Méthode
—
Port
22
Chemin / cible
—
Confiance classification
68%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-OpenSSH
Meta JSON brut
{
"bytes_in": 17,
"payload_entropy": 3.381580488309164,
"port_category": "well_known",
"org": "PIO-Hosting GmbH",
"service": "ssh",
"app_proto": "ssh",
"asn": 198584,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 30,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 30,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 19,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "4a67c8cb1e29b5e39a79acd012734536b5a2b497",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "58890344d4d66357021038319740ebe6",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"confidence": 0.68,
"classification_confidence": 0.68,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "SSH-2.0-OpenSSH\r\n",
"event_signature": "30a1d8e79d67f844921f26aa7608ea01dc3326ae",
"ban_policy": "advisory_monitor",
"tags_list": [
"ssh_banner"
],
"asn_dc_heuristic": true
}
|