufffd\ufffdJ\ufffd;V\ufffd\ufffdL\"hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 08:54:51 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|&��o��j�hcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|&��o��j�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|&��o��j�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|&��o��j�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|&��o��j�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.847341726014627, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c2d5e89be81b28253297524ac97f38b5", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a26c92b5fd1c8edec9d005b284a8c46c766e176", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|&\ufffd\ufffdo\ufffd\ufffd\ufffdj\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014&\ufffd\ufffdo\ufffd\ufffd\u0010\u0001\u001a\ufffdj\ufffd\u001e\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|&\ufffd\ufffdo\ufffd\ufffd\ufffdj\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 08:18:18 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��N�3�q� ��o �hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��N�3�q� ��o �hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��N�3�q� ��o �hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��N�3�q��o �hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��N�3�q� ��o �hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.850134535888863, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7fd6abbe0a7ead409cb69107a8f4fc4a", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "996d30d4e3c48183218b69c831a965628545b4b4", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffdN\ufffd3\ufffdq\ufffd\ufffd\ufffdo\r\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffdN\ufffd3\ufffd\u001dq\ufffd\f\ufffd\ufffdo\r\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffdN\ufffd3\ufffdq\ufffd\ufffd\ufffdo\r\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 07:20:49 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|h$��{�i��N��hcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|h$��{�i��N��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|h$��{�i��N��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|h$��{�i��N��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|h$��{�i��N��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.8506895525379985, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a7ad14c3c5a5f78439f5912db9998e40", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e50ff1a9ba51f0a28ae44303362656775adbc224", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|h$\ufffd\ufffd\u0093{\ufffdi\ufffd\ufffdN\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 07:10:10 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��,��P�hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��,��P�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��,��P�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��,��P�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��,��P�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.852326723694155, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6c27fda5b6c9b01c1935a582a87cf4d4", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25c91c05730f69317468fed2c7da10c023eb9801", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdP\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\u0001\ufffdP\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdP\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
17/07/2026 00:10:20 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|*3��E��r�21��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|3��E��r�21��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|3��E��r�21��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|3��E��r�21��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|3��E��r�21��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.839454448563342, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e4221048afb854b51d5dece7b1622ab0", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9881030231f69f5eb6c7f1639e4bddf363e86efe", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|3\ufffd\ufffdE\ufffd\ufffd\ufffdr\ufffd21\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u00143\ufffd\ufffdE\ufffd\ufffd\ufffd\u001ar\ufffd21\ufffd\ufffd\u0010\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|*3\ufffd\ufffdE\ufffd\ufffd\ufffdr\ufffd21\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 22:04:14 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|;3b��է;֚�H�khcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|;3b��է;֚�H�khcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|;3b��է;֚�H�khcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|;3b��է;֚�H�khcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|;3b��է;֚�H�khcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.844009645012764, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "36fba4d533c033be7a60f5fdd3221332", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b436982e2ac811cf89fc003be9647f5b214c44c", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffdH\ufffdkhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffd\u000fH\ufffdk\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|;3b\ufffd\ufffd\ufffd\u0567;\u059a\ufffdH\ufffdkhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 15:22:40 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|��Naj��uM#��hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|��Naj��uM#��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|��Naj��uM#��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|��Naj��uM#��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|��Naj��uM#��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a", "emulator_response_len": 39, "bytes_in": 1423, "payload_entropy": 4.843170630368789, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ab17a68bd5bf0dbd0a4f34b7f0ec85cc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4fb74bdac2c5c922373a34a590907bc2249927c3", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdNaj\ufffd\ufffduM#\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\ufffdNaj\ufffd\u0019\ufffd\u0015uM#\u0001\ufffd\u001c\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\ufffdNaj\ufffd\ufffduM#\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 13:58:20 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|>��uO��ϴ�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|>��uO��ϴ�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|>��uO��ϴ�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|>��uO��ϴ�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|>��uO��ϴ�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.855876927819724, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "07fcc26b75cdf775505addbe278046ed", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "82565842141ac0501c2ad28be6f5685f9178cd0a", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduO\ufffd\ufffd\u03f4\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u0011>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\u0017O\ufffd\ufffd\u03f4\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduO\ufffd\ufffd\u03f4\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 13:21:25 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�U��eQ��2�6hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�U��eQ��2�6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�U��eQ��2�6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�U��eQ��2�6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�U��eQ��2�6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.844338182630515, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "132dc0b1d0dac8fdf29927c8dc8ca37e", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e19b88b3d86a9318167c99ca20e6165cac34645", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdU\ufffd\ufffd\ufffd\ufffdeQ\ufffd\ufffd\ufffd2\ufffd6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdU\ufffd\ufffd\u0007\ufffd\ufffdeQ\ufffd\ufffd\ufffd\u001d2\ufffd6\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdU\ufffd\ufffd\ufffd\ufffdeQ\ufffd\ufffd\ufffd2\ufffd6hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 