|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��?o�3����-����)6a~�tCP��ON�� ���Z˂�s @�<�>�K=��Y��+k��X��� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��?o�3����-����)6a~�tCP��ON�� ���Z˂�s @�<�>�K=��Y��+k��X��� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��?o�3����-����)6a~�tCP��ON�� ���Z˂�s @�<�>�K=��Y��+k��X��� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.060221311978099,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "49337191e284fc9fbdbdd535c326651f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd\u0010\u000e-\ufffd\ufffd\ufffd\ufffd)\u00156a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\u0006\ufffd\ufffdZ\u02c2\ufffds\u000b@\ufffd<\ufffd\u0005>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd\u0010\u000e-\ufffd\ufffd\ufffd\ufffd)\u00156a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\u0006\ufffd\ufffdZ\u02c2\ufffds\u000b@\ufffd<\ufffd\u0005>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd\u0010\u000e-\ufffd\ufffd\ufffd\ufffd)\u00156a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\u0006\ufffd\ufffdZ\u02c2\ufffds\u000b@\ufffd<\ufffd\u0005>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85cef0d423c44e0d518172b3a0e614add8a0e4ac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd\u0010\u000e-\ufffd\ufffd\ufffd\ufffd)\u00156a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\u0006\ufffd\ufffdZ\u02c2\ufffds\u000b@\ufffd<\ufffd\u0005>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd)6a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\ufffd\ufffdZ\u02c2\ufffds@\ufffd<\ufffd>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd\u0010\u000e-\ufffd\ufffd\ufffd\ufffd)\u00156a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\u0006\ufffd\ufffdZ\u02c2\ufffds\u000b@\ufffd<\ufffd\u0005>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd?o\ufffd3\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd)6a~\ufffdtCP\ufffd\ufffdON\ufffd\ufffd \ufffd\ufffd\ufffdZ\u02c2\ufffds@\ufffd<\ufffd>\ufffdK=\ufffd\ufffdY\ufffd\ufffd+k\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��j�0�ca� 4��v�r��˽�ОG��mx� f�� ��C�bA����>�b4c+ ���1ə� � � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��j�0�ca� 4��v�r��˽�ОG��mx� f�� ��C�bA����>�b4c+ ���1ə� � � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��j�0�ca� 4��v�r��˽�ОG��mx� f�� ��C�bA����>�b4c+ ���1ə� � � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.01174010855038,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "8b6896c76d0ebf332965f4afd90b9514",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj\ufffd0\ufffd\u0006ca\ufffd\t4\ufffd\ufffdv\u0011\ufffdr\u0018\ufffd\ufffd\u02fd\ufffd\u041eG\u0004\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\u0001\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\u001e\ufffd\ufffd\ufffd\u00161\u0259\ufffd\f\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj\ufffd0\ufffd\u0006ca\ufffd\t4\ufffd\ufffdv\u0011\ufffdr\u0018\ufffd\ufffd\u02fd\ufffd\u041eG\u0004\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\u0001\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\u001e\ufffd\ufffd\ufffd\u00161\u0259\ufffd\f\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj\ufffd0\ufffd\u0006ca\ufffd\t4\ufffd\ufffdv\u0011\ufffdr\u0018\ufffd\ufffd\u02fd\ufffd\u041eG\u0004\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\u0001\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\u001e\ufffd\ufffd\ufffd\u00161\u0259\ufffd\f\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9eb4f2650eadad16fad5af4080e933b00afaa0e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj\ufffd0\ufffd\u0006ca\ufffd\t4\ufffd\ufffdv\u0011\ufffdr\u0018\ufffd\ufffd\u02fd\ufffd\u041eG\u0004\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\u0001\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\u001e\ufffd\ufffd\ufffd\u00161\u0259\ufffd\f\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffd0\ufffdca\ufffd\t4\ufffd\ufffdv\ufffdr\ufffd\ufffd\u02fd\ufffd\u041eG\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\ufffd\ufffd\ufffd1\u0259\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdj\ufffd0\ufffd\u0006ca\ufffd\t4\ufffd\ufffdv\u0011\ufffdr\u0018\ufffd\ufffd\u02fd\ufffd\u041eG\u0004\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\u0001\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\u001e\ufffd\ufffd\ufffd\u00161\u0259\ufffd\f\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffd0\ufffdca\ufffd\t4\ufffd\ufffdv\ufffdr\ufffd\ufffd\u02fd\ufffd\u041eG\ufffd\ufffdmx\ufffd f\ufffd\ufffd\t\ufffd\ufffdC\ufffdbA\ufffd\ufffd\ufffd\ufffd>\ufffdb4c+\ufffd\ufffd\ufffd1\u0259\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 afdaf39cbf0a1f6f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �#XS�q|�_c�o��s��2XK�՜ ���ȯ?��@ 0�} ��1��?*�4�q�J!�\��S ���(�g� � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �#XS�q|�_c�o��s��2XK�՜ ���ȯ?��@ 0�} ��1��?*�4�q�J!�\��S
���(�g� �
����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �#XS�q|�_c�o��s��2XK�՜ ���ȯ?��@ 0�} ��1��?*�4�q�J!�\��S ���(�g� � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "afdaf39cbf0a1f6fc796b4f5fa0e6e83",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.994764484428452,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "f213363bf4b78ac473a43248bbf2df144491df1a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "afdaf39cbf0a1f6fc796b4f5fa0e6e83",
"payload_hash": "d274589fe8a068d250f1814ead20d9c1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\u001e\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\u001e\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\u001e\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71083e891fcc4d621b2258290e41ab9c146cbae3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\u001e\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "afdaf39cbf0a1f6fc796b4f5fa0e6e83",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\ufffd\n\n\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\u001e\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "afdaf39cbf0a1f6fc796b4f5fa0e6e83",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd#XS\ufffdq|\ufffd_c\ufffdo\ufffd\ufffds\ufffd\ufffd2XK\ufffd\u055c\ufffd\ufffd\ufffd\u022f?\ufffd\ufffd@ 0\ufffd}\t\ufffd\ufffd1\ufffd\ufffd?*\ufffd4\ufffdq\ufffdJ!\ufffd\\\ufffd\ufffdS\n\ufffd\ufffd\ufffd(\ufffdg\ufffd\ufffd\n\n\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�u���HYv�r\����F�G<�wm��W'�� �?1I �sQ�^�؉� �(�� �U)S|M��0 D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�u���HYv�r\����F�G<�wm��W'�� �?1I �sQ�^�؉� �(��
�U)S|M��0 D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�u���HYv�r\����F�G<�wm��W'�� �?1I �sQ�^�؉� �(�� �U)S|M��0 D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.960856789522869,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "b391ccead3d6ea3592f36884851be9fc",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\u0003\u0001\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\u001f\u0006\ufffd(\ufffd\ufffd\n\ufffd\u0018U)S|M\ufffd\ufffd\u00040\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\u0003\u0001\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\u001f\u0006\ufffd(\ufffd\ufffd\n\ufffd\u0018U)S|M\ufffd\ufffd\u00040\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\u0003\u0001\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\u001f\u0006\ufffd(\ufffd\ufffd\n\ufffd\u0018U)S|M\ufffd\ufffd\u00040\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a478e1afd0c536278dc26bdcfac77db9489d251",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\u0003\u0001\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\u001f\u0006\ufffd(\ufffd\ufffd\n\ufffd\u0018U)S|M\ufffd\ufffd\u00040\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\ufffd(\ufffd\ufffd\n\ufffdU)S|M\ufffd\ufffd0D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\u0003\u0001\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\u001f\u0006\ufffd(\ufffd\ufffd\n\ufffd\u0018U)S|M\ufffd\ufffd\u00040\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffdu\ufffd\ufffd\ufffdHYv\ufffdr\\\ufffd\ufffd\ufffd\ufffdF\ufffdG<\ufffdwm\ufffd\ufffdW'\ufffd\ufffd \ufffd?1I \ufffdsQ\ufffd^\ufffd\u0609\ufffd\ufffd(\ufffd\ufffd\n\ufffdU)S|M\ufffd\ufffd0D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c3003ade9bfc09eb SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �Q-I�.^f[ݿ�L�e�B�F=�� iK����%'F����a���!r�of�!�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Q-I�.^f[ݿ�L�e�B�F=�� iK����%'F����a���!r�of�!�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �Q-I�.^f[ݿ�L�e�B�F=�� iK����%'F����a���!r�of�!�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �** 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "c3003ade9bfc09ebbde16b3217b0d2a5",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.036831105065678,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "1216bfe912e4089e23bf731973fbd3fecea7fd5a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c3003ade9bfc09ebbde16b3217b0d2a5",
"payload_hash": "6d03f35444c6aa0d49d5774f50fa6176",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0015Q\u0019-I\udaf1\udec2\ufffd.^f\u0011[\u077f\ufffdL\ufffd\u0011\u0018e\ufffdB\ufffdF=\u000e\ufffd\ufffd\u001a iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\u001b\u0011\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\u0001\ufffd!\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0015Q\u0019-I\udaf1\udec2\ufffd.^f\u0011[\u077f\ufffdL\ufffd\u0011\u0018e\ufffdB\ufffdF=\u000e\ufffd\ufffd\u001a iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\u001b\u0011\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\u0001\ufffd!\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd**\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0015Q\u0019-I\udaf1\udec2\ufffd.^f\u0011[\u077f\ufffdL\ufffd\u0011\u0018e\ufffdB\ufffdF=\u000e\ufffd\ufffd\u001a iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\u001b\u0011\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\u0001\ufffd!\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8fa0f32918b74a59f9186e15ca135ac150109bd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0015Q\u0019-I\udaf1\udec2\ufffd.^f\u0011[\u077f\ufffdL\ufffd\u0011\u0018e\ufffdB\ufffdF=\u000e\ufffd\ufffd\u001a iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\u001b\u0011\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\u0001\ufffd!\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "c3003ade9bfc09ebbde16b3217b0d2a5",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdQ-I\udaf1\udec2\ufffd.^f[\u077f\ufffdL\ufffde\ufffdB\ufffdF=\ufffd\ufffd iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0015Q\u0019-I\udaf1\udec2\ufffd.^f\u0011[\u077f\ufffdL\ufffd\u0011\u0018e\ufffdB\ufffdF=\u000e\ufffd\ufffd\u001a iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\u001b\u0011\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\u0001\ufffd!\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "c3003ade9bfc09ebbde16b3217b0d2a5",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdQ-I\udaf1\udec2\ufffd.^f[\u077f\ufffdL\ufffde\ufffdB\ufffdF=\ufffd\ufffd iK\ufffd\ufffd\ufffd\ufffd%'F\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd!r\ufffd\u0082of\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����j-'AH�~�����s n,�J���|m�� C���Rr�V� UIH�N�u��?���� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����j-'AH�~�����s n,�J���|m�� C���Rr�V�
UIH�N�u��?���� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����j-'AH�~�����s n,�J���|m�� C���Rr�V� UIH�N�u��?���� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.034708139146501,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "4fa8d5b814130dfda07f5a660a01a9ba",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffds\u0000n,\ufffdJ\ufffd\ufffd\ufffd\u0001|m\ufffd\ufffd C\ufffd\ufffd\u0005\ufffdR\u0003\u0007r\ufffdV\u0018\ufffd\rUIH\ufffdN\ufffdu\ufffd\b\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffds\u0000n,\ufffdJ\ufffd\ufffd\ufffd\u0001|m\ufffd\ufffd C\ufffd\ufffd\u0005\ufffdR\u0003\u0007r\ufffdV\u0018\ufffd\rUIH\ufffdN\ufffdu\ufffd\b\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffds\u0000n,\ufffdJ\ufffd\ufffd\ufffd\u0001|m\ufffd\ufffd C\ufffd\ufffd\u0005\ufffdR\u0003\u0007r\ufffdV\u0018\ufffd\rUIH\ufffdN\ufffdu\ufffd\b\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c79b473146e18841719b740762583213621b7308",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffds\u0000n,\ufffdJ\ufffd\ufffd\ufffd\u0001|m\ufffd\ufffd C\ufffd\ufffd\u0005\ufffdR\u0003\u0007r\ufffdV\u0018\ufffd\rUIH\ufffdN\ufffdu\ufffd\b\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffdsn,\ufffdJ\ufffd\ufffd\ufffd|m\ufffd\ufffd C\ufffd\ufffd\ufffdRr\ufffdV\ufffd\rUIH\ufffdN\ufffdu\ufffd\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffds\u0000n,\ufffdJ\ufffd\ufffd\ufffd\u0001|m\ufffd\ufffd C\ufffd\ufffd\u0005\ufffdR\u0003\u0007r\ufffdV\u0018\ufffd\rUIH\ufffdN\ufffdu\ufffd\b\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdj-'AH\ufffd\u07ba~\ufffd\ufffd\ufffd\ufffd\ufffdsn,\ufffdJ\ufffd\ufffd\ufffd|m\ufffd\ufffd C\ufffd\ufffd\ufffdRr\ufffdV\ufffd\rUIH\ufffdN\ufffdu\ufffd\ufffd?\ufffd\ufffd\ue24b\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���1�b�K���ز����n��6�^����B}Q+ ��Fz���Ob�e8?]� y/�+�]!$jw-F� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���1�b�K���ز����n��6�^����B}Q+ ��Fz���Ob�e8?]� y/�+�]!$jw-F� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���1�b�K���ز����n��6�^����B}Q+ ��Fz���Ob�e8?]� y/�+�]!