|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic OTo5
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic OTo5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 96,
"payload_entropy": 4.876324158019611,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b442add0dfab1bc2a021fcf3ceb0276",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b02ddf3b6d40452fe00d40c88778b45c5bbe50e",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic OTo5",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 110,
"payload_entropy": 5.153262669088582,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "395b8fa6b92e6f4d030030dec8a26746",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33279be665a2a46046affa64397672d3caeea991",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic czlyb3NlbWFyeTpub2Rl",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 112,
"payload_entropy": 5.290127998582259,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1168577f375c0b05b793fbddb148ba08",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3992bf860420b184e54af7077521be692135de24",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpRQVp3c3gxMjMu",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cm9vdDp2cHMxMDI0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDp2cHMxMDI0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 108,
"payload_entropy": 5.111221128854476,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "73b28f56d46b5d20cad5dbae2ff170ac",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc07b8b008468c4da5fbe602a34f55844975b251",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDp2cHMxMDI0",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic MTIzOjEyMw==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic MTIzOjEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 102,
"payload_entropy": 5.065274210312297,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0bf019f2c9dd156d8037ab5d4116fa0b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "257ec0e3888f65dac0a4ad5baa0806513c2aec5d",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic ODAwMDo4MDAw
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic ODAwMDo4MDAw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 102,
"payload_entropy": 5.000282146752584,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ed0c0a9b31b631dcc48b646130f8b8c",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "81dfb5a23de69fb28bd92e3e74c301217d979493",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 116,
"payload_entropy": 5.217714996683305,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 197769,
"country": "SI",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2cca82dc5b10cb31e5c249d07f6c2e1",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee7f09296a405064bdb81d289a2d3ac8ea241d5f",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkxMjM0NTYh",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�J��#;�tS1 V� hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�J��#;�tS1 V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l�J��#;�tS1 V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�J��#;�tS1 V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�J��#;�tS1 V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.83287105096246,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8c3d173d9de12f7faf89f71a549ad92b",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "690dbbeb3360d94f20064af6222eba772668572a",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdJ\ufffd\ufffd#;\ufffdtS1\tV\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdJ\ufffd\ufffd\b#;\ufffdtS1\tV\u0014\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdJ\ufffd\ufffd#;\ufffdtS1\tV\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l��Pa� 1�ӊli-�D hcurve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l��Pa� 1�ӊli-�D hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-s…
Payload
SSH-2.0-libssh_0.11.4 l��Pa� 1�ӊli-�D hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l��Pa� 1�ӊli-�D hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l��Pa� 1�ӊli-�D hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.8162292000987605,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb684a2914776d097758ae6f21daca0a",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "55ba0cc5487ff66dd090a2fab5efa55d5a408480",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffdPa\ufffd1\ufffd\u04cali-\ufffdDhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdPa\ufffd\u001c1\ufffd\u04cali-\u0004\ufffdD\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffdPa\ufffd1\ufffd\u04cali-\ufffdDhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�$��� u� :4DU�� hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�$��� u� :4DU�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l�$��� u� :4DU�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�$��� u�
:4DU�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�$��� u� :4DU�� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.830250763113121,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da65ee989fc78237dc2b19c42c22fd25",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce32a249c3573a9e21e06471be220fdafd06024c",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd$\ufffd\ufffd\ufffdu\ufffd\n:4DU\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd$\ufffd\ufffd\ufffd\u0000u\ufffd\n:\u00154DU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd$\ufffd\ufffd\ufffdu\ufffd\n:4DU\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.239187701035704,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "ee6d634bcf1e1f381195e928ec04863399d89c44",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8a6452f924d5462defdfd507264d9e47",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f57886db889a5e7453a50e561ca262255d9375a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpwNHI0bjAxZA==",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "ee6d634bcf1e1f381195e928ec04863399d89c44",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20ecb9a9e63a3cbd526b9823801e77793fa055f3",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic YmVuOnRlc3QhQA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.174294955210346,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "ee6d634bcf1e1f381195e928ec04863399d89c44",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b05afd7f3b587dd0898a059f480f8fef",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f4f727957638f7b776fda9a5f95ac626c85b78b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YmVuOnRlc3QhQA==",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic d2VidXNlcjoxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.098166410945058,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "ee6d634bcf1e1f381195e928ec04863399d89c44",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b21ae296c863905efd811301c478e24",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b2a316df28e54022b1d0790fcd7cb9780bf641a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic d2VidXNlcjoxMjM=",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "ee6d634bcf1e1f381195e928ec04863399d89c44",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20ecb9a9e63a3cbd526b9823801e77793fa055f3",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a856bc25d757ab51f53b30feff16ae2237cac66",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic dGVzdDoxMjM0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dGVzdDoxMjM0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.0516500610506645,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b34c05059b713f8bb369af2988c8c5dd",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec226b298b433875d0b0e4745fb0ad2d976efae3",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.087778409835216,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c67d9039639d16111103016eb67111d4",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "308592c4fa7ee6de547283890cc188753cb56536",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.208188523451913,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fd716c4d0f7613d30f59476a0e1ddd2b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfe2d8ce9deba48afe0636a09d4613c5bee5cbac",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic dGVzdDoxMjM0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dGVzdDoxMjM0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.054936132738835,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b21935cb1634b73cce4018ad258f8a6",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8bb0435a6c06840cb0a0ef020f24c87970cd805f",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 114,
"payload_entropy": 5.2541947561892615,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "53d83ef13fe7456e10fdfe9b9e0eafe3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0d3422c6aa8525fc8dbf0377ecab178dad1f13d",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic bGlkaWFuOiV1c2VybmFtZSU=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic dGVzdDp0ZXN0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.055135016230372,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eb5ac616ce8b90742e03158013c7cb97",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5f07ed206728fca1c45f05ceaaf6033b796fb81",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.087778409835216,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c67d9039639d16111103016eb67111d4",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "308592c4fa7ee6de547283890cc188753cb56536",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic ZnRwOmZ0cA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic ZnRwOmZ0cA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.051109078566647,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6c1c57e248adfe69f44c4d2ff5a439f7",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4262563447faa11eedc0324b759b730f69d474c",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwOmZ0cA==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 114,
"payload_entropy": 5.1613232956355395,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a4e247c0564dedd4c25b6c020e79df3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ee954ef4558f9c5ff7407385ecfbc534c71ea44f",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic ZnRwdXNlcjoxMjMxMjMxMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 112,
"payload_entropy": 5.204327637203358,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5a692f47ebf32c1432bedba6d61b2559",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3beb54a834490532fae434c97e18686acfe93c07",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cHJveHk6cGFzc3dvcmQ=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a856bc25d757ab51f53b30feff16ae2237cac66",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · WEBSPHERE
|
websphere
|
Sonde WebSphere
websphere probe · via WEBSPHERE:9080 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
WEBSPHERE
WAF
—
Recommandation
Surveiller
Tags
net_websphere_probe
websphere_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9080
Chemin / cible
—
Pourquoi cette classification : Type « websphere_probe » (signaux protocolaires) · confiance 0%
Confiance classification
10%
Corrélation +10
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "websphere",
"app_proto": "websphere",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f1aeee218360866f2e4a57aee6ace3b69d206b56",
"event_fingerprint": "aea6e2a5981661f5cad72e19453c56aa15fd8d08",
"classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.1,
"classification_confidence": 0.1,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "websphere",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "a8ef247ba3612b90c1c670387b185e85"
},
"target_context": {
"dst_port": 9080,
"service": "websphere",
"service_name": "websphere",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan",
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3b4ab5525dd4ae1a3498a13edcd66eb770e4b6f",
"protocol_details": {
"port": 9080,
"service": "websphere",
"service_label_fr": "WEBSPHERE"
},
"attack_vector": "websphere probe \u00b7 via WEBSPHERE:9080 \u00b7 (sonde \/ probe)",
"target_port_label": "9080 \u00b7 WEBSPHERE",
"emulator_service": "websphere",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 10,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "websphere",
"service_label_fr": "WEBSPHERE",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-websphere",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 9080,
"service": "websphere",
"service_label_fr": "WEBSPHERE"
},
