|
|
TCP |
1026 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:1026 · (sonde / probe)
|
Moyenne
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 8c5b2f378e481f94
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1026
Chemin / cible
—
Service
TLS
Payload
� ��t[�К��Q���< �뜥U�e��N_]r� A��Q���y���q�Ȭ��f�' �FZ(7 �+�/�,�0̨̩� �� � y �
Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��t[�К��Q���< �뜥U�e��N_]r� A��Q���y���q�Ȭ��f�'
�FZ(7 �+�/�,�0̨̩� ��
� y �
Requête brute (extrait)
� ��t[�К��Q���< �뜥U�e��N_]r� A��Q���y���q�Ȭ��f�' �FZ(7 �+�/�,�0̨̩� �� � y � � 2 h2http/1.1 + 3���
Meta JSON brut
{"tls_ja3_hash":"8c5b2f378e481f94b4f82c131798f4d4","tls_sni":null,"tls_alpn":["h2","http\/1.1"],"bytes_in":1509,"payload_entropy":7.72507156091301,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"tls","app_proto":"tls","asn":45102,"country":"DE","dst_port":1026,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.2,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":24,"tag_count":2,"anomaly_count":0,"campaign_key":"e596ca85df74ce6534987df456dc3f634bf6364c","event_fingerprint":"1d1a68b6528bd0d13106abe4c556f7dae11a2e5d","classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"8c5b2f378e481f94b4f82c131798f4d4","payload_hash":"82393685939cbf6910635a71b2fde807","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c"},"target_context":{"dst_port":1026,"service":"tls","servi…
|
|
|
TCP |
1026 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:1026 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
JA3 19e29534fd49dd27
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1026
Chemin / cible
—
Service
TLS
Payload
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �I����i�Y���e-�Ud]��b8�g��9dZ8f g��i���˰�Nֽ�g|p��<Z��T��8'O; &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �<'�Vʑ�t���m-�߅��@���+33�:�H
Meta JSON brut
{"tls_ja3_hash":"19e29534fd49dd27d09234e639c4057e","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":4,"bytes_in":243,"payload_entropy":5.917995008383122,"port_category":"registered","org":"Alibaba (US) Technology Co., Ltd.","service":"tls","app_proto":"tls","asn":45102,"country":"DE","dst_port":1026,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":1.5,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":24,"tag_count":3,"anomaly_count":0,"campaign_key":"b2ed0d8fb54aebc27078ba250fda13453ebbec8f","event_fingerprint":"3bf195431e4ad164c267ca9e22ce3915695eb07a","classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":24},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":45102,"org":"Alibaba (US) Technology Co., Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"19e29534fd49dd27d09234e639c4057e","payload_hash":"f92e510aaeca6871a90045d62102af72","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c","ja4":"7b5e3a15097abc10f88e98257ea5101…
|