$jw-F� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.974480613999863,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "36e926d34892f17c0871dd325e4760fc",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}\u0016Q+\u0000 \ufffd\u0001\ufffdF\u0005z\ufffd\ufffd\u0015\ufffdOb\ufffde8?]\ufffd\u0000y\/\ufffd+\ufffd]!$jw-F\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}\u0016Q+\u0000 \ufffd\u0001\ufffdF\u0005z\ufffd\ufffd\u0015\ufffdOb\ufffde8?]\ufffd\u0000y\/\ufffd+\ufffd]!$jw-F\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}\u0016Q+\u0000 \ufffd\u0001\ufffdF\u0005z\ufffd\ufffd\u0015\ufffdOb\ufffde8?]\ufffd\u0000y\/\ufffd+\ufffd]!$jw-F\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "18d0aacc467d981a2d6424b2b1b7873f9bed4890",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}\u0016Q+\u0000 \ufffd\u0001\ufffdF\u0005z\ufffd\ufffd\u0015\ufffdOb\ufffde8?]\ufffd\u0000y\/\ufffd+\ufffd]!$jw-F\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}Q+ \ufffd\ufffdFz\ufffd\ufffd\ufffdOb\ufffde8?]\ufffdy\/\ufffd+\ufffd]!$jw-F\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}\u0016Q+\u0000 \ufffd\u0001\ufffdF\u0005z\ufffd\ufffd\u0015\ufffdOb\ufffde8?]\ufffd\u0000y\/\ufffd+\ufffd]!$jw-F\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd1\ufffdb\ufffdK\ufffd\ufffd\ufffd\u0632\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd6\ufffd^\ufffd\ufffd\ufffd\ufffdB}Q+ \ufffd\ufffdFz\ufffd\ufffd\ufffdOb\ufffde8?]\ufffdy\/\ufffd+\ufffd]!$jw-F\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �x� ~���&��<�iǥ�J�uhɋ`I�+�' �K��L�'Ux'�;c�@��1���o�X��@r� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �x� ~���&��<�iǥ�J�uhɋ`I�+�' �K��L�'Ux'�;c�@��1���o�X��@r� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �x� ~���&��<�iǥ�J�uhɋ`I�+�' �K��L�'Ux'�;c�@��1���o�X��@r� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 6.001832378321431,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "a126311cde3c57efcd8d534baeb41926",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\u0012x\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffd\u0016\u000fJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\u000f\ufffd@\ufffd\ufffd\u00191\ufffd\ufffd\ufffdo\u001b\ufffdX\ufffd\ufffd@r\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\u0012x\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffd\u0016\u000fJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\u000f\ufffd@\ufffd\ufffd\u00191\ufffd\ufffd\ufffdo\u001b\ufffdX\ufffd\ufffd@r\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\u0012x\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffd\u0016\u000fJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\u000f\ufffd@\ufffd\ufffd\u00191\ufffd\ufffd\ufffdo\u001b\ufffdX\ufffd\ufffd@r\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88ad44501b4d88a31d8b2a77cefdb265ce06c935",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\u0012x\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffd\u0016\u000fJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\u000f\ufffd@\ufffd\ufffd\u00191\ufffd\ufffd\ufffdo\u001b\ufffdX\ufffd\ufffd@r\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdx\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffdJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\ufffd@\ufffd\ufffd1\ufffd\ufffd\ufffdo\ufffdX\ufffd\ufffd@r\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0011\u0012x\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffd\u0016\u000fJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\u000f\ufffd@\ufffd\ufffd\u00191\ufffd\ufffd\ufffdo\u001b\ufffdX\ufffd\ufffd@r\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdx\ufffd ~\ufffd\ufffd\ufffd&\ufffd\ufffd<\ufffdi\u01e5\ufffdJ\ufffduh\u024b`I\ufffd+\ufffd' \ufffdK\ufffd\ufffdL\ufffd'Ux'\ufffd;c\ufffd@\ufffd\ufffd1\ufffd\ufffd\ufffdo\ufffdX\ufffd\ufffd@r\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �� c*���r��*�|�Q8��'I"�[�po�� � �����\S&&l�T�x ���H��4��"�4y � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� c*���r��*�|�Q8��'I"�[�po�� � �����\S&&l�T�x ���H��4��"�4y � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �� c*���r��*�|�Q8��'I"�[�po�� � �����\S&&l�T�x ���H��4��"�4y � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.0065374538975504,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "7fc33699806b8cd86a0f90c182c1437b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001cc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\u0010\f\ufffd \ufffd\u0019\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\u000b\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001cc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\u0010\f\ufffd \ufffd\u0019\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\u000b\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001cc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\u0010\f\ufffd \ufffd\u0019\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\u000b\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fceff50603b9a8105318a6aaa15ef3fee049b0ca",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001cc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\u0010\f\ufffd \ufffd\u0019\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\u000b\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u001cc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\u0010\f\ufffd \ufffd\u0019\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\u000b\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdc*\ufffd\ufffd\ufffdr\ufffd\ufffd*\ufffd|\ufffdQ8\ufffd\ufffd'I\"\ufffd[\ufffdpo\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\\S&&l\ufffdT\ufffdx\ufffd\ufffd\ufffdH\ufffd\ufffd4\ufffd\ufffd\"\ufffd4y\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P5�8�/U�RM�v g�d7Ҳ�G�f�� �� �5V���XX�1$���(�1�A�;��{�F/�u F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P5�8�/U�RM�v g�d7Ҳ�G�f�� �� �5V���XX�1$���(�1�A�;��{�F/�u F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P5�8�/U�RM�v g�d7Ҳ�G�f�� �� �5V���XX�1$���(�1�A�;��{�F/�u F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.0572610741080135,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "3ac588870d3ce552292c404e4dac1242",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u00035\ufffd\u00028\ufffd\/U\ufffdRM\ufffdv\u0015\u001cg\ufffd\u000fd7\b\u04b2\u001a\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd\u00161\ufffdA\ufffd;\ufffd\ufffd{\ufffd\u001aF\/\ufffdu\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u00035\ufffd\u00028\ufffd\/U\ufffdRM\ufffdv\u0015\u001cg\ufffd\u000fd7\b\u04b2\u001a\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd\u00161\ufffdA\ufffd;\ufffd\ufffd{\ufffd\u001aF\/\ufffdu\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u00035\ufffd\u00028\ufffd\/U\ufffdRM\ufffdv\u0015\u001cg\ufffd\u000fd7\b\u04b2\u001a\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd\u00161\ufffdA\ufffd;\ufffd\ufffd{\ufffd\u001aF\/\ufffdu\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a7eb51659e2d2a66cb5b2aa40542bd6d7321917",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u00035\ufffd\u00028\ufffd\/U\ufffdRM\ufffdv\u0015\u001cg\ufffd\u000fd7\b\u04b2\u001a\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd\u00161\ufffdA\ufffd;\ufffd\ufffd{\ufffd\u001aF\/\ufffdu\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP5\ufffd8\ufffd\/U\ufffdRM\ufffdvg\ufffdd7\u04b2\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd1\ufffdA\ufffd;\ufffd\ufffd{\ufffdF\/\ufffduF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u00035\ufffd\u00028\ufffd\/U\ufffdRM\ufffdv\u0015\u001cg\ufffd\u000fd7\b\u04b2\u001a\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd\u00161\ufffdA\ufffd;\ufffd\ufffd{\ufffd\u001aF\/\ufffdu\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP5\ufffd8\ufffd\/U\ufffdRM\ufffdvg\ufffdd7\u04b2\ufffdG\ufffdf\ufffd\ufffd\t\ufffd\ufffd \ufffd5V\ufffd\ufffd\ufffdXX\ufffd1$\ufffd\ufffd\ufffd(\ufffd1\ufffdA\ufffd;\ufffd\ufffd{\ufffdF\/\ufffduF\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
�(sd����ϩQ���]OQ���I��FfzI�) yU�J���Z��Y��̸�2p ��=X��*�tq >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�(sd����ϩQ���]OQ���I��FfzI�) yU�J���Z��Y��̸�2p ��=X��*�tq >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�(sd����ϩQ���]OQ���I��FfzI�) yU�J���Z��Y��̸�2p ��=X��*�tq >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.949056697627219,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "4088384ff0437b7ad660893dd753d236",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(s\u0016d\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\b\ufffd]OQ\ufffd\ufffd\ufffdI\u0015\ufffd\ufffdFfzI\ufffd) yU\u0018\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0014\u0011\u0338\ufffd2p\u001e\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(s\u0016d\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\b\ufffd]OQ\ufffd\ufffd\ufffdI\u0015\ufffd\ufffdFfzI\ufffd) yU\u0018\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0014\u0011\u0338\ufffd2p\u001e\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(s\u0016d\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\b\ufffd]OQ\ufffd\ufffd\ufffdI\u0015\ufffd\ufffdFfzI\ufffd) yU\u0018\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0014\u0011\u0338\ufffd2p\u001e\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb3791a99ddf5cd42cede8d8bf15c90c19403907",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(s\u0016d\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\b\ufffd]OQ\ufffd\ufffd\ufffdI\u0015\ufffd\ufffdFfzI\ufffd) yU\u0018\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0014\u0011\u0338\ufffd2p\u001e\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd(sd\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\ufffd]OQ\ufffd\ufffd\ufffdI\ufffd\ufffdFfzI\ufffd) yU\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0338\ufffd2p\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003(s\u0016d\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\b\ufffd]OQ\ufffd\ufffd\ufffdI\u0015\ufffd\ufffdFfzI\ufffd) yU\u0018\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0014\u0011\u0338\ufffd2p\u001e\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd(sd\ufffd\ufffd\ufffd\ufffd\u03e9Q\ufffd\ufffd\ufffd]OQ\ufffd\ufffd\ufffdI\ufffd\ufffdFfzI\ufffd) yU\ufffdJ\ufffd\ufffd\ufffdZ\ufffd\ufffdY\ufffd\ufffd\u0338\ufffd2p\ufffd\ufffd=X\ufffd\ufffd*\ufffdtq>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �a���������2a! �~1��K�і�{éq ��g�� �A �N h�*��=����} ?'�tY � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �a���������2a! �~1��K�і�{éq ��g��
�A �N
h�*��=����} ?'�tY � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �a���������2a! �~1��K�і�{éq ��g�� �A �N h�*��=����} ?'�tY � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.967019834933681,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "6e5c1e42748068c434d0950db5ae5d4a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u000f2\u001aa!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\u0001\n\ufffdA\t\ufffdN\u001d\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdt\u0010Y\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u000f2\u001aa!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\u0001\n\ufffdA\t\ufffdN\u001d\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdt\u0010Y\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u000f2\u001aa!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\u0001\n\ufffdA\t\ufffdN\u001d\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdt\u0010Y\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28908b4891a4a0134cc7efeba1c485298d495720",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u000f2\u001aa!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\u0001\n\ufffdA\t\ufffdN\u001d\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdt\u0010Y\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2a!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\n\ufffdA\t\ufffdN\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdtY\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\u000f2\u001aa!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\u0001\n\ufffdA\t\ufffdN\u001d\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdt\u0010Y\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2a!\t\ufffd~1\ufffd\ufffdK\ufffd\u0456\ufffd{\u00e9q \ufffd\ufffdg\ufffd\ufffd\n\ufffdA\t\ufffdN\nh\ufffd*\ufffd\ufffd=\ufffd\ufffd\ufffd\ufffd} ?'\ufffdtY\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c83b9029f5aa95d3 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���(��nu�moA�E�|�s���;D>Wo �ƙ��~>�DgjJ� �9����3�� � �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���(��nu�moA�E�|�s���;D>Wo �ƙ��~>�DgjJ�
�9����3�� � �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ���(��nu�moA�E�|�s���;D>Wo �ƙ��~>�DgjJ� �9����3�� � �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ٺ� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "c83b9029f5aa95d3b7adfaf59e76d1dd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.989387691038645,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "41628109ca9f72f0c6be487d498c1476517da69b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c83b9029f5aa95d3b7adfaf59e76d1dd",
