Méthode
OPTIONS
Port
5060
Chemin / cible
sip:62.3.50.33:5060
Confiance classification
92%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
OPTIONS / HTTP/1.1
User-Agent
Asterisk PBX
Règles WAF
950318:lfi-14
950326:rce-0
950382:rce-14
950470:nosqli-3
Payload (extrait)
OPTIONS sip:62.3.50.33:5060 SIP/2.0
Via: SIP/2.0/TCP 81.16.177.200:15617;branch=z9hG4bK3fc072dcb286436c9e88e56505d18aeb;rport
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33:5060",
"http_ua_hash": "ce207c59267a635b306413fc472297f88648418f",
"http_host_hash": null,
"http_target_hash": "798e38d7545b0e7b6561ac7162b981eb0969a3f7",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 374,
"payload_entropy": 5.427368471916497,
"port_category": "registered",
"org": "PebbleHost Ltd",
"service": "http",
"app_proto": "http",
"asn": 212027,
"country": "GB",
"dst_port": 5060,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "17a9335371f674add033e71c57db4b89f4dc52de",
"event_fingerprint": "e07f670aa764ffb6d966cf47c4072b512e601a00",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "GB",
"asn": 212027,
"org": "PebbleHost Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "30586fec1dff35e44e38dd1673d21d18",
"payload_hash": "c01d0561229af3ac9255da17a55bdfc4",
"path_pattern_hash": "ab15fc5eaa8a1dcb5d9622a2cdea3004"
},
"target_context": {
"dst_port": 5060,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 0.92,
"classification_confidence": 0.92,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "OPTIONS sip:62.3.50.33:5060 SIP\/2.0\r\nVia: SIP\/2.0\/TCP 81.16.177.200:15617;branch=z9hG4bK3fc072dcb286436c9e88e56505d18aeb;rport\r\n",
"event_signature": "0b33fd82530fee85671ce3757190cb9322a49be5",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3"
]
}
|
Méthode
OPTIONS
Port
5060
Chemin / cible
sip:62.3.50.33:5060
Ligne de requête
OPTIONS / HTTP/1.1
User-Agent
Asterisk PBX
Règles WAF
950318:lfi-14
950326:rce-0
950382:rce-14
950470:nosqli-3
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "33:5060",
"http_ua_hash": "ce207c59267a635b306413fc472297f88648418f",
"http_host_hash": null,
"http_target_hash": "798e38d7545b0e7b6561ac7162b981eb0969a3f7",
"http_referer_hash": null,
"http_method": "OPTIONS",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 374,
"payload_entropy": 5.453375932139075,
"port_category": "registered",
"org": "PebbleHost Ltd",
"service": "http",
"app_proto": "http",
"asn": 212027,
"country": "GB",
"tag_count": 4,
"anomaly_count": 0,
"risk_score": 100,
"campaign_key": "17a9335371f674add033e71c57db4b89f4dc52de",
"event_fingerprint": "e07f670aa764ffb6d966cf47c4072b512e601a00",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3"
]
}
|