|
|
TCP |
5900 · VNC
|
vnc
|
Sonde port 5900/TCP
port 5900 tcp · via VNC:5900 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 799b30521ece672f
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
net_vnc_probe
tls_clienthello
vnc_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5900
Chemin / cible
—
Preuve honeypot — Sonde port 5900/TCP
Connexion détectée sur le port 5900 (TCP) du capteur simulé.
Service
VNC
Payload
k gjX~Hu�'x�t�ˋ����@���� ~�4� / 9 �+�/�,�0̨̩�� � � 5
Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69%
Confiance classification
69%
Risque capteur
Moyen
· 42
Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
Tcp Vnc Auth
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
k gjX~Hu�'x�t�ˋ����@����
~�4� /
9 �+�/�,�0̨̩�� � � 5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "524642203030332e3030380a",
"emulator_response_len": 12,
"bytes_in": 112,
"payload_entropy": 5.1984792262028785,
"port_category": "registered",
"org": "Chinanet",
"service": "vnc",
"app_proto": "vnc",
"asn": 4134,
"country": "CN",
"dst_port": 5900,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a278da5f968ed132a1611a6016a9f26d4a82171a",
"event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 82,
"precision_signals": [
"INT-tcp-vnc-auth"
],
"kb_rule_ids": [
"INT-tcp-vnc-auth"
],
"matched_patterns": [
"pat-0554",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "vnc_bruteforce",
"service_name": "vnc",
"risk_confidence_factor": 69,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "83f87214dbfd9f860a66108ba0fb8407",
"path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1",
"ja3": "799b30521ece672fae5d0cec76e8d728",
"ja4": "69c70b0bda2dcb6e8fab5737ed5b5710",
"tls_version": "0x0303",
"tls_cipher_count": 16,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "799b30521ece672fae5d0cec76e8d728",
"tls_ja3": "771,47-10-19-57-4-49195-49199-49196-49200-52393-52392-49171-49172-156-157-53,13,,",
"tls_ja4_hash": "69c70b0bda2dcb6e8fab5737ed5b5710",
"tls_ja4": "t13d0116_3fdba35f04dc_d03502c43d74",
"tls_version": "0x0303",
"tls_cipher_count": 16,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5900,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000k\u0001\u0000\u0000g\u0003\u0003jX~H\u000eu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\u0013\b\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd\u0000\u0000 \u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u00005\u0001\u0000\u0000\u001e\u0000\r\u0000\u001a\u0000\u0018\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0001\u0004\u0002\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0007\b\b",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000k\u0001\u0000\u0000g\u0003\u0003jX~H\u000eu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\u0013\b\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd\u0000\u0000 \u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u00005\u0001\u0000\u0000\u001e\u0000\r\u0000\u001a\u0000\u0018\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0001\u0004\u0002\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000k\u0001\u0000\u0000g\u0003\u0003jX~H\u000eu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\u0013\b\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd\u0000\u0000 \u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u00005\u0001\u0000\u0000\u001e\u0000\r\u0000\u001a\u0000\u0018\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0001\u0004\u0002\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0007\b\b",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97763f881fd9342c438c5c0894dddb89968ba9bc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000k\u0001\u0000\u0000g\u0003\u0003jX~H\u000eu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\u0013\b\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd\u0000\u0000 \u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u00005\u0001\u0000\u0000\u001e\u0000\r\u0000\u001a\u0000\u0018\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0001\u0004\u0002\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0007\b\b",
"tls_ja3": "799b30521ece672fae5d0cec76e8d728",
"tls_ja4": "69c70b0bda2dcb6e8fab5737ed5b5710",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "kgjX~Hu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd \/\n9\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd5",
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 5900,
"protocol_emulated": true,
"tags_summary": [
"INT-tcp-vnc-auth"
],
"tags_summary_labels_fr": [
"Tcp Vnc Auth"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000k\u0001\u0000\u0000g\u0003\u0003jX~H\u000eu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\u0013\b\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd\u0000\u0000 \u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u00005\u0001\u0000\u0000\u001e\u0000\r\u0000\u001a\u0000\u0018\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0001\u0004\u0002\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0007\b\b",
"tls_ja3": "799b30521ece672fae5d0cec76e8d728",
"tls_ja4": "69c70b0bda2dcb6e8fab5737ed5b5710",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "kgjX~Hu\ufffd'x\ufffdt\ufffd\u02cb\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\n~\ufffd4\ufffd \/\n9\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd5",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "5900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_vnc_probe",
"tls_clienthello",
"vnc_emulated"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
5900 · VNC
|
vnc
|
Sonde port 5900/TCP
port 5900 tcp · via VNC:5900 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
net_vnc_probe
tls_clienthello
vnc_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5900
Chemin / cible
—
Preuve honeypot — Sonde port 5900/TCP
Connexion détectée sur le port 5900 (TCP) du capteur simulé.