"payload_hash": "16a536717e237c8d953ccec897aa5db8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0014\ufffd(\ufffd\ufffd\bn\u0015u\ufffd\u0010moA\ufffdE\ufffd|\ufffds\ufffd\u0013\ufffd\u0002\ufffd;D\u0003>Wo \ufffd\u0199\u0017\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\u0004\ufffd9\ufffd\ufffd\ufffd\ufffd\u00053\ufffd\ufffd \ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0014\ufffd(\ufffd\ufffd\bn\u0015u\ufffd\u0010moA\ufffdE\ufffd|\ufffds\ufffd\u0013\ufffd\u0002\ufffd;D\u0003>Wo \ufffd\u0199\u0017\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\u0004\ufffd9\ufffd\ufffd\ufffd\ufffd\u00053\ufffd\ufffd \ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u067a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0014\ufffd(\ufffd\ufffd\bn\u0015u\ufffd\u0010moA\ufffdE\ufffd|\ufffds\ufffd\u0013\ufffd\u0002\ufffd;D\u0003>Wo \ufffd\u0199\u0017\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\u0004\ufffd9\ufffd\ufffd\ufffd\ufffd\u00053\ufffd\ufffd \ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f294d40d2b11ab3f06c499c1f10f12811aef3af",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0014\ufffd(\ufffd\ufffd\bn\u0015u\ufffd\u0010moA\ufffdE\ufffd|\ufffds\ufffd\u0013\ufffd\u0002\ufffd;D\u0003>Wo \ufffd\u0199\u0017\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\u0004\ufffd9\ufffd\ufffd\ufffd\ufffd\u00053\ufffd\ufffd \ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "c83b9029f5aa95d3b7adfaf59e76d1dd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffdnu\ufffdmoA\ufffdE\ufffd|\ufffds\ufffd\ufffd\ufffd;D>Wo \ufffd\u0199\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\ufffd9\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0014\ufffd(\ufffd\ufffd\bn\u0015u\ufffd\u0010moA\ufffdE\ufffd|\ufffds\ufffd\u0013\ufffd\u0002\ufffd;D\u0003>Wo \ufffd\u0199\u0017\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\u0004\ufffd9\ufffd\ufffd\ufffd\ufffd\u00053\ufffd\ufffd \ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "c83b9029f5aa95d3b7adfaf59e76d1dd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffdnu\ufffdmoA\ufffdE\ufffd|\ufffds\ufffd\ufffd\ufffd;D>Wo \ufffd\u0199\ufffd\ufffd~>\ufffd\u058cDgjJ\ufffd\n\ufffd9\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d8577422d9974ec2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �QR�N�&�(���@���\�w7��v����, �F�-6���0��G�O:���-b_RS����� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �QR�N�&�(���@���\�w7��v����, �F�-6���0��G�O:���-b_RS����� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �QR�N�&�(���@���\�w7��v����, �F�-6���0��G�O:���-b_RS����� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �jj 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "d8577422d9974ec2541d83be70b09063",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.004995708849556,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "930310e13203414e08146b2d8c4f64570e36f7ed",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d8577422d9974ec2541d83be70b09063",
"payload_hash": "8e9c263a9ab49db8b070d22acbcd505b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003QR\ufffdN\ufffd&\ufffd(\ufffd\u0007\ufffd\ufffd@\ufffd\ufffd\ufffd\u0004\\\ufffdw7\ufffd\ufffdv\ufffd\u0005\ufffd\u0016\ufffd\ufffd, \ufffdF\ufffd\u0003-6\ufffd\ufffd\ufffd\u00120\ufffd\ufffd\u0004G\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003QR\ufffdN\ufffd&\ufffd(\ufffd\u0007\ufffd\ufffd@\ufffd\ufffd\ufffd\u0004\\\ufffdw7\ufffd\ufffdv\ufffd\u0005\ufffd\u0016\ufffd\ufffd, \ufffdF\ufffd\u0003-6\ufffd\ufffd\ufffd\u00120\ufffd\ufffd\u0004G\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdjj\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003QR\ufffdN\ufffd&\ufffd(\ufffd\u0007\ufffd\ufffd@\ufffd\ufffd\ufffd\u0004\\\ufffdw7\ufffd\ufffdv\ufffd\u0005\ufffd\u0016\ufffd\ufffd, \ufffdF\ufffd\u0003-6\ufffd\ufffd\ufffd\u00120\ufffd\ufffd\u0004G\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6dd543315b5b9d2557b1861c69b866f7263c50d4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003QR\ufffdN\ufffd&\ufffd(\ufffd\u0007\ufffd\ufffd@\ufffd\ufffd\ufffd\u0004\\\ufffdw7\ufffd\ufffdv\ufffd\u0005\ufffd\u0016\ufffd\ufffd, \ufffdF\ufffd\u0003-6\ufffd\ufffd\ufffd\u00120\ufffd\ufffd\u0004G\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "d8577422d9974ec2541d83be70b09063",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdQR\ufffdN\ufffd&\ufffd(\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\\\ufffdw7\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd, \ufffdF\ufffd-6\ufffd\ufffd\ufffd0\ufffd\ufffdG\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003QR\ufffdN\ufffd&\ufffd(\ufffd\u0007\ufffd\ufffd@\ufffd\ufffd\ufffd\u0004\\\ufffdw7\ufffd\ufffdv\ufffd\u0005\ufffd\u0016\ufffd\ufffd, \ufffdF\ufffd\u0003-6\ufffd\ufffd\ufffd\u00120\ufffd\ufffd\u0004G\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "d8577422d9974ec2541d83be70b09063",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdQR\ufffdN\ufffd&\ufffd(\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\\\ufffdw7\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd, \ufffdF\ufffd-6\ufffd\ufffd\ufffd0\ufffd\ufffdG\ufffdO:\ufffd\ufffd\ufffd-b_RS\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��N���qx��Yv|Q!<=��;`��� ���� �YI��bI�)*ƒ��k��0�H�.|2vɯ� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��N���qx��Yv|Q!<=��;`��� ���� �YI��bI�)*ƒ��k��0�H�.|2vɯ� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��N���qx��Yv|Q!<=��;`��� ���� �YI��bI�)*ƒ��k��0�H�.|2vɯ� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.009296537512266,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "7f2af4a6aece0d60e5ae7522070484dd",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\u000e\u0014\ufffd\u001d\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\u0016\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\u000e\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\u000e\u0014\ufffd\u001d\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\u0016\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\u000e\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\u000e\u0014\ufffd\u001d\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\u0016\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\u000e\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "145de60b8809f2471e204c9d05d6266d96c68b7d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\u000e\u0014\ufffd\u001d\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\u0016\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\u000e\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\u000e\u0014\ufffd\u001d\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\u0016\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\u000e\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdN\ufffd\ufffd\ufffdqx\ufffd\ufffdYv|Q!<=\ufffd\ufffd;`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdYI\ufffd\ufffdbI\ufffd)*\u0192\ufffd\ufffdk\ufffd\ufffd0\ufffdH\ufffd.|2v\u026f\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��l�B>&e_ѐ %a���ש� ����҅���� O��X�"���qO ���?�v�e� VZ6�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��l�B>&e_ѐ
%a���ש� ����҅���� O��X�"���qO ���?�v�e� VZ6�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��l�B>&e_ѐ %a���ש� ����҅���� O��X�"���qO ���?�v�e� VZ6�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.02616331550177,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "cf7a35582a8535e9ca0de54c842783d8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdl\ufffdB>&\u000fe_\u0450\u001a\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd \u001dO\ufffd\ufffdX\ufffd\"\ufffd\ufffd\u0001\ufffdqO\u001c\ufffd\ufffd\u0017\ufffd?\ufffdv\ufffde\ufffd\u001dVZ6\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdl\ufffdB>&\u000fe_\u0450\u001a\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd \u001dO\ufffd\ufffdX\ufffd\"\ufffd\ufffd\u0001\ufffdqO\u001c\ufffd\ufffd\u0017\ufffd?\ufffdv\ufffde\ufffd\u001dVZ6\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdl\ufffdB>&\u000fe_\u0450\u001a\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd \u001dO\ufffd\ufffdX\ufffd\"\ufffd\ufffd\u0001\ufffdqO\u001c\ufffd\ufffd\u0017\ufffd?\ufffdv\ufffde\ufffd\u001dVZ6\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfc8adb8ca86d77165efbcd7c5c79a640654e32b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdl\ufffdB>&\u000fe_\u0450\u001a\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd \u001dO\ufffd\ufffdX\ufffd\"\ufffd\ufffd\u0001\ufffdqO\u001c\ufffd\ufffd\u0017\ufffd?\ufffdv\ufffde\ufffd\u001dVZ6\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdl\ufffdB>&e_\u0450\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd O\ufffd\ufffdX\ufffd\"\ufffd\ufffd\ufffdqO\ufffd\ufffd\ufffd?\ufffdv\ufffde\ufffdVZ6\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdl\ufffdB>&\u000fe_\u0450\u001a\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd \u001dO\ufffd\ufffdX\ufffd\"\ufffd\ufffd\u0001\ufffdqO\u001c\ufffd\ufffd\u0017\ufffd?\ufffdv\ufffde\ufffd\u001dVZ6\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdl\ufffdB>&e_\u0450\n%a\ufffd\ufffd\ufffd\u05e9\ufffd\t\ufffd\ufffd\ufffd\ufffd\u0485\ufffd\ufffd\ufffd\ufffd O\ufffd\ufffdX\ufffd\"\ufffd\ufffd\ufffdqO\ufffd\ufffd\ufffd?\ufffdv\ufffde\ufffdVZ6\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �f i\\E�ek�:��wE��(ei�������O� qNm[t�:�K�< �6�F�Fp��+��gHx� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �f
i\\E�ek�:��wE��(ei�������O� qNm[t�:�K�< �6�F�Fp��+��gHx� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �f i\\E�ek�:��wE��(ei�������O� qNm[t�:�K�< �6�F�Fp��+��gHx� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.982461349725917,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "54a67083bf64ef7eb8c689fb7386bff1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003f\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\u0018\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd \u0003qNm[\u0016t\ufffd:\ufffdK\ufffd<\u001c\ufffd6\ufffdF\ufffdFp\ufffd\ufffd\u0011+\ufffd\ufffdgHx\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003f\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\u0018\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd \u0003qNm[\u0016t\ufffd:\ufffdK\ufffd<\u001c\ufffd6\ufffdF\ufffdFp\ufffd\ufffd\u0011+\ufffd\ufffdgHx\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003f\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\u0018\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd \u0003qNm[\u0016t\ufffd:\ufffdK\ufffd<\u001c\ufffd6\ufffdF\ufffdFp\ufffd\ufffd\u0011+\ufffd\ufffdgHx\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ef841e5b9af16bb7312a0f523e412753b810bbd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003f\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\u0018\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd \u0003qNm[\u0016t\ufffd:\ufffdK\ufffd<\u001c\ufffd6\ufffdF\ufffdFp\ufffd\ufffd\u0011+\ufffd\ufffdgHx\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdf\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd qNm[t\ufffd:\ufffdK\ufffd<\ufffd6\ufffdF\ufffdFp\ufffd\ufffd+\ufffd\ufffdgHx\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003f\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\u0018\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd \u0003qNm[\u0016t\ufffd:\ufffdK\ufffd<\u001c\ufffd6\ufffdF\ufffdFp\ufffd\ufffd\u0011+\ufffd\ufffdgHx\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdf\ni\\\\\u05fbE\ufffdek\ufffd:\ufffd\ufffdwE\ufffd\ufffd(ei\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\ufffd qNm[t\ufffd:\ufffdK\ufffd<\ufffd6\ufffdF\ufffdFp\ufffd\ufffd+\ufffd\ufffdgHx\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ����0��%��SV��T�v�M���-���C�+� gA�-C����/(6D@�� ���8������} � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����0��%��SV��T�v�M���-���C�+� gA�-C����/(6D@�� ���8������} � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����0��%��SV��T�v�M���-���C�+� gA�-C����/(6D@�� ���8������} � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 6.002928683548559,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "b01421790b721cedd2e0bb10819851e4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0019\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\u0005\ufffd\/(6D@\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\b8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011}\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0019\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\u0005\ufffd\/(6D@\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\b8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011}\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0019\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\u0005\ufffd\/(6D@\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\b8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011}\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0fdd2f133a2d93cbacd70a98c85727897390e98",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0019\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\u0005\ufffd\/(6D@\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\b8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011}\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\ufffd\/(6D@\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u0019\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\u0005\ufffd\/(6D@\ufffd\ufffd\u001d\ufffd\ufffd\ufffd\b8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011}\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd%\ufffd\ufffdSV\ufffd\ufffdT\ufffdv\ufffdM\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffdC\ufffd+\ufffd gA\ufffd-C\ufffd\ufffd\ufffd\ufffd\/(6D@\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd}\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �2����co� f�&����<2*�O���7[���? <J+í�K�sL���m�����Qٛ䍩:�t� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �2����co� f�&����<2*�O���7[���? <J+í�K�sL���m�����Qٛ䍩:�t� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �2����co� f�&����<2*�O���7[���? <J+í�K�sL���m�����Qٛ䍩:�t� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.953885222489449,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "69055a0760b2f66655178a0bc4ec223e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd\u0002<2*\ufffdO\ufffd\u000f\ufffd\ufffd7[\ufffd\ufffd\ufffd? \u0014<J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\u0002\ufffdt\u000e\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd\u0002<2*\ufffdO\ufffd\u000f\ufffd\ufffd7[\ufffd\ufffd\ufffd? \u0014<J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\u0002\ufffdt\u000e\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd\u0002<2*\ufffdO\ufffd\u000f\ufffd\ufffd7[\ufffd\ufffd\ufffd? \u0014<J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\u0002\ufffdt\u000e\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33f7a7c0016ee5559498ce4ecdc2fa4946ae75f4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd\u0002<2*\ufffdO\ufffd\u000f\ufffd\ufffd7[\ufffd\ufffd\ufffd? \u0014<J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\u0002\ufffdt\u000e\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd<2*\ufffdO\ufffd\ufffd\ufffd7[\ufffd\ufffd\ufffd? <J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00032\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd\u0002<2*\ufffdO\ufffd\u000f\ufffd\ufffd7[\ufffd\ufffd\ufffd? \u0014<J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\u0002\ufffdt\u000e\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffdco\ufffd\tf\ufffd&\ufffd\ufffd\ufffd\ufffd<2*\ufffdO\ufffd\ufffd\ufffd7[\ufffd\ufffd\ufffd? <J+\u00ed\ufffdK\ufffdsL\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdQ\u065b\u4369:\ufffdt\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T Pʩ0��7���I%T�k�l�:��G>�q��`4KK �b�k8�|�H�)|��Nn��9��*�0��] F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T Pʩ0��7���I%T�k�l�:��G>�q��`4KK �b�k8�|�H�)|��Nn��9��*�0��] F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T Pʩ0��7���I%T�k�l�:��G>�q��`4KK �b�k8�|�H�)|��Nn��9��*�0��] F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.123451890048411,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "9cc212c40b8dc2031fe3ed2a2381d67e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI\u0012%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG\u0012>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\u0016\ufffd9\ufffd\u0019\ufffd*\u0004\ufffd0\ufffd\ufffd\u000f]\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI\u0012%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG\u0012>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\u0016\ufffd9\ufffd\u0019\ufffd*\u0004\ufffd0\ufffd\ufffd\u000f]\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI\u0012%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG\u0012>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\u0016\ufffd9\ufffd\u0019\ufffd*\u0004\ufffd0\ufffd\ufffd\u000f]\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "365e90ebb3ce960b9d87330eec06a36643a51864",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI\u0012%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG\u0012>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\u0016\ufffd9\ufffd\u0019\ufffd*\u0004\ufffd0\ufffd\ufffd\u000f]\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\ufffd9\ufffd\ufffd*\ufffd0\ufffd\ufffd]F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI\u0012%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG\u0012>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\u0016\ufffd9\ufffd\u0019\ufffd*\u0004\ufffd0\ufffd\ufffd\u000f]\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\u02a90\ufffd\ufffd7\ufffd\ufffd\ufffdI%T\ufffdk\ufffdl\ufffd:\ufffd\ufffdG>\ufffdq\ufffd\ufffd`4KK \ufffdb\ufffdk8\ufffd|\ufffdH\ufffd)|\ufffd\ufffdNn\ufffd\ufffd9\ufffd\ufffd*\ufffd0\ufffd\ufffd]F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B*��6�z��� �������Ɣ�f �!C��e �7�(5��m�]}����@�45*� �BT�R��� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B*��6�z��� �������Ɣ�f �!C��e �7�(5��m�]}����@�45*� �BT�R��� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B*��6�z��� �������Ɣ�f �!C��e �7�(5��m�]}����@�45*� �BT�R��� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.989280387482358,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "c658fd2ac66fdc45bbe0d06a6b113495",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003*\u0014\b\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\u001f\u0014\ufffd!C\ufffd\ufffd\u0018e \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45\u0013*\ufffd\u001f\ufffdBT\u0007\ufffdR\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003*\u0014\b\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\u001f\u0014\ufffd!C\ufffd\ufffd\u0018e \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45\u0013*\ufffd\u001f\ufffdBT\u0007\ufffdR\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003*\u0014\b\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\u001f\u0014\ufffd!C\ufffd\ufffd\u0018e \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45\u0013*\ufffd\u001f\ufffdBT\u0007\ufffdR\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3108858e9c6c43d49a7678e9e5fea9fd71d5d660",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003*\u0014\b\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\u001f\u0014\ufffd!C\ufffd\ufffd\u0018e \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45\u0013*\ufffd\u001f\ufffdBT\u0007\ufffdR\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB*\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\ufffd!C\ufffd\ufffde \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45*\ufffd\ufffdBT\ufffdR\ufffd\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003*\u0014\b\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\u001f\u0014\ufffd!C\ufffd\ufffd\u0018e \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45\u0013*\ufffd\u001f\ufffdBT\u0007\ufffdR\ufffd\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB*\ufffd\ufffd6\ufffdz\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0194\ufffdf\ufffd!C\ufffd\ufffde \ufffd7\ufffd(5\ufffd\ufffdm\ufffd]}\ufffd\ufffd\ufffd\ufffd@\ufffd45*\ufffd\ufffdBT\ufffdR\ufffd\ufffd\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
����:˛���W��s��� ��� �I �}�� V ������O%�:~���Bq����.@�B{Weq� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����:˛���W��s���
��� �I �}�� V ������O%�:~���Bq����.@�B{Weq� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
����:˛���W��s��� ��� �I �}�� V ������O%�:~���Bq����.@�B{Weq� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9244193407320664,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "7166d4f44dece94fec8d72bd737af563",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd:\u02db\u0005\u000f\ufffd\ufffd\ufffdW\ufffd\ufffds\u0011\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u001e\ufffdI \u000b\ufffd}\ufffd\ufffd V\u0016\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd:\u02db\u0005\u000f\ufffd\ufffd\ufffdW\ufffd\ufffds\u0011\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u001e\ufffdI \u000b\ufffd}\ufffd\ufffd V\u0016\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd:\u02db\u0005\u000f\ufffd\ufffd\ufffdW\ufffd\ufffds\u0011\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u001e\ufffdI \u000b\ufffd}\ufffd\ufffd V\u0016\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8045df21924561a62a938cf4fe283d1a0598755",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd:\u02db\u0005\u000f\ufffd\ufffd\ufffdW\ufffd\ufffds\u0011\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u001e\ufffdI \u000b\ufffd}\ufffd\ufffd V\u0016\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd:\u02db\ufffd\ufffd\ufffdW\ufffd\ufffds\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdI \ufffd}\ufffd\ufffd V\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd:\u02db\u0005\u000f\ufffd\ufffd\ufffdW\ufffd\ufffds\u0011\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\u001e\ufffdI \u000b\ufffd}\ufffd\ufffd V\u0016\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd:\u02db\ufffd\ufffd\ufffdW\ufffd\ufffds\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffdI \ufffd}\ufffd\ufffd V\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO%\ufffd:~\ufffd\ufffd\ufffdBq\ufffd\ufffd\ufffd\ufffd.@\ufffdB{Weq\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �טix�Дu�} �݄q����B� ��86 ���Ã�� �|��9K��1�f`<��g�����U� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �טix�Дu�} �݄q����B� ��86 ���Ã��
�|��9K��1�f`<��g�����U� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �טix�Дu�} �݄q����B� ��86 ���Ã�� �|��9K��1�f`<��g�����U� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.024046669233308,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "634d5056a2e3389e979ebfd62069cbbd",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744\u0018q\u0014\ufffd\ufffd\ufffd\ufffdB\u0019\u0018\ufffd\u0011\u001f\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\u0016\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744\u0018q\u0014\ufffd\ufffd\ufffd\ufffdB\u0019\u0018\ufffd\u0011\u001f\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\u0016\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744\u0018q\u0014\ufffd\ufffd\ufffd\ufffdB\u0019\u0018\ufffd\u0011\u001f\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\u0016\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f96ebb4d01a9ac4a870bf90e858e487325859a82",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744\u0018q\u0014\ufffd\ufffd\ufffd\ufffdB\u0019\u0018\ufffd\u0011\u001f\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\u0016\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744q\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744\u0018q\u0014\ufffd\ufffd\ufffd\ufffdB\u0019\u0018\ufffd\u0011\u001f\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\u0016\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u05d8ix\ufffd\u0414u\ufffd} \ufffd\u0744q\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd86 \ufffd\ufffd\ufffd\u00c3\ufffd\ufffd\r\ufffd|\ufffd\ufffd9K\ufffd\ufffd1\ufffdf`<\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��d�` Z}��Ȇ2tT�2qC��y�_���֢ �Z�#���O*g�������{��5�7�>�>��� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��d�` Z}��Ȇ2tT�2qC��y�_���֢ �Z�#���O*g�������{��5�7�>�>��� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��d�` Z}��Ȇ2tT�2qC��y�_���֢ �Z�#���O*g�������{��5�7�>�>��� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.00797955325445,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "67351d615a6952de82f3d3881e314cac",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u0018d\u0007\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\u0010\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\u0013\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u0018d\u0007\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\u0010\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\u0013\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u0018d\u0007\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\u0010\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\u0013\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5cc766eb4afa2bf1be5fb93aeb81e2cfbb39257",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u0018d\u0007\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\u0010\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\u0013\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdd\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u0018d\u0007\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\u0010\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\u0013\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdd\ufffd`\tZ}\ufffd\ufffd\u02062tT\ufffd2qC\ufffd\ufffdy\ufffd_\ufffd\ufffd\ufffd\u05a2 \ufffdZ\ufffd#\ufffd\ufffd\ufffdO*g\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd5\ufffd7\ufffd>\ufffd>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��][��n.�]�ԃ5���f����tP�H5{F3�n �>0� �Y�k�a ܃?� c"�M|�!���͖ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��][��n.�]�ԃ5���f����tP�H5{F3�n �>0� �Y�k�a
܃?� c"�M|�!���͖ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��][��n.�]�ԃ5���f����tP�H5{F3�n �>0� �Y�k�a ܃?� c"�M|�!���͖ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.021265318196234,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "8ed0e054c340e7dfca624bbcac7b961f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd][\ufffd\u0018\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\u000b\ufffdY\ufffdk\ufffda\n\u001f\u0703?\ufffd\u001ec\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd][\ufffd\u0018\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\u000b\ufffdY\ufffdk\ufffda\n\u001f\u0703?\ufffd\u001ec\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd][\ufffd\u0018\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\u000b\ufffdY\ufffdk\ufffda\n\u001f\u0703?\ufffd\u001ec\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fac2499d20600a03a1055bbdbc08e8efa438cd3f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd][\ufffd\u0018\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\u000b\ufffdY\ufffdk\ufffda\n\u001f\u0703?\ufffd\u001ec\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd][\ufffd\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\ufffdY\ufffdk\ufffda\n\u0703?\ufffdc\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd][\ufffd\u0018\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\u000b\ufffdY\ufffdk\ufffda\n\u001f\u0703?\ufffd\u001ec\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd][\ufffd\ufffdn.\ufffd]\ufffd\u05035\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffdtP\ufffdH5{F3\ufffdn \ufffd>0\ufffd\ufffdY\ufffdk\ufffda\n\u0703?\ufffdc\"\ufffdM|\ufffd!\ufffd\ufffd\ufffd\u0356\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a57067f810685237 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �& zg�@��+� l)^5}��6#3/f�ɱ�� ���6�s<�c��βKm¿��q�`;N��! �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&
zg�@��+� l)^5}��6#3/f�ɱ�� ���6�s<�c��βKm¿��q�`;N��! �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �& zg�@��+� l)^5}��6#3/f�ɱ�� ���6�s<�c��βKm¿��q�`;N��! �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "a57067f810685237c7cea0e08baf702b",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.983238459939769,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "12e82706666b30c0bc850f9b8e2df3988c10839e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a57067f810685237c7cea0e08baf702b",
"payload_hash": "5565f5ab5bde1ab3b211b30167e005f8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\nzg\ufffd@\ufffd\ufffd\u0015+\ufffd\tl)^\u00055}\ufffd\ufffd6#\u00053\/f\ufffd\u0271\u0018\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\u0012\ufffdc\ufffd\ufffd\b\u03b2\bKm\u00bf\ufffd\ufffd\u0011q\ufffd`;N\ufffd\ufffd!\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\nzg\ufffd@\ufffd\ufffd\u0015+\ufffd\tl)^\u00055}\ufffd\ufffd6#\u00053\/f\ufffd\u0271\u0018\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\u0012\ufffdc\ufffd\ufffd\b\u03b2\bKm\u00bf\ufffd\ufffd\u0011q\ufffd`;N\ufffd\ufffd!\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\nzg\ufffd@\ufffd\ufffd\u0015+\ufffd\tl)^\u00055}\ufffd\ufffd6#\u00053\/f\ufffd\u0271\u0018\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\u0012\ufffdc\ufffd\ufffd\b\u03b2\bKm\u00bf\ufffd\ufffd\u0011q\ufffd`;N\ufffd\ufffd!\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1682bb832068cf06a7e7a599ee029f15eb4f13a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\nzg\ufffd@\ufffd\ufffd\u0015+\ufffd\tl)^\u00055}\ufffd\ufffd6#\u00053\/f\ufffd\u0271\u0018\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\u0012\ufffdc\ufffd\ufffd\b\u03b2\bKm\u00bf\ufffd\ufffd\u0011q\ufffd`;N\ufffd\ufffd!\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "a57067f810685237c7cea0e08baf702b",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd&\nzg\ufffd@\ufffd\ufffd+\ufffd\tl)^5}\ufffd\ufffd6#3\/f\ufffd\u0271\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\ufffdc\ufffd\ufffd\u03b2Km\u00bf\ufffd\ufffdq\ufffd`;N\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003&\nzg\ufffd@\ufffd\ufffd\u0015+\ufffd\tl)^\u00055}\ufffd\ufffd6#\u00053\/f\ufffd\u0271\u0018\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\u0012\ufffdc\ufffd\ufffd\b\u03b2\bKm\u00bf\ufffd\ufffd\u0011q\ufffd`;N\ufffd\ufffd!\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "a57067f810685237c7cea0e08baf702b",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd&\nzg\ufffd@\ufffd\ufffd+\ufffd\tl)^5}\ufffd\ufffd6#3\/f\ufffd\u0271\ufffd\ufffd \ufffd\ufffd\ufffd6\ufffds<\ufffdc\ufffd\ufffd\u03b2Km\u00bf\ufffd\ufffdq\ufffd`;N\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �]�g�z"n�p�k?L����?>AkE_s2#� � �D�Z�٫�<�&��� r(�#a{ ��FE � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �]�g�z"n�p�k?L����?>AkE_s2#� � �D�Z�٫�<�&��� r(�#a{ ��FE � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �]�g�z"n�p�k?L����?>AkE_s2#� � �D�Z�٫�<�&��� r(�#a{ ��FE � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.941950434100231,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "73b70bdd4c8ffa3556cc5e2981b180a1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003]\ufffdg\ufffdz\"n\ufffdp\u0005\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\u0010\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\u0015\ufffd&\ufffd\b\ufffd\ufffd\u0000\u000br(\ufffd#a{\u0000\u0016\ufffd\ufffdFE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003]\ufffdg\ufffdz\"n\ufffdp\u0005\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\u0010\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\u0015\ufffd&\ufffd\b\ufffd\ufffd\u0000\u000br(\ufffd#a{\u0000\u0016\ufffd\ufffdFE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003]\ufffdg\ufffdz\"n\ufffdp\u0005\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\u0010\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\u0015\ufffd&\ufffd\b\ufffd\ufffd\u0000\u000br(\ufffd#a{\u0000\u0016\ufffd\ufffdFE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "788c43a069fff3cd3eb4c322a275acea299422e7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003]\ufffdg\ufffdz\"n\ufffdp\u0005\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\u0010\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\u0015\ufffd&\ufffd\b\ufffd\ufffd\u0000\u000br(\ufffd#a{\u0000\u0016\ufffd\ufffdFE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd]\ufffdg\ufffdz\"n\ufffdp\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\ufffd&\ufffd\ufffd\ufffdr(\ufffd#a{\ufffd\ufffdFE\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003]\ufffdg\ufffdz\"n\ufffdp\u0005\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\u0010\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\u0015\ufffd&\ufffd\b\ufffd\ufffd\u0000\u000br(\ufffd#a{\u0000\u0016\ufffd\ufffdFE\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd]\ufffdg\ufffdz\"n\ufffdp\ufffdk?L\ufffd\ufffd\ufffd\ufffd?>AkE_s2#\ufffd \ufffd \ufffdD\ufffdZ\ufffd\u066b\ufffd<\ufffd&\ufffd\ufffd\ufffdr(\ufffd#a{\ufffd\ufffdFE\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P���UE����y�S�m��H���[Ӑ�R �x�� f�")�bj���'�C�^_�6�l��O��<A�u\ F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P���UE����y�S�m��H���[Ӑ�R �x�� f�")�bj���'�C�^_�6�l��O��<A�u\ F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P���UE����y�S�m��H���[Ӑ�R �x�� f�")�bj���'�C�^_�6�l��O��<A�u\ F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.1101477584930235,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "3481ff321353df0ca843f68d3c9c9273",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\u0018\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\b\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\u0013\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\u0007\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\u0018\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\b\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\u0013\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\u0007\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\u0018\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\b\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\u0013\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\u0007\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c63c08af980719fea9a15b75f32af9779e6a07d4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\u0018\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\b\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\u0013\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\u0007\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\u0018\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\b\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\u0013\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\u0007\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd\ufffd\ufffdUE\ufffd\ufffd\ufffd\ufffdy\ufffdS\ufffdm\ufffd\ufffdH\ufffd\ufffd\ufffd[\u04d0\ufffdR\t\ufffdx\ufffd\ufffd f\ufffd\")\ufffdbj\ufffd\ufffd\ufffd'\ufffdC\ufffd^_\ufffd6\ufffdl\ufffd\ufffdO\ufffd\ufffd<A\ufffdu\\F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�����05м�5@!��tlx�{�f��X���{� Q ��e����v<���1[���rl�t��˂ D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�����05м�5@!��tlx�{�f��X���{� Q ��e����v<���1[���rl�t��˂ D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�����05м�5@!��tlx�{�f��X���{� Q ��e����v<���1[���rl�t��˂ D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.9907005605535675,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "9bab6259f0c5772089bbb39bbd9d8693",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd\u00055@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\u0001\ufffd\ufffd\ufffd{\ufffd \u000bQ\u0014\u0000\u001e\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2\u0002\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd\u00055@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\u0001\ufffd\ufffd\ufffd{\ufffd \u000bQ\u0014\u0000\u001e\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2\u0002\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd\u00055@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\u0001\ufffd\ufffd\ufffd{\ufffd \u000bQ\u0014\u0000\u001e\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2\u0002\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "521c8dfb7e81b69f1b024536b822af53b49a317c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd\u00055@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\u0001\ufffd\ufffd\ufffd{\ufffd \u000bQ\u0014\u0000\u001e\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2\u0002\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd5@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\ufffd\ufffd\ufffd{\ufffd Q\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd\u00055@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\u0001\ufffd\ufffd\ufffd{\ufffd \u000bQ\u0014\u0000\u001e\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2\u0002\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffd\ufffd\ufffd\ufffd\ufffd05\u043c\ufffd5@!\ufffd\ufffdtlx\ufffd{\ufffdf\ufffd\ufffdX\ufffd\ufffd\ufffd{\ufffd Q\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdv<\ufffd\ufffd\ufffd1[\ufffd\ufffd\ufffdrl\ufffdt\ufffd\ufffd\u02c2D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 5a5d080c935634eb SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��v fL-;�z,��IP,N������H5<�� �?��M��o�]� �S<"�5�ұ�:|`C�B �dz �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��v fL-;�z,��IP,N������H5<�� �?��M��o�]� �S<"�5�ұ�:|`C�B
�dz �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��v fL-;�z,��IP,N������H5<�� �?��M��o�]� �S<"�5�ұ�:|`C�B �dz �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "5a5d080c935634eb694d18e7542b1d2e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.006116217305992,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "73d73723d2e7fec3e7253c45c23b538d831be98e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "5a5d080c935634eb694d18e7542b1d2e",
"payload_hash": "67014ad8b0f9fb557231e3abba6821a3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u001cf\u0016\u0010L-;\ufffdz,\ufffd\ufffdIP,\u0014N\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u001cf\u0016\u0010L-;\ufffdz,\ufffd\ufffdIP,\u0014N\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u001cf\u0016\u0010L-;\ufffdz,\ufffd\ufffdIP,\u0014N\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "01f676569284d794085e184dda076f9c2c365df4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u001cf\u0016\u0010L-;\ufffdz,\ufffd\ufffdIP,\u0014N\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "5a5d080c935634eb694d18e7542b1d2e",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdvfL-;\ufffdz,\ufffd\ufffdIP,N\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\ufffd::\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdv\u001cf\u0016\u0010L-;\ufffdz,\ufffd\ufffdIP,\u0014N\ufffd\ufffd\ufffd\ufffd\ufffd\u000f\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "5a5d080c935634eb694d18e7542b1d2e",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdvfL-;\ufffdz,\ufffd\ufffdIP,N\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH5<\ufffd\ufffd \ufffd?\ufffd\ufffdM\ufffd\ufffdo\ufffd]\ufffd \ufffdS<\"\ufffd5\ufffd\u04b1\ufffd:|`C\ufffdB\n\ufffd\u01f3\ufffd::\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���D#��̺���f��I��v_Ɋ�Za�B i�=]���r����YA�k� v���)�@����v� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���D#��̺���f��I��v_Ɋ�Za�B i�=]���r����YA�k�
v���)�@����v� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���D#��̺���f��I��v_Ɋ�Za�B i�=]���r����YA�k� v���)�@����v� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.017232998075629,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "2b38bcb890a41e750c9f178331ef91f3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0004\u0015\ufffdD\u0018#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffd\u001bI\u001b\ufffd\ufffdv_\u024a\u0014\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd\u0001)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0004\u0015\ufffdD\u0018#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffd\u001bI\u001b\ufffd\ufffdv_\u024a\u0014\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd\u0001)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0004\u0015\ufffdD\u0018#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffd\u001bI\u001b\ufffd\ufffdv_\u024a\u0014\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd\u0001)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36210d93aef32a59b5812f388e20a41eb1f67996",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0004\u0015\ufffdD\u0018#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffd\u001bI\u001b\ufffd\ufffdv_\u024a\u0014\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd\u0001)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdD#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffdI\ufffd\ufffdv_\u024a\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0004\u0015\ufffdD\u0018#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffd\u001bI\u001b\ufffd\ufffdv_\u024a\u0014\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd\u0001)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdD#\ufffd\ufffd\u033a\ufffd\ufffd\ufffdf\ufffd\ufffdI\ufffd\ufffdv_\u024a\ufffdZa\ufffdB i\ufffd=]\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffdYA\ufffdk\ufffd\nv\ufffd\ufffd\ufffd)\ufffd@\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���K�c������W�#�� � �L��]���� bs���k�~#Q4CX�K-StUj�9P>Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���K�c������W�#�� � �L��]���� bs���k�~#Q4CX�K-StUj�9P>Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���K�c������W�#�� � �L��]���� bs���k�~#Q4CX�K-StUj�9P>Y�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.986563009065136,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "21737f97f3ddbbca584493c23f0b8c9c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\u0007\ufffd\u0015 bs\ufffd\ufffd\ufffdk\u0016\u0007\ufffd~#Q4C\u0014X\ufffdK-\u0013StUj\ufffd9P>Y\u0015\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\u0007\ufffd\u0015 bs\ufffd\ufffd\ufffdk\u0016\u0007\ufffd~#Q4C\u0014X\ufffdK-\u0013StUj\ufffd9P>Y\u0015\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\u0007\ufffd\u0015 bs\ufffd\ufffd\ufffdk\u0016\u0007\ufffd~#Q4C\u0014X\ufffdK-\u0013StUj\ufffd9P>Y\u0015\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd567ee742bf59e40728e655a1038f800838127d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\u0007\ufffd\u0015 bs\ufffd\ufffd\ufffdk\u0016\u0007\ufffd~#Q4C\u0014X\ufffdK-\u0013StUj\ufffd9P>Y\u0015\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd bs\ufffd\ufffd\ufffdk\ufffd~#Q4CX\ufffdK-StUj\ufffd9P>Y\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\u0007\ufffd\u0015 bs\ufffd\ufffd\ufffdk\u0016\u0007\ufffd~#Q4C\u0014X\ufffdK-\u0013StUj\ufffd9P>Y\u0015\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdK\ufffdc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd#\ufffd\ufffd\t\ufffd\t\t\ufffdL\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd bs\ufffd\ufffd\ufffdk\ufffd~#Q4CX\ufffdK-StUj\ufffd9P>Y\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
���=3�� 1C�{.�Y��A3�tt�_>#0�c� �%6�T-����`, 0����T�����: ��> >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���=3�� 1C�{.�Y��A3�tt�_>#0�c�
�%6�T-����`, 0����T�����: ��> >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
���=3�� 1C�{.�Y��A3�tt�_>#0�c� �%6�T-����`, 0����T�����: ��> >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.941152137479813,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "223043954b1324d25aebfd1f49e6f1d5",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0012\ufffd\ufffd=3\ufffd\ufffd\u001c1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffd\u0004c\ufffd\u0010 \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd\u0005`,\u000b0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0012\ufffd\ufffd=3\ufffd\ufffd\u001c1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffd\u0004c\ufffd\u0010 \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd\u0005`,\u000b0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0012\ufffd\ufffd=3\ufffd\ufffd\u001c1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffd\u0004c\ufffd\u0010 \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd\u0005`,\u000b0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c533ecad37085ee0ca8537075d20f07b677bab4e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0012\ufffd\ufffd=3\ufffd\ufffd\u001c1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffd\u0004c\ufffd\u0010 \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd\u0005`,\u000b0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd=3\ufffd\ufffd1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffdc\ufffd \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd`,0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0012\ufffd\ufffd=3\ufffd\ufffd\u001c1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffd\u0004c\ufffd\u0010 \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd\u0005`,\u000b0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd=3\ufffd\ufffd1C\ufffd{.\ufffdY\ufffd\ufffdA3\ufffdtt\ufffd_>#0\ufffdc\ufffd \n\ufffd%6\ufffdT-\ufffd\ufffd\ufffd\ufffd`,0\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffd: \ufffd\ufffd>>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 64c11c772456c926 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��d/�n����4/Lh5@\�vr������yľ 7(Ĩ ��\[yO��7��n�0���i��3� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��d/�n����4/Lh5@\�vr������yľ 7(Ĩ ��\[yO��7��n�0���i��3� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��d/�n����4/Lh5@\�vr������yľ 7(Ĩ ��\[yO��7��n�0���i��3� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �:: 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "64c11c772456c9268f31cad622602793",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.974125464384493,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "408339e42bda4b83192ced67d556328042dab125",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "64c11c772456c9268f31cad622602793",
"payload_hash": "7d2b8e280a1209bed79cd26ab4f4e7f2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh\u00045@\u001a\\\ufffdvr\ufffd\ufffd\u0013\ufffd\u0007\ufffd\ufffd\ufffdy\u013e 7(\u0010\u0128\f\ufffd\ufffd\\[yO\ufffd\ufffd\u00127\u0012\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh\u00045@\u001a\\\ufffdvr\ufffd\ufffd\u0013\ufffd\u0007\ufffd\ufffd\ufffdy\u013e 7(\u0010\u0128\f\ufffd\ufffd\\[yO\ufffd\ufffd\u00127\u0012\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd::\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh\u00045@\u001a\\\ufffdvr\ufffd\ufffd\u0013\ufffd\u0007\ufffd\ufffd\ufffdy\u013e 7(\u0010\u0128\f\ufffd\ufffd\\[yO\ufffd\ufffd\u00127\u0012\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43bcc830ff68b3e0d6193e63f3f15fc1d447805c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh\u00045@\u001a\\\ufffdvr\ufffd\ufffd\u0013\ufffd\u0007\ufffd\ufffd\ufffdy\u013e 7(\u0010\u0128\f\ufffd\ufffd\\[yO\ufffd\ufffd\u00127\u0012\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "64c11c772456c9268f31cad622602793",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh5@\\\ufffdvr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u013e 7(\u0128\ufffd\ufffd\\[yO\ufffd\ufffd7\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh\u00045@\u001a\\\ufffdvr\ufffd\ufffd\u0013\ufffd\u0007\ufffd\ufffd\ufffdy\u013e 7(\u0010\u0128\f\ufffd\ufffd\\[yO\ufffd\ufffd\u00127\u0012\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "64c11c772456c9268f31cad622602793",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdd\/\ufffdn\ufffd\ufffd\ufffd\ufffd4\/Lh5@\\\ufffdvr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\u013e 7(\u0128\ufffd\ufffd\\[yO\ufffd\ufffd7\ufffd\ufffdn\ufffd0\ufffd\ufffd\ufffdi\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �T?H6��Al�g��%+%b�p���L�5�� �JQ� ��r I�e�B襠�ϥ�:3�n��+�& � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �T?H6��Al�g��%+%b�p���L�5�� �JQ� ��r I�e�B襠�ϥ�:3�n��+�& � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �T?H6��Al�g��%+%b�p���L�5�� �JQ� ��r I�e�B襠�ϥ�:3�n��+�& � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.995313101781349,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "6069a1dc3c00ab37036aa3b3d2e2f18b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002T\u0004?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\u001b\ufffdL\u0004\ufffd\u00175\ufffd\ufffd\u0012 \ufffdJQ\ufffd\u0000\ufffd\ufffdr\u001fI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002T\u0004?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\u001b\ufffdL\u0004\ufffd\u00175\ufffd\ufffd\u0012 \ufffdJQ\ufffd\u0000\ufffd\ufffdr\u001fI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002T\u0004?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\u001b\ufffdL\u0004\ufffd\u00175\ufffd\ufffd\u0012 \ufffdJQ\ufffd\u0000\ufffd\ufffdr\u001fI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7624ab7322a21c8e9c87a110cb00cd905ec096af",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002T\u0004?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\u001b\ufffdL\u0004\ufffd\u00175\ufffd\ufffd\u0012 \ufffdJQ\ufffd\u0000\ufffd\ufffdr\u001fI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdT?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\ufffdL\ufffd5\ufffd\ufffd \ufffdJQ\ufffd\ufffd\ufffdrI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002T\u0004?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\u001b\ufffdL\u0004\ufffd\u00175\ufffd\ufffd\u0012 \ufffdJQ\ufffd\u0000\ufffd\ufffdr\u001fI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdT?H6\ufffd\ufffdAl\ufffdg\ufffd\ufffd%+%b\ufffdp\ufffd\ufffd\ufffdL\ufffd5\ufffd\ufffd \ufffdJQ\ufffd\ufffd\ufffdrI\ufffde\ufffdB\u8960\ufffd\u03e5\ufffd:3\ufffdn\ufffd\ufffd\u0603+\ufffd&\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���3Ul=WD�̀N\0P�G^������٭�m ���FB`� �A ���������=� ��B� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���3Ul=WD�̀N\0P�G^������٭�m ���FB`� �A ���������=� ��B� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���3Ul=WD�̀N\0P�G^������٭�m ���FB`� �A ���������=� ��B� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.972852107872759,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "39d7eb1061d629dad21f09480af68eac",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd3Ul=\u0011WD\ufffd\u0300\u0016N\\0P\ufffdG^\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\f\u0019\ufffdA\f\ufffd\ufffd\ufffd\ufffd\u0018\u0015\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\u0001\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd3Ul=\u0011WD\ufffd\u0300\u0016N\\0P\ufffdG^\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\f\u0019\ufffdA\f\ufffd\ufffd\ufffd\ufffd\u0018\u0015\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\u0001\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd3Ul=\u0011WD\ufffd\u0300\u0016N\\0P\ufffdG^\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\f\u0019\ufffdA\f\ufffd\ufffd\ufffd\ufffd\u0018\u0015\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\u0001\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a8a246973676eac481714d7197fee9fdca09dc1f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd3Ul=\u0011WD\ufffd\u0300\u0016N\\0P\ufffdG^\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\f\u0019\ufffdA\f\ufffd\ufffd\ufffd\ufffd\u0018\u0015\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\u0001\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd3Ul=WD\ufffd\u0300N\\0P\ufffdG^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd3Ul=\u0011WD\ufffd\u0300\u0016N\\0P\ufffdG^\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\f\u0019\ufffdA\f\ufffd\ufffd\ufffd\ufffd\u0018\u0015\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\u0001\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd3Ul=WD\ufffd\u0300N\\0P\ufffdG^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u066d\ufffdm \ufffd\ufffd\ufffdFB`\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\t\ufffd\ufffdB\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��ו�9!�yqP6K �TjuPY�V�� g�� ��"˳a�o�0~�,��'��һIʅ:5�Y��Z � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ו�9!�yqP6K �TjuPY�V�� g�� ��"˳a�o�0~�,��'��һIʅ:5�Y��Z � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��ו�9!�yqP6K �TjuPY�V�� g�� ��"˳a�o�0~�,��'��һIʅ:5�Y��Z � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.033382144382831,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "9d5f00721577a320d7bf4294601f922f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u05d5\ufffd\u00179!\ufffdyqP6K\u001c\ufffdTjuP\u0006Y\ufffdV\ufffd\ufffd\u001a\u001cg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd\u00110~\ufffd,\u0012\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u05d5\ufffd\u00179!\ufffdyqP6K\u001c\ufffdTjuP\u0006Y\ufffdV\ufffd\ufffd\u001a\u001cg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd\u00110~\ufffd,\u0012\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u05d5\ufffd\u00179!\ufffdyqP6K\u001c\ufffdTjuP\u0006Y\ufffdV\ufffd\ufffd\u001a\u001cg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd\u00110~\ufffd,\u0012\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af84f3a28eebdbbc91f4b2e142c6181273ea80a9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u05d5\ufffd\u00179!\ufffdyqP6K\u001c\ufffdTjuP\u0006Y\ufffdV\ufffd\ufffd\u001a\u001cg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd\u00110~\ufffd,\u0012\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u05d5\ufffd9!\ufffdyqP6K\ufffdTjuPY\ufffdV\ufffd\ufffdg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd0~\ufffd,\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u05d5\ufffd\u00179!\ufffdyqP6K\u001c\ufffdTjuP\u0006Y\ufffdV\ufffd\ufffd\u001a\u001cg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd\u00110~\ufffd,\u0012\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u05d5\ufffd9!\ufffdyqP6K\ufffdTjuPY\ufffdV\ufffd\ufffdg\ufffd\ufffd \ufffd\ufffd\"\u02f3a\ufffdo\ufffd0~\ufffd,\ufffd\ufffd'\ufffd\ufffd\u04bbI\u0285:5\ufffdY\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �����?l8�|JX�X��h�$q� �v�칷�����6��� 6�H]U�Q��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����?l8�|JX�X��h�$q� �v�칷�����6��� 6�H]U�Q��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �����?l8�|JX�X��h�$q� �v�칷�����6��� 6�H]U�Q��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.0238288805624505,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "2a754c37d6277577dde58575ff7003fa",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000e\ufffd\u0094\ufffd\ufffd\u0005\ufffd?l\u00188\ufffd|JX\ufffdX\u0001\ufffd\ufffd\u0018h\ufffd$q\ufffd\u0017 \ufffdv\u0011\u0013\ufffd\uce77\ufffd\u0014\ufffd\u0013\ufffd\ufffd\ufffd6\ufffd\ufffd\u0004\ufffd\u001e6\ufffdH]U\u000e\ufffdQ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000e\ufffd\u0094\ufffd\ufffd\u0005\ufffd?l\u00188\ufffd|JX\ufffdX\u0001\ufffd\ufffd\u0018h\ufffd$q\ufffd\u0017 \ufffdv\u0011\u0013\ufffd\uce77\ufffd\u0014\ufffd\u0013\ufffd\ufffd\ufffd6\ufffd\ufffd\u0004\ufffd\u001e6\ufffdH]U\u000e\ufffdQ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000e\ufffd\u0094\ufffd\ufffd\u0005\ufffd?l\u00188\ufffd|JX\ufffdX\u0001\ufffd\ufffd\u0018h\ufffd$q\ufffd\u0017 \ufffdv\u0011\u0013\ufffd\uce77\ufffd\u0014\ufffd\u0013\ufffd\ufffd\ufffd6\ufffd\ufffd\u0004\ufffd\u001e6\ufffdH]U\u000e\ufffdQ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df169e23246b263f20131970fb222ea7a693072e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000e\ufffd\u0094\ufffd\ufffd\u0005\ufffd?l\u00188\ufffd|JX\ufffdX\u0001\ufffd\ufffd\u0018h\ufffd$q\ufffd\u0017 \ufffdv\u0011\u0013\ufffd\uce77\ufffd\u0014\ufffd\u0013\ufffd\ufffd\ufffd6\ufffd\ufffd\u0004\ufffd\u001e6\ufffdH]U\u000e\ufffdQ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u0094\ufffd\ufffd\ufffd?l8\ufffd|JX\ufffdX\ufffd\ufffdh\ufffd$q\ufffd \ufffdv\ufffd\uce77\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\ufffdH]U\ufffdQ\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000e\ufffd\u0094\ufffd\ufffd\u0005\ufffd?l\u00188\ufffd|JX\ufffdX\u0001\ufffd\ufffd\u0018h\ufffd$q\ufffd\u0017 \ufffdv\u0011\u0013\ufffd\uce77\ufffd\u0014\ufffd\u0013\ufffd\ufffd\ufffd6\ufffd\ufffd\u0004\ufffd\u001e6\ufffdH]U\u000e\ufffdQ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u0094\ufffd\ufffd\ufffd?l8\ufffd|JX\ufffdX\ufffd\ufffdh\ufffd$q\ufffd \ufffdv\ufffd\uce77\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd\ufffd6\ufffdH]U\ufffdQ\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �Wb,��Z�QV�2ǰq�֏.`e +�"� 2�X CF j[9�9F�b���8�M���] � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Wb,��Z�QV�2ǰq�֏.`e +�"� 2�X CF j[9�9F�b���8�M���] � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �Wb,��Z�QV�2ǰq�֏.`e +�"� 2�X CF j[9�9F�b���8�M���] � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.953335300378693,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "1516c0443b10f287e886044697c54a67",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001Wb,\u0001\ufffd\ufffd\u0005\u0016Z\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e\u000b+\u000e\u0018\ufffd\"\ufffd 2\ufffdX\u000bCF\u0000\u001ej[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffd\bM\ufffd\ufffd\ufffd]\f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001Wb,\u0001\ufffd\ufffd\u0005\u0016Z\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e\u000b+\u000e\u0018\ufffd\"\ufffd 2\ufffdX\u000bCF\u0000\u001ej[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffd\bM\ufffd\ufffd\ufffd]\f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001Wb,\u0001\ufffd\ufffd\u0005\u0016Z\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e\u000b+\u000e\u0018\ufffd\"\ufffd 2\ufffdX\u000bCF\u0000\u001ej[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffd\bM\ufffd\ufffd\ufffd]\f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13f9f09f26549bce7a1855519a8958ff4fc88369",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001Wb,\u0001\ufffd\ufffd\u0005\u0016Z\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e\u000b+\u000e\u0018\ufffd\"\ufffd 2\ufffdX\u000bCF\u0000\u001ej[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffd\bM\ufffd\ufffd\ufffd]\f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdWb,\ufffd\ufffdZ\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e+\ufffd\"\ufffd 2\ufffdXCFj[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffdM\ufffd\ufffd\ufffd]\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001Wb,\u0001\ufffd\ufffd\u0005\u0016Z\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e\u000b+\u000e\u0018\ufffd\"\ufffd 2\ufffdX\u000bCF\u0000\u001ej[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffd\bM\ufffd\ufffd\ufffd]\f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdWb,\ufffd\ufffdZ\ufffdQV\ufffd2\u01f0q\ufffd\u058f.`e+\ufffd\"\ufffd 2\ufffdXCFj[9\ufffd9F\ufffdb\ufffd\ufffd\u0bc4\ufffd8\ufffdM\ufffd\ufffd\ufffd]\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �X@O?t�Z�������C��˴��ճ�b �NL=��!�4J4�\�O��ﲆ�x�4��1g � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �X@O?t�Z�������C��˴��ճ�b �NL=��!�4J4�\�O��ﲆ�x�4��1g � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �X@O?t�Z�������C��˴��ճ�b �NL=��!�4J4�\�O��ﲆ�x�4��1g � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.010968733759792,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "56b9e99d3064fd8a606abe7ca0df264c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X@O?\u000et\ufffdZ\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffdC\ufffd\u0015\ufffd\u0001\u02f4\u0006\ufffd\ufffd\u0573\ufffdb\u001c \ufffdNL=\ufffd\ufffd!\ufffd\u00134J4\ufffd\\\ufffdO\u0019\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X@O?\u000et\ufffdZ\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffdC\ufffd\u0015\ufffd\u0001\u02f4\u0006\ufffd\ufffd\u0573\ufffdb\u001c \ufffdNL=\ufffd\ufffd!\ufffd\u00134J4\ufffd\\\ufffdO\u0019\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X@O?\u000et\ufffdZ\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffdC\ufffd\u0015\ufffd\u0001\u02f4\u0006\ufffd\ufffd\u0573\ufffdb\u001c \ufffdNL=\ufffd\ufffd!\ufffd\u00134J4\ufffd\\\ufffdO\u0019\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6c7c2b8822a65aa504a507ac4a4b47cb9d7808b5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X@O?\u000et\ufffdZ\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffdC\ufffd\u0015\ufffd\u0001\u02f4\u0006\ufffd\ufffd\u0573\ufffdb\u001c \ufffdNL=\ufffd\ufffd!\ufffd\u00134J4\ufffd\\\ufffdO\u0019\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdX@O?t\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u02f4\ufffd\ufffd\u0573\ufffdb \ufffdNL=\ufffd\ufffd!\ufffd4J4\ufffd\\\ufffdO\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X@O?\u000et\ufffdZ\ufffd\ufffd\ufffd\u0016\ufffd\ufffd\ufffd\ufffdC\ufffd\u0015\ufffd\u0001\u02f4\u0006\ufffd\ufffd\u0573\ufffdb\u001c \ufffdNL=\ufffd\ufffd!\ufffd\u00134J4\ufffd\\\ufffdO\u0019\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdX@O?t\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\u02f4\ufffd\ufffd\u0573\ufffdb \ufffdNL=\ufffd\ufffd!\ufffd4J4\ufffd\\\ufffdO\ufffd\ufffd\ufc86\ufffdx\ufffd4\ufffd\ufffd1g \ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T Pͩ��� �qٶ�u�> �E/���NM!�4��S` ƗLy�^ۏ����tu��#z��k��> F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T Pͩ��� �qٶ�u�>
�E/���NM!�4��S` ƗLy�^ۏ����tu��#z��k��> F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T Pͩ��� �qٶ�u�> �E/���NM!�4��S` ƗLy�^ۏ����tu��#z��k��> F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.055564157942067,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "20d2edf3cc8da15ca7173b77c90c2d6f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0369\ufffd\ufffd\ufffd\f\ufffdq\u0676\ufffdu\ufffd>\r\ufffd\u0002E\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0018\u0197L\u0015y\u0002\ufffd\u0013^\u06cf\ufffd\u0010\ufffd\ufffd\ufffdt\u0015u\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0369\ufffd\ufffd\ufffd\f\ufffdq\u0676\ufffdu\ufffd>\r\ufffd\u0002E\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0018\u0197L\u0015y\u0002\ufffd\u0013^\u06cf\ufffd\u0010\ufffd\ufffd\ufffdt\u0015u\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0369\ufffd\ufffd\ufffd\f\ufffdq\u0676\ufffdu\ufffd>\r\ufffd\u0002E\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0018\u0197L\u0015y\u0002\ufffd\u0013^\u06cf\ufffd\u0010\ufffd\ufffd\ufffdt\u0015u\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5b97d64a412cb1845f3155b19ee6353ce01b969",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0369\ufffd\ufffd\ufffd\f\ufffdq\u0676\ufffdu\ufffd>\r\ufffd\u0002E\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0018\u0197L\u0015y\u0002\ufffd\u0013^\u06cf\ufffd\u0010\ufffd\ufffd\ufffdt\u0015u\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\u0369\ufffd\ufffd\ufffd\ufffdq\u0676\ufffdu\ufffd>\r\ufffdE\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0197Ly\ufffd^\u06cf\ufffd\ufffd\ufffd\ufffdtu\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0369\ufffd\ufffd\ufffd\f\ufffdq\u0676\ufffdu\ufffd>\r\ufffd\u0002E\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0018\u0197L\u0015y\u0002\ufffd\u0013^\u06cf\ufffd\u0010\ufffd\ufffd\ufffdt\u0015u\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\u0369\ufffd\ufffd\ufffd\ufffdq\u0676\ufffdu\ufffd>\r\ufffdE\/\ufffd\ufffd\ufffdNM!\ufffd4\ufffd\ufffdS` \u07be\u0197Ly\ufffd^\u06cf\ufffd\ufffd\ufffd\ufffdtu\ufffd\ufffd#z\ufffd\ufffdk\ufffd\ufffd>F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�}\P��~�!B�����>�v"̿˿���� �".�cM�Wõ� $Ug�X7� ��<�����2 D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�}\P��~�!B�����>�v"̿˿���� �".�cM�Wõ� $Ug�X7� ��<�����2 D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�}\P��~�!B�����>�v"̿˿���� �".�cM�Wõ� $Ug�X7� ��<�����2 D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.993028541538363,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "766202b9d72083f44ef6b36c247eea20",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\u0002\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd\u000b$Ug\u000f\ufffdX7\ufffd\u000b\ufffd\ufffd<\ufffd\ufffd\ufffd\u0013\ufffd\ufffd2\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\u0002\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd\u000b$Ug\u000f\ufffdX7\ufffd\u000b\ufffd\ufffd<\ufffd\ufffd\ufffd\u0013\ufffd\ufffd2\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\u0002\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd\u000b$Ug\u000f\ufffdX7\ufffd\u000b\ufffd\ufffd<\ufffd\ufffd\ufffd\u0013\ufffd\ufffd2\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "383807ffef89db3e762b1c73c786410e99d2e623",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\u0002\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd\u000b$Ug\u000f\ufffdX7\ufffd\u000b\ufffd\ufffd<\ufffd\ufffd\ufffd\u0013\ufffd\ufffd2\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd$Ug\ufffdX7\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd2D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\u0002\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd\u000b$Ug\u000f\ufffdX7\ufffd\u000b\ufffd\ufffd<\ufffd\ufffd\ufffd\u0013\ufffd\ufffd2\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffd}\\P\ufffd\ufffd~\ufffd!B\uf40d\ufffd\ufffd\ufffd\ufffd\ufffd>\ufffdv\"\u033f\u02ff\ufffd\ufffd\ufffd\ufffd \ufffd\".\ufffdcM\ufffdW\u00f5\ufffd$Ug\ufffdX7\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd2D\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ab7ac3c873c1b1fd SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��n�^c �̩����-�(It�3�Q�X�#<Ғ+ �HvQtv1c�����ǓH� 5:�E�?�M �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��n�^c �̩����-�(It�3�Q�X�#<Ғ+ �HvQtv1c�����ǓH� 5:�E�?�M �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��n�^c �̩����-�(It�3�Q�X�#<Ғ+ �HvQtv1c�����ǓH� 5:�E�?�M �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "ab7ac3c873c1b1fd6885e433fac95470",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.912185345666948,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "e9e6514f8b80ce8cfab10bc05cf382c87d309ede",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ab7ac3c873c1b1fd6885e433fac95470",
"payload_hash": "04147ababa36723cafbe30b1184da836",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd^c\u0000\ufffd\u0329\ufffd\u0006\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\u0006\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd\u000b5:\ufffd\u0005E\u000e\ufffd?\ufffd\u0011\u001bM\u001d\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd^c\u0000\ufffd\u0329\ufffd\u0006\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\u0006\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd\u000b5:\ufffd\u0005E\u000e\ufffd?\ufffd\u0011\u001bM\u001d\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd^c\u0000\ufffd\u0329\ufffd\u0006\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\u0006\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd\u000b5:\ufffd\u0005E\u000e\ufffd?\ufffd\u0011\u001bM\u001d\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "950721166224fcdaefd5f4ebde58268c4c05dd61",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd^c\u0000\ufffd\u0329\ufffd\u0006\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\u0006\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd\u000b5:\ufffd\u0005E\u000e\ufffd?\ufffd\u0011\u001bM\u001d\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "ab7ac3c873c1b1fd6885e433fac95470",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdn\ufffd^c\ufffd\u0329\ufffd\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd5:\ufffdE\ufffd?\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd^c\u0000\ufffd\u0329\ufffd\u0006\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\u0006\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd\u000b5:\ufffd\u0005E\u000e\ufffd?\ufffd\u0011\u001bM\u001d\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "ab7ac3c873c1b1fd6885e433fac95470",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdn\ufffd^c\ufffd\u0329\ufffd\ufffd\ufffd\ufffd-\ufffd(It\ufffd3\ufffdQ\ufffdX\ufffd#<\u0492+ \ufffdHvQtv1c\ufffd\ufffd\ufffd\ufffd\ufffd\u01d3H\ufffd5:\ufffdE\ufffd?\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
��'���Ԣ��ЬI<+K� k{]�?V6 � � a �&���_:N�Mȏ�������y0��D���� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��'���Ԣ��ЬI<+K� k{]�?V6 � � a �&���_:N�Mȏ�������y0��D���� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��'���Ԣ��ЬI<+K� k{]�?V6 � � a �&���_:N�Mȏ�������y0��D���� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9764437062102855,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "9f04abbb132fdb93e67a204d8ece441f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u0007\u042cI<+K\ufffd\u001d\u0017k{]\ufffd?V6\u0013\u000b\ufffd\u0013\t\ufffd a\u001e\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\u000f\ufffd\ufffdD\b\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u0007\u042cI<+K\ufffd\u001d\u0017k{]\ufffd?V6\u0013\u000b\ufffd\u0013\t\ufffd a\u001e\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\u000f\ufffd\ufffdD\b\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u0007\u042cI<+K\ufffd\u001d\u0017k{]\ufffd?V6\u0013\u000b\ufffd\u0013\t\ufffd a\u001e\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\u000f\ufffd\ufffdD\b\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "422788cff614a4f88432e447822008ef9d9a901f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u0007\u042cI<+K\ufffd\u001d\u0017k{]\ufffd?V6\u0013\u000b\ufffd\u0013\t\ufffd a\u001e\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\u000f\ufffd\ufffdD\b\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u042cI<+K\ufffdk{]\ufffd?V6\ufffd\t\ufffd a\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u0007\u042cI<+K\ufffd\u001d\u0017k{]\ufffd?V6\u0013\u000b\ufffd\u0013\t\ufffd a\u001e\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\u000f\ufffd\ufffdD\b\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd'\ufffd\ufffd\ufffd\u0522\ufffd\ufffd\u042cI<+K\ufffdk{]\ufffd?V6\ufffd\t\ufffd a\ufffd&\ufffd\ufffd\ufffd_:N\ufffdM\u020f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy0\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �A��\IK3~����'Q���et�[~ 1�k���� 1�h��Eζgq�c � �%�2^�VbT���� � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �A��\IK3~����'Q���et�[~
1�k���� 1�h��Eζgq�c �
�%�2^�VbT���� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �A��\IK3~����'Q���et�[~ 1�k���� 1�h��Eζgq�c � �%�2^�VbT���� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.0045858030918104,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "0d7bf2ee27f6ebe81b2f4805e8658116",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e4f807adcbe8e19e171f438e99e420bd338e04d8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdA\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd 1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003A\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd \u001e1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\u001e\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\u0005\ufffd\u0015\u001d\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdA\ufffd\ufffd\\IK3~\ufffd\ufffd\ufffd\ufffd'Q\ufffd\ufffd\ufffdet\ufffd[~\r1\ufffdk\ufffd\ufffd\ufffd\ufffd 1\ufffdh\ufffd\ufffdE\u03b6gq\ufffdc\ufffd\n\ufffd%\ufffd2^\ufffdVbT\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 917fde1bf3bcb67f SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �4ـ��"�@S�{7���q �`ѐp��1S�4=� �5I��cS�� �Z�Y�:;�%� ��pn��=^�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4ـ��"�@S�{7���q �`ѐp��1S�4=� �5I��cS�� �Z�Y�:;�%� ��pn��=^�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �4ـ��"�@S�{7���q �`ѐp��1S�4=� �5I��cS�� �Z�Y�:;�%� ��pn��=^�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.948147523638942,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "295884441a007f98d8ac140548486d1f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9e6017044d4e6cf6241c9c5380243671f8f91105",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd4\u0640\ufffd\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00034\u0640\ufffd\u0014\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\u0002\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd4\u0640\ufffd\ufffd\"\ufffd@S\ufffd{7\ufffd\ufffd\ufffdq \ufffd`\u0450p\ufffd\ufffd1S\ufffd4=\ufffd \ufffd5I\ufffd\ufffdcS\ufffd\ufffd\t\ufffdZ\ufffdY\ufffd:;\ufffd%\ufffd \ufffd\ufffdpn\ufffd\ufffd=^\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 8ac3a7bb4b76f66b SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� � �~^������� 8p��F���OD���� ]�����>C,�2v���rlfu�^Uz" e��q �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �~^������� 8p��F���OD���� ]�����>C,�2v���rlfu�^Uz" e��q �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� � �~^������� 8p��F���OD���� ]�����>C,�2v���rlfu�^Uz" e��q �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ٪� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "8ac3a7bb4b76f66b074faac937e13a56",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.022343716940365,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b2a69f7657db13c5f113897d834774a029b6c156",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8ac3a7bb4b76f66b074faac937e13a56",
"payload_hash": "fad330fac7917ae5b6c57c952307c92b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u066a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u066a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1f0a59558865d0b87ba35ba00624d40f851a1e4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "8ac3a7bb4b76f66b074faac937e13a56",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t8p\ufffd\ufffdF\ufffd\ufffd\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"e\ufffd\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\u0018\u0017\ufffd\ufffd\ufffd\u0015\t8p\ufffd\u0002\ufffdF\ufffd\ufffd\u000f\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\u0010\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"\u0016\u001ee\ufffd\ufffdq\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "8ac3a7bb4b76f66b074faac937e13a56",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\t\ufffd~^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t8p\ufffd\ufffdF\ufffd\ufffd\ufffdOD\ufffd\ufffd\ufffd\ufffd ]\ufffd\ufffd\ufffd\ufffd\ufffd>C,\ufffd2v\ufffd\ufffd\ufffdrlfu\ufffd^Uz\"e\ufffd\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
coap probe
coap probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a96dc3876784813c SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
F B�(z��[�r�$�c��!�|hv�hSaQ2��e�G @��.SS�5t � �����T#�;���;� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =��
Pourquoi cette classification : Type « coap_probe » (signaux protocolaires) · confiance 51%
Confiance classification
51%
Risque capteur
Moyen
· 44
Confiance : Confiance 51 % — Motif catalogue confirmé
Signaux
pat-0798
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma CoAP GET
STUN binding
Minecraft varint handshake
SOCKS5 greeting
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�(z��[�r�$�c��!�|hv�hSaQ2��e�G @��.SS�5t �
�����T#�;���;� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�(z��[�r�$�c��!�|hv�hSaQ2��e�G @��.SS�5t � �����T#�;���;� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.97714741941286,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"confidence": 0.51,
"classification_confidence": 0.51,
"precision_score": 60,
"precision_signals": [
"pat-0798"
],
"kb_rule_ids": [
"pat-0798"
],
"matched_patterns": [
"pat-0798",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"matched_pattern_names": [
"Sigma CoAP GET",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0798",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 51,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "341251ebf6796d01a6170de503ac6f67",
"path_pattern_hash": "2bc9f93b3f58e74e96efca118403941c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 44
},
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd(z\ufffd\ufffd[\ufffdr\u0002\ufffd$\ufffdc\u0002\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\u0001\ufffd\ufffd.SS\ufffd5t\f\ufffd\r\ufffd\ufffd\u000e\ufffd\u0018\ufffd\ufffdT#\u0015\ufffd;\ufffd\ufffd\ufffd;\ufffd\u0014\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd(z\ufffd\ufffd[\ufffdr\u0002\ufffd$\ufffdc\u0002\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\u0001\ufffd\ufffd.SS\ufffd5t\f\ufffd\r\ufffd\ufffd\u000e\ufffd\u0018\ufffd\ufffdT#\u0015\ufffd;\ufffd\ufffd\ufffd;\ufffd\u0014\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd(z\ufffd\ufffd[\ufffdr\u0002\ufffd$\ufffdc\u0002\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\u0001\ufffd\ufffd.SS\ufffd5t\f\ufffd\r\ufffd\ufffd\u000e\ufffd\u0018\ufffd\ufffdT#\u0015\ufffd;\ufffd\ufffd\ufffd;\ufffd\u0014\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3105f8d8f544a855f240c594f2a6ce6f242e2ee9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd(z\ufffd\ufffd[\ufffdr\u0002\ufffd$\ufffdc\u0002\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\u0001\ufffd\ufffd.SS\ufffd5t\f\ufffd\r\ufffd\ufffd\u000e\ufffd\u0018\ufffd\ufffdT#\u0015\ufffd;\ufffd\ufffd\ufffd;\ufffd\u0014\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "FB\ufffd(z\ufffd\ufffd[\ufffdr\ufffd$\ufffdc\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\ufffd\ufffd.SS\ufffd5t\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffdT#\ufffd;\ufffd\ufffd\ufffd;\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"attack_vector": "coap probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"classification_reason_label_fr": "Type \u00ab coap_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"confidence_pct": 51,
"confidence_breakdown": {
"waf": 8,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0798"
],
"tags_summary_labels_fr": [
"pat-0798"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd(z\ufffd\ufffd[\ufffdr\u0002\ufffd$\ufffdc\u0002\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\u0001\ufffd\ufffd.SS\ufffd5t\f\ufffd\r\ufffd\ufffd\u000e\ufffd\u0018\ufffd\ufffdT#\u0015\ufffd;\ufffd\ufffd\ufffd;\ufffd\u0014\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"tls_ja3": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "coap probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "FB\ufffd(z\ufffd\ufffd[\ufffdr\ufffd$\ufffdc\ufffd\ufffd!\ufffd|hv\ufffdhSaQ2\ufffd\ufffde\ufffdG @\ufffd\ufffd.SS\ufffd5t\ufffd\r\ufffd\ufffd\ufffd\ufffd\ufffdT#\ufffd;\ufffd\ufffd\ufffd;\ufffdD\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\ufffd\n\/<\ufffd\ufffd\ufffd\ufffd\ufffd5=\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 10ab52888ab2383a SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �=W�mK�}�K��-��W6 _o7��^�a� ��� ��L�R ��cF:�*v�/%&3�#1�u���L5 �jj����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �=W�mK�}�K��-��W6 _o7��^�a� ��� ��L�R ��cF:�*v�/%&3�#1�u���L5 �jj����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �=W�mK�}�K��-��W6 _o7��^�a� ��� ��L�R ��cF:�*v�/%&3�#1�u���L5 �jj����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "10ab52888ab2383ae17812588548749f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.952201917702819,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "92552a19db2dab18f82dcbfb13a0dda4bdc08794",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "10ab52888ab2383ae17812588548749f",
"payload_hash": "f7288acd468cdfc5bd838bec7ef7bb8e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34a28768adec936e8a68ceff30884e288105a67d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "10ab52888ab2383ae17812588548749f",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW6_o7\ufffd\ufffd^\ufffda\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL\ufffdR\ufffd\ufffdcF:\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\ufffdjj\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW\u00046\u0002\u001d_o7\ufffd\ufffd^\ufffda\ufffd\f\ufffd\ufffd\ufffd \ufffd\ufffdL\u0018\ufffdR\u000b\ufffd\ufffdc\u000fF:\u0001\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"tls_ja3": "10ab52888ab2383ae17812588548749f",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd=W\ufffdmK\ufffd}\ufffdK\ufffd\ufffd-\ufffd\ufffdW6_o7\ufffd\ufffd^\ufffda\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL\ufffdR\ufffd\ufffdcF:\ufffd*v\ufffd\/%&3\ufffd#1\ufffdu\ufffd\ufffd\ufffdL5\ufffdjj\ufffd\ufffd\ufffd\ufffd'\ufffd\ufffd\/\ufffd\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 006315b3ad276906 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ���i �pv������0a���O�T��z��E �6��:����J~���Vf��h`��p�_� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���i
�pv������0a���O�T��z��E �6��:����J~���Vf��h`��p�_� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���i �pv������0a���O�T��z��E �6��:����J~���Vf��h`��p�_� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.995952672447125,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "9dfddd1f797a3a5ae3f3e5126d22bf8a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a979d81f5ba998f1309c2d7b1abd6423eb5182b8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\ufffd\ufffdE \ufffd6\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffdJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\u0001a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\u0017\ufffd\ufffdE \ufffd6\ufffd\ufffd:\u0002\u0003\ufffd\ufffd\ufffd\ufffd\bJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdi\r\ufffdpv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0a\ufffd\ufffd\ufffdO\ufffdT\ufffd\ufffdz\ufffd\ufffdE \ufffd6\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffdJ~\ufffd\ufffd\ufffdVf\ufffd\ufffdh`\ufffd\ufffdp\ufffd_\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|