"attack_vector": "websphere probe \u00b7 via WEBSPHERE:9080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9080 \u00b7 WEBSPHERE",
"emulator_service": "websphere",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (102.220.160.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "websphere",
"service_banner": "honeypot-websphere",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "102.220.160.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_websphere_probe",
"websphere_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ba766e8ee03465c1bd4980039131c9b459da705",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic MTIzOjEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.061789329440021,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "77352442ce0a5ee88bf2b5447c36a426",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "51001df7e5819b8167549e61fa9cc94dd972a1dd",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.198479226202879,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3221256fa7908fcf31b7bd38712caf23",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef99982d7335c403a5333951c51933f9afb030f5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic b3BzOjIxb3BzLmNvbQ==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ba766e8ee03465c1bd4980039131c9b459da705",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.055135016230372,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eb5ac616ce8b90742e03158013c7cb97",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccc44550f07f378da8f449f8c265a9ca28c9bbd0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ba766e8ee03465c1bd4980039131c9b459da705",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.22417423119018,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f6f84cad50b6956923fd8ebeae459ea7",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b981d6632c81511b3a0668775706c5e76d4e743d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDphMTIzNDU2QQ==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic YnJhZDpicmFk
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.1194816371323295,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b45210edb6322a0aa9454a0761ef6c74",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35acf4fed56fb43e43468c3bfd2a208d0425da71",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic YnJhZDpicmFk",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic MTIzOjEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.065274210312297,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0bf019f2c9dd156d8037ab5d4116fa0b",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8210e4655a53c063759563cb436b5212a1c5adeb",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.055135016230372,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eb5ac616ce8b90742e03158013c7cb97",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccc44550f07f378da8f449f8c265a9ca28c9bbd0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 61,
"payload_entropy": 4.167378526863898,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1858163c0136e354fb4b9c1a13ea7f4e",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de543813efd58eaa4ffadd73585d0b78e68dbcd1",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 4.062305474194333,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81c098c8d4430024d7ae4217f8dcc2e2",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ba766e8ee03465c1bd4980039131c9b459da705",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1080 · SOCKS5
|
socks5
|
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "socks5",
"app_proto": "socks5",
"asn": 197769,
"country": "SI",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"socks5"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_handshake"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.47:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 102.220.160.47:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
102.220.160.47:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
102.220.160.47:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 102.220.160.47:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "47:80",
"http_ua_hash": null,
"http_host_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_target_hash": "d4c0cacd362d1a0e66ac6473f0cb35590412e2c5",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 63,
"payload_entropy": 4.182444011484596,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "cb91bbc7f59da2dea22d752b48ea2b6e50e59402",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "12f44f335a600cbd00b1ed67f6407d12",
"path_pattern_hash": "21005405859c8de5d162bbe51133e31d"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n\r\n",
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"evidence": {
"method": "CONNECT",
"path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4be87f44a5477cfa14e0c9dec49092990547b43f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "102.220.160.47:80",
"request_line": "CONNECT 102.220.160.47:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.47:80",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.143231732290761,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 197769,
"country": "SI",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3a1a9b701247194fc91f6e95ef1ebed3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e659b3981eaca57fd6b343bb150626e046fa17b",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 102.220.160.47:80 HTTP/1.0 Host: 102.220.160.47:80 Proxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 102.220.160.47:80 HTTP/1.0
Host: 102.220.160.47:80
Proxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 112,
"payload_entropy": 5.2186994271536875,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a9f6368845815c25d47240f993148d3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=\r\n\r\n",
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"evidence": {
"request_sample": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=\r\n\r\n",
"payload_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77905325d3df74e6130559b5ce480339f6fe6299",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 102.220.160.47:80 HTTP\/1.0\r\nHost: 102.220.160.47:80\r\nProxy-Authorization: Basic cm9vdDpQQCQkdzByZCE=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|