Service
VNC
Payload
��1H+^7�.��%p7:q ����`x ��K}��� �E��͵a�< ʃ/����F���Ǫ�.��ӯ � 3 9 5 /�,�0 � �̨̩̪���������]�a�W�S
Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69%
Confiance classification
69%
Risque capteur
Moyen
· 42
Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
Tcp Vnc Auth
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��1H+^7�.��%p7:q ����`x ��K}��� �E��͵a�< ʃ/����F���Ǫ�.��ӯ � 3 9 5
/�,�0 � �̨̩̪���������]�a�W�S
Requête brute (extrait)
��1H+^7�.��%p7:q ����`x ��K}��� �E��͵a�< ʃ/����F���Ǫ�.��ӯ � 3 9 5 /�,�0 � �̨̩̪���������]�a�W�S�+�/ � ����������\�`�V�R�$�( k j�s�w � ��#�' g @�r�v � �� � 8 � �� � 2 � � E D���� ������Q ������P = � < � � � A �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "524642203030332e3030380a",
"emulator_response_len": 12,
"bytes_in": 517,
"payload_entropy": 5.032574058468668,
"port_category": "registered",
"org": "Chinanet",
"service": "vnc",
"app_proto": "vnc",
"asn": 4134,
"country": "CN",
"dst_port": 5900,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a278da5f968ed132a1611a6016a9f26d4a82171a",
"event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 82,
"precision_signals": [
"INT-tcp-vnc-auth"
],
"kb_rule_ids": [
"INT-tcp-vnc-auth"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "vnc_bruteforce",
"service_name": "vnc",
"risk_confidence_factor": 69,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38f1fc67b9877993545b07970e982dd7",
"path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
},
"target_context": {
"dst_port": 5900,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00151H+^7\ufffd.\ufffd\ufffd%p7:q\u001f\ufffd\ufffd\ufffd\ufffd`x\u001f\ufffd\ufffdK}\ufffd\ufffd\ufffd\u0001 \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\u000e\ufffd\u01ea\ufffd.\ufffd\ufffd\u0014\u04ef\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u0000\u0005\u0000\u0016\u00003\u00009\u00005\u0000\n\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00151H+^7\ufffd.\ufffd\ufffd%p7:q\u001f\ufffd\ufffd\ufffd\ufffd`x\u001f\ufffd\ufffdK}\ufffd\ufffd\ufffd\u0001 \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\u000e\ufffd\u01ea\ufffd.\ufffd\ufffd\u0014\u04ef\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u0000\u0005\u0000\u0016\u00003\u00009\u00005\u0000\n\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\ufffd\n\ufffd\u0014\u00008\u0000\ufffd\u0000\ufffd\ufffd\t\ufffd\u0013\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0007\ufffd\u0011\ufffd\b\ufffd\u0012\u0000\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\u0007\u0000\ufffd\u0001\u0000\u0001\u0005",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00151H+^7\ufffd.\ufffd\ufffd%p7:q\u001f\ufffd\ufffd\ufffd\ufffd`x\u001f\ufffd\ufffdK}\ufffd\ufffd\ufffd\u0001 \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\u000e\ufffd\u01ea\ufffd.\ufffd\ufffd\u0014\u04ef\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u0000\u0005\u0000\u0016\u00003\u00009\u00005\u0000\n\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f52b062876e7777c2ae6825797cee16f44b62ac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00151H+^7\ufffd.\ufffd\ufffd%p7:q\u001f\ufffd\ufffd\ufffd\ufffd`x\u001f\ufffd\ufffdK}\ufffd\ufffd\ufffd\u0001 \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\u000e\ufffd\u01ea\ufffd.\ufffd\ufffd\u0014\u04ef\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u0000\u0005\u0000\u0016\u00003\u00009\u00005\u0000\n\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "\ufffd\ufffd1H+^7\ufffd.\ufffd\ufffd%p7:q\ufffd\ufffd\ufffd\ufffd`x\ufffd\ufffdK}\ufffd\ufffd\ufffd \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u01ea\ufffd.\ufffd\ufffd\u04ef\ufffd395\n\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 5900,
"protocol_emulated": true,
"tags_summary": [
"INT-tcp-vnc-auth"
],
"tags_summary_labels_fr": [
"Tcp Vnc Auth"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00151H+^7\ufffd.\ufffd\ufffd%p7:q\u001f\ufffd\ufffd\ufffd\ufffd`x\u001f\ufffd\ufffdK}\ufffd\ufffd\ufffd\u0001 \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\u000e\ufffd\u01ea\ufffd.\ufffd\ufffd\u0014\u04ef\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\u0000\u0005\u0000\u0016\u00003\u00009\u00005\u0000\n\u0000\/\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd1H+^7\ufffd.\ufffd\ufffd%p7:q\ufffd\ufffd\ufffd\ufffd`x\ufffd\ufffdK}\ufffd\ufffd\ufffd \ufffdE\ufffd\ufffd\u0375a\ufffd<\t\u0283\/\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u01ea\ufffd.\ufffd\ufffd\u04ef\ufffd395\n\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "5900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_vnc_probe",
"tls_clienthello",
"vnc_emulated"
]
}
|
|
|
TCP |
5900 · VNC
|
vnc
|
vnc bruteforce
vnc bruteforce · via VNC:5900 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
net_vnc_bruteforce
vnc_auth_attempt
vnc_banner
vnc_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5900
Chemin / cible
—
Service
VNC
Payload
RFB 003.008
Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 42
Confiance : Confiance 95 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Tcp Vnc Auth
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
VNC RFB 3.8
User-Agent
—
Règles WAF
—
Payload (extrait)
RFB 003.008
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "524642203030332e3030380a",
"emulator_response_len": 12,
"bytes_in": 12,
"payload_entropy": 2.9182958340544896,
"port_category": "registered",
"org": "Chinanet",
"service": "vnc",
"app_proto": "vnc",
"asn": 4134,
"country": "CN",
"dst_port": 5900,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "be66c1e10cc49cf983619c539468e52da00ee67a",
"event_fingerprint": "4224855e75f2a2d841b898f9815ab5cb95ce6365",
"classification_reason": "Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 107,
"precision_signals": [
"INT-tcp-vnc-auth",
"INT-upstream"
],
"kb_rule_ids": [
"INT-tcp-vnc-auth",
"INT-upstream"
],
"matched_patterns": [
"pat-0552"
],
"matched_pattern_names": [
"VNC RFB 3.8"
],
"pattern_ids": [
"pat-0552"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": false,
"service_name": "vnc",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "59ac080647b56a2a43715cdf9e630c46",
"path_pattern_hash": "6577fc24207aaa414d0e07447153793c"
},
"target_context": {
"dst_port": 5900,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"payload_preview": "RFB 003.008\n",
"request_sample": "RFB 003.008\n",
"payload_snippet": "RFB 003.008",
"evidence": {
"request_sample": "RFB 003.008\n",
"payload_snippet": "RFB 003.008",
"classification_reason": "Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60f11fe76a8ae12877f3fd8c55b32557a87e48db",
"protocol_details": {
"payload_preview": "RFB 003.008",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"evidence_snippet": "RFB 003.008",
"attack_vector": "vnc bruteforce \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 5900,
"protocol_emulated": true,
"tags_summary": [
"INT-tcp-vnc-auth",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Tcp Vnc Auth",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "RFB 003.008",
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "vnc bruteforce \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"evidence_snippet": "RFB 003.008",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 95 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "5900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_vnc_bruteforce",
"vnc_auth_attempt",
"vnc_banner",
"vnc_emulated"
]
}
|
|
|
TCP |
5900 · VNC
|
vnc
|
Sonde port 5900/TCP
port 5900 tcp · via VNC:5900 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
net_vnc_probe
vnc_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5900
Chemin / cible
—
Preuve honeypot — Sonde port 5900/TCP
Connexion détectée sur le port 5900 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69%
Confiance classification
69%
Risque capteur
Moyen
· 42
Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
Tcp Vnc Auth
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "524642203030332e3030380a",
"emulator_response_len": 12,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Chinanet",
"service": "vnc",
"app_proto": "vnc",
"asn": 4134,
"country": "CN",
"dst_port": 5900,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
"event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 82,
"precision_signals": [
"INT-tcp-vnc-auth"
],
"kb_rule_ids": [
"INT-tcp-vnc-auth"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "vnc_bruteforce",
"service_name": "vnc",
"risk_confidence_factor": 69,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
},
"target_context": {
"dst_port": 5900,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3ade5dd4bf2b10d4442d8160e05322d98a8e986",
"protocol_details": {
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 5900,
"protocol_emulated": true,
"tags_summary": [
"INT-tcp-vnc-auth"
],
"tags_summary_labels_fr": [
"Tcp Vnc Auth"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "5900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_vnc_probe",
"vnc_emulated"
]
}
|
|
|
TCP |
5900 · VNC
|
vnc
|
Sonde port 5900/TCP
port 5900 tcp · via VNC:5900 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
VNC
WAF
—
Recommandation
Surveiller
Tags
net_vnc_probe
vnc_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5900
Chemin / cible
—
Preuve honeypot — Sonde port 5900/TCP
Connexion détectée sur le port 5900 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69%
Confiance classification
69%
Risque capteur
Moyen
· 42
Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
Tcp Vnc Auth
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "524642203030332e3030380a",
"emulator_response_len": 12,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Chinanet",
"service": "vnc",
"app_proto": "vnc",
"asn": 4134,
"country": "CN",
"dst_port": 5900,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "85454e6c29c51aac1db940d56f57ff1075b15dc1",
"event_fingerprint": "3a1818c09cc3b5e6ad75703011c0dde91c1bf15b",
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"confidence": 0.69,
"classification_confidence": 0.69,
"precision_score": 82,
"precision_signals": [
"INT-tcp-vnc-auth"
],
"kb_rule_ids": [
"INT-tcp-vnc-auth"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "vnc_bruteforce",
"service_name": "vnc",
"risk_confidence_factor": 69,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4a4cb19f87c1ed9566419ca625731da1"
},
"target_context": {
"dst_port": 5900,
"service": "vnc",
"service_name": "vnc",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3ade5dd4bf2b10d4442d8160e05322d98a8e986",
"protocol_details": {
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"classification_reason_label_fr": "Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 69,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "vnc",
"service_label_fr": "VNC",
"dst_port": 5900,
"protocol_emulated": true,
"tags_summary": [
"INT-tcp-vnc-auth"
],
"tags_summary_labels_fr": [
"Tcp Vnc Auth"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-vnc",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5900,
"service": "vnc",
"service_label_fr": "VNC"
},
"attack_vector": "port 5900 tcp \u00b7 via VNC:5900 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5900 \u00b7 VNC",
"emulator_service": "vnc",
"confidence_reason": "Confiance 69 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "vnc",
"service_banner": "honeypot-vnc",
"service_os": "linux",
"dst_port": "5900"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_vnc_probe",
"vnc_emulated"
]
}
|
|
|
TCP |
2869 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:2869 · (sonde / probe) · → /favicon.ico
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2869
Chemin / cible
/favicon.ico
Pourquoi cette classification : Sonde HTTP (tag rce-0) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2869
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:2869 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "794d54186261fe2bc2736ed06e3d0e320c015c5f",
"http_host_hash": "aa8d37268eaa3cd59922467019db9b5b9101d777",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.36351237730614,
"port_category": "registered",
"org": "Chinanet",
"service": "http",
"app_proto": "http",
"asn": 4134,
"country": "CN",
"dst_port": 2869,
"risk_waf": 60,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1081d928af0386c29471d875ff7552da236c011b",
"event_fingerprint": "2c5f14dce2d6bf228ce502a7b84538586022426d",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 42
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3f39f875a501422aded24cccae49cc9b",
"payload_hash": "0168f8b2b7285defcea45e415bb2b22f",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2869,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85ad105f02f01140cbb219f127868402151d8392",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 2869,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2869 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "2869 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2869,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 2869,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2869 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"target_port_label": "2869 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2869"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
|
|
|
TCP |
2869 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:2869 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2869
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 46
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2869
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2869 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "794d54186261fe2bc2736ed06e3d0e320c015c5f",
"http_host_hash": "aa8d37268eaa3cd59922467019db9b5b9101d777",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 222,
"payload_entropy": 5.361789336276927,
"port_category": "registered",
"org": "Chinanet",
"service": "http",
"app_proto": "http",
"asn": 4134,
"country": "CN",
"dst_port": 2869,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3094540659f4a1ce7a710ef47dfa8a81627d9f2d",
"event_fingerprint": "f4de4b1b2b1b592f48d38f2478c4d8ac7b44fb75",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3f39f875a501422aded24cccae49cc9b",
"payload_hash": "d79595b5ef82ad642bae479df449fdba",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2869,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce9ea2cf086659da9d15a56706034c5a5de395e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 2869,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "exploit attempt \u00b7 via HTTP:2869 \u00b7 (tentative d'exploit)",
"target_port_label": "2869 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2869,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 2869,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:2869 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2869\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "2869 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2869"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
7070 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:7070 · (sonde / probe) · → /favicon.ico
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /favicon.ico UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7070
Chemin / cible
/favicon.ico
Pourquoi cette classification : Sonde HTTP (tag rce-0) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:7070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:7070 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "794d54186261fe2bc2736ed06e3d0e320c015c5f",
"http_host_hash": "4a5cd81ea3b5d66e331d177417c1b6ed0067dc7d",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.329177613357642,
"port_category": "registered",
"org": "Chinanet",
"service": "http",
"app_proto": "http",
"asn": 4134,
"country": "CN",
"dst_port": 7070,
"risk_waf": 60,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "079f5436a4284e14ea400c9228d39bfc96470800",
"event_fingerprint": "64adb264ff107a246fd4a1f18009e3e99f8f8a52",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 42
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3f39f875a501422aded24cccae49cc9b",
"payload_hash": "ab942f74bb59991c67b60203c5acd753",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 7070,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0ceebacacfbde3aa1c1f3fd29a3cb7c786c3314a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 7070,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7070 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "7070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7070,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 7070,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:7070 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
"target_port_label": "7070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
|
|
|
TCP |
7070 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:7070 · (tentative d'exploit)
|
Élevée
|
Moyen · 43
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7070
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 43
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:7070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:7070 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "794d54186261fe2bc2736ed06e3d0e320c015c5f",
"http_host_hash": "4a5cd81ea3b5d66e331d177417c1b6ed0067dc7d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 222,
"payload_entropy": 5.325753300240891,
"port_category": "registered",
"org": "Chinanet",
"service": "http",
"app_proto": "http",
"asn": 4134,
"country": "CN",
"dst_port": 7070,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 43,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f57ed61f81b3fd7c687fcb11eeaa40ebb44511c1",
"event_fingerprint": "de1bf634ad5e2f0c81c4988858e1d0f2cacbc429",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4134,
"org": "Chinanet",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3f39f875a501422aded24cccae49cc9b",
"payload_hash": "4926aac7381fc6f591920e0fb97b683b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7070,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122.0.0.0\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6de0ce93b5a12706b984029df1bfeec10adc5c1d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 7070,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "exploit attempt \u00b7 via HTTP:7070 \u00b7 (tentative d'exploit)",
"target_port_label": "7070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7070,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36 Edg\/122\u2026",
"port": 7070,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:7070 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7070\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "7070 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7070"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|