|
|
TCP |
3600 · SAP Message Server
|
sap-ms
|
Cross-site scripting
xss attack · via SAP Message Server:3600 · (tentative d'exploit)
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-MS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_message_server
sap_message_server
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3600
Chemin / cible
—
Service
SAP Message Server
Payload
GET / HTTP/1.1 Host: 62.3.50.33:3600 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 44
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3600
Connection: close
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3600 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"00000000534150000000000000000000000000","emulator_response_len":19,"bytes_in":258,"payload_entropy":5.4203049729056865,"port_category":"registered","org":"ONYPHE SAS","service":"sap-ms","app_proto":"sap-ms","asn":213412,"country":"FR","dst_port":3600,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":48,"risk_novelty":25,"risk_boost":20,"risk_granularity":2.7,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":48,"novelty":25},"risk_score":44,"tag_count":6,"anomaly_count":0,"campaign_key":"eb8129e9d97444f0cd63f606424d4263f3fbd29d","event_fingerprint":"8c06cdcabd30598babf31af408e531814b67291c","classification_reason":"Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%","confidence":0.59,"classification_confidence":0.59,"precision_score":70,"precision_signals":["pat-0284"],"kb_rule_ids":["pat-0284"],"matched_patterns":["pat-0284"],"matched_pattern_names":["CRS 941130"],"pattern_ids":["pat-0284"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":48,"novelty":25,"risk_score":44},"named_classification_skipped":false,"service_name":"sap-ms","risk_confidence_factor":59,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"FR","asn":213412,"org":"ONYPHE SAS","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"f5b89c08913f212d66ecd2b519bbf7a9","path_pattern_hash":"e84c630ed8a3a6084c1…
|
|
|
TCP |
3347 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:3347 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 cd350275e54f0c0d
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3347
Chemin / cible
—
Service
TLS
Payload
�1Vս��0+Hv����&H�\/��� ����& �7T�,�8�c�����^'�s�e$uˑ�po_Y >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�1Vս��0+Hv����&H�\/��� ����& �7T�,�8�c�����^'�s�e$uˑ�po_Y >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�1Vս��0+Hv����&H�\/��� ����& �7T�,�8�c�����^'�s�e$uˑ�po_Y >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + -
Meta JSON brut
{"tls_ja3_hash":"cd350275e54f0c0d6df9f3c93af0211d","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":8,"bytes_in":517,"payload_entropy":3.9671230927284946,"port_category":"registered","org":"ONYPHE SAS","service":"tls","app_proto":"tls","asn":213412,"country":"FR","dst_port":3347,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":0,"risk_boost":6,"risk_granularity":5.8,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0},"risk_score":35,"tag_count":3,"anomaly_count":0,"campaign_key":"d6ebdb29ff76e6405f8bbf0995f2817418bccf73","event_fingerprint":"da953128c2195e6699d8af761c68a1bfab75ec87","classification_confidence":0.5,"confidence":0.5,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0,"risk_score":35},"service_name":"tls","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"FR","asn":213412,"org":"ONYPHE SAS","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cd350275e54f0c0d6df9f3c93af0211d","payload_hash":"21a72483b618f4ed764b130d6b712033","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c"},"target_context":{"dst_port":3347,"service":"tls","service_name":"tls","risk_score":35},"payload_snippet":"\u0016\u0003\u0001\u0002\u0000\u00…
|