06:53:05 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�jEi\��\��*�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�jEi\��\���hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|�jEi\��\���hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�jEi\��\���hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�jEi\��\���hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.8515463213177865, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1bacc80cf0a92ba39656cab6667a5fbc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d94d279c0b7013c3c68c70770cd17e207ed28095", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdjEi\\\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdjE\u0017i\\\ufffd\ufffd\ufffd\\\ufffd\u001e\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdjEi\\\ufffd\ufffd\ufffd\\\ufffd\ufffd*\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 06:32:17 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|oCY?��ڙ~H�w�Ihcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|oCY?��ڙ~H�w�Ihcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|oCY?��ڙ~H�w�Ihcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|oCY?��ڙ~H�w�Ihcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|oCY?��ڙ~H�w�Ihcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.8500643563596215, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "644acfcbff25af4456fcd2a4e0617632", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "55be587e9ac31d0db239df8a6a39fa97dbae80ad", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdIhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdI\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|oCY?\ufffd\ufffd\ufffd\ufffd\u0699~H\ufffdw\ufffdIhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 06:11:26 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�p��o��EyX��d'N+hcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�p��o��EyX��d'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�p��o��EyX��d'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�p��o��EyX��d'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�p��o��EyX��d'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.839025326255535, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "239d1ef11e7d67bbb744ad023911a1dc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b02009362e47394bdbe1663b5d3f204b5d6e4e6", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdp\ufffd\ufffdo\ufffd\ufffdEyX\ufffd\ufffdd'N+hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 05:55:45 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�䃙��΂o&��Gdhcurve25519-sha256,curve255… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�䃙��΂o&��Gdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp3… Payload SSH-2.0-PUTTY \|�䃙��΂o&��Gdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�䃙��΂o&��Gdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�䃙��΂o&��Gdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1423, "payload_entropy": 4.8454598823534605, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "86c67427b45aba4cc8f1b8a80e554c10", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7899baccf16f2958646e78f6ce1272b72e13f6e7", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd\u40d9\ufffd\ufffd\ufffd\ufffd\u0382o&\ufffd\ufffdGdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 05:24:25 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|ϭ��v�ojk�m�}�hcurve25519-sha256,curve25… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|ϭ��v�ojk�m�}�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp… Payload SSH-2.0-PUTTY \|ϭ��v�ojk�m�}�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|ϭ��v�ojk�m�}�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|ϭ��v�ojk�m�}�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.840596039589942, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b89e42e8a19b933f6860ef035aa5b84c", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "31e39936cb41a85f664209a197bf9861187001e4", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd}\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd\u0005}\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\u03ed\ufffd\ufffdv\ufffdojk\ufffdm\ufffd}\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
16/07/2026 04:42:35 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�6�� J�Q�hcurve25519-sha256,curve2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�6�� J�Q�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist… Payload SSH-2.0-PUTTY \|�6�� J�Q�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�6�� J�Q�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�6�� J�Q�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1423, "payload_entropy": 4.856601715468601, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7f7d613d5d310d5d4929a0bac016e79b", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "069f59539574fc9be2c2f1ee21de16ba754df576", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffd\u000e6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffd\u0017Q\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffd6\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffdJ\ufffdQ\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }
15/07/2026 20:29:17 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-PUTTY \|�x�8.2�\|W>��5�JShcurve25519-sha256,curve… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-PUTTY \|�x�8.2�\|W>��5�JShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis… Payload SSH-2.0-PUTTY \|�x�8.2�\|W>��5�JShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0389 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PuTTY SSH client SSH-2.0 banner RFC4253 TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-PUTTY \|�x�8.2�\|W>��5�JShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec Requête brute (extrait) SSH-2.0-PUTTY \|�x�8.2�\|W>��5�JShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a", "emulator_response_len": 41, "bytes_in": 1423, "payload_entropy": 4.83131549389031, "port_category": "well_known", "org": "Cipher Operations Doo Beograd - Novi Beograd", "service": "ssh", "app_proto": "ssh", "asn": 215930, "country": "IR", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0389", "pat-0391", "pat-0536" ], "matched_pattern_names": [ "PuTTY SSH client", "SSH-2.0 banner RFC4253", "TFTP RRQ" ], "pattern_ids": [ "pat-0389", "pat-0391", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IR", "asn": 215930, "org": "Cipher Operations Doo Beograd - Novi Beograd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cced192065bf5ffd48591022a741072d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "evidence": { "request_sample": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman", "payload_snippet": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8c779545e7419af4352ba4b0bd251a5d1b6f7055", "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0389", "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0389", "pat-0391", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "payload_preview": "SSH-2.0-PUTTY\r\n\u0000\u0000\u0005\|\u0005\u0014\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJS\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-PUTTY\r\n\|\ufffdx\ufffd8.2\ufffd\|W>\ufffd\ufffd5\ufffdJShcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ] }

62.60.130.219

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence