|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��X��<�^� ���kb�(����r��)Y �W 1wM���:� �{;�EqI|��)�?W�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��X��<�^� ���kb�(����r��)Y �W 1wM���:� �{;�EqI|��)�?W�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��X��<�^� ���kb�(����r��)Y �W 1wM���:� �{;�EqI|��)�?W�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.928733645209824,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "650ee656a53a617c11ac685dbb1f7b71",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffd<\ufffd^\ufffd\f\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\u0013\ufffdr\u0006\ufffd\u0019\u0006\ufffd)Y\u0000\ufffdW 1wM\ufffd\ufffd\u0002\ufffd:\ufffd\u0005\t\ufffd{;\ufffdEqI|\u0013\ufffd\u0014\ufffd)\ufffd?W\u0005\ufffd\u0019\ufffd\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffd<\ufffd^\ufffd\f\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\u0013\ufffdr\u0006\ufffd\u0019\u0006\ufffd)Y\u0000\ufffdW 1wM\ufffd\ufffd\u0002\ufffd:\ufffd\u0005\t\ufffd{;\ufffdEqI|\u0013\ufffd\u0014\ufffd)\ufffd?W\u0005\ufffd\u0019\ufffd\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffd<\ufffd^\ufffd\f\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\u0013\ufffdr\u0006\ufffd\u0019\u0006\ufffd)Y\u0000\ufffdW 1wM\ufffd\ufffd\u0002\ufffd:\ufffd\u0005\t\ufffd{;\ufffdEqI|\u0013\ufffd\u0014\ufffd)\ufffd?W\u0005\ufffd\u0019\ufffd\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "181091a0ae1dd6321c840ef9318e723809a220c3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffd<\ufffd^\ufffd\f\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\u0013\ufffdr\u0006\ufffd\u0019\u0006\ufffd)Y\u0000\ufffdW 1wM\ufffd\ufffd\u0002\ufffd:\ufffd\u0005\t\ufffd{;\ufffdEqI|\u0013\ufffd\u0014\ufffd)\ufffd?W\u0005\ufffd\u0019\ufffd\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd<\ufffd^\ufffd\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd)Y\ufffdW 1wM\ufffd\ufffd\ufffd:\ufffd\t\ufffd{;\ufffdEqI|\ufffd\ufffd)\ufffd?W\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX\ufffd\ufffd<\ufffd^\ufffd\f\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\u0013\ufffdr\u0006\ufffd\u0019\u0006\ufffd)Y\u0000\ufffdW 1wM\ufffd\ufffd\u0002\ufffd:\ufffd\u0005\t\ufffd{;\ufffdEqI|\u0013\ufffd\u0014\ufffd)\ufffd?W\u0005\ufffd\u0019\ufffd\u0013\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd<\ufffd^\ufffd\ufffd\ufffd\ufffdkb\ufffd(\ufffd\ufffd\ufffd\ufffdr\ufffd\ufffd)Y\ufffdW 1wM\ufffd\ufffd\ufffd:\ufffd\t\ufffd{;\ufffdEqI|\ufffd\ufffd)\ufffd?W\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 db8d4ad49cb378fa SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �T��|.s7��$�� �����C����p���� ���خ� V��\N��Б<W d»2��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$��
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �T��|.s7��$�� �����C����p���� ���خ� V��\N��Б<W d»2��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �T��|.s7��$�� �����C����p���� ���خ� V��\N��Б<W d»2��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.986579695752168,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "b5e1ebe2573443737f7cbe10b7cab870",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfcad16ba41bb096576d923f26352da34a5898f8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd|.s7\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<Wd\u00bb2\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003T\ufffd\ufffd|\u0005.s7\ufffd\ufffd\u0005$\ufffd\ufffd\u001c\ufffd\ufffd\u0019\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\b\ufffd\ufffd \b\ufffd\u0012\ufffd\u001b\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<W\u001dd\u00bb2\u001a\ufffd\ufffd\u0014\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"tls_ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd|.s7\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u062e\ufffd\tV\ufffd\ufffd\\N\ufffd\ufffd\u0411<Wd\u00bb2\ufffd\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 013c30c8ce44c8b2 SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �y����b���?��� ��R���u9&��#� �Rq�쏴\�:�d����k��S��;��d��! � � � � A ����� = 5 ����� < / ��̨�w
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �y����b���?��� ��R���u9&��#� �Rq�쏴\�:�d����k��S��;��d��! � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �y����b���?��� ��R���u9&��#� �Rq�쏴\�:�d����k��S��;��d��! � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.995761439560159,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "b74bbc54b9a8dd2dbe3da4620a3cd310",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003y\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\u0017\ufffd\ufffd\ufffd\u0010 \ufffd\ufffdR\ufffd\ufffd\ufffdu9\u0017&\ufffd\ufffd#\ufffd\u0011\u001e \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\u0006\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd\u0006!\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003y\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\u0017\ufffd\ufffd\ufffd\u0010 \ufffd\ufffdR\ufffd\ufffd\ufffdu9\u0017&\ufffd\ufffd#\ufffd\u0011\u001e \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\u0006\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd\u0006!\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003y\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\u0017\ufffd\ufffd\ufffd\u0010 \ufffd\ufffdR\ufffd\ufffd\ufffdu9\u0017&\ufffd\ufffd#\ufffd\u0011\u001e \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\u0006\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd\u0006!\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "585e09eaad9086f69b32af3fe9ee7940fc5cab7e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003y\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\u0017\ufffd\ufffd\ufffd\u0010 \ufffd\ufffdR\ufffd\ufffd\ufffdu9\u0017&\ufffd\ufffd#\ufffd\u0011\u001e \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\u0006\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd\u0006!\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd \ufffd\ufffdR\ufffd\ufffd\ufffdu9&\ufffd\ufffd#\ufffd \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003y\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\u0017\ufffd\ufffd\ufffd\u0010 \ufffd\ufffdR\ufffd\ufffd\ufffdu9\u0017&\ufffd\ufffd#\ufffd\u0011\u001e \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\u0006\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd\u0006!\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"tls_ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdy\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd \ufffd\ufffdR\ufffd\ufffd\ufffdu9&\ufffd\ufffd#\ufffd \ufffdRq\ufffd\uc3f4\\\ufffd:\ufffdd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffdS\ufffd\ufffd;\ufffd\ufffdd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd=5\ufffd\ufffd\ufffd\ufffd\ufffd<\/\n\ufffd\ufffd\u0328\ufffdw",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 03a3ad27040f733e SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
T P�+�?XMn�����Qd�QI�v��>�O���b+�>u @�>7�!�(I�# d��ўfF.�`�}�g�$ F���̩�s�r�,�����$� �+�����#� � � � � � E �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P�+�?XMn�����Qd�QI�v��>�O���b+�>u @�>7�!�(I�# d��ўfF.�`�}�g�$ F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�+�?XMn�����Qd�QI�v��>�O���b+�>u @�>7�!�(I�# d��ўfF.�`�}�g�$ F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.05621796225854,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "d96a3a9de0a88b8f5b7a665204bd1f9b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ad650812bc47385c91c563f78271dd5cb7e9b32",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "TP\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd!\ufffd(I\ufffd#d\ufffd\ufffd\u045efF.\ufffd`\ufffd}\ufffdg\ufffd$F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd\u0016!\ufffd(I\ufffd#\u001cd\ufffd\u0018\ufffd\u045efF.\ufffd`\ufffd}\u0013\ufffdg\u0013\ufffd$\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"tls_ja3": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "TP\ufffd+\ufffd?XMn\ufffd\ufffd\ufffd\ufffd\ufffdQd\ufffdQI\ufffdv\ufffd\ufffd>\ufffdO\ufffd\ufffd\ufffdb+\ufffd>u @\ufffd>7\ufffd!\ufffd(I\ufffd#d\ufffd\ufffd\u045efF.\ufffd`\ufffd}\ufffdg\ufffd$F\ufffd\ufffd\ufffd\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:82 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c12b4ccd5320bbb3
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Service
TLS
Payload
�/��yC@�4�w�"2���J�w�.�7da�� �pGX�n�R����mvV��^��丱)�g�e�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�/��yC@�4�w�"2���J�w�.�7da�� �pGX�n�R����mvV��^��丱)�g�e�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�/��yC@�4�w�"2���J�w�.�7da�� �pGX�n�R����mvV��^��丱)�g�e�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9858226271127015,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "8da18506afd7bc57f7df6c9f99d6d630",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b955d385bc302db07efcef36f941191b1a504c47",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\/\ufffd\ufffdyC@\ufffd4\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\ufffd7da\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\/\ufffd\ufffdyC@\ufffd\u00104\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\u001b\ufffd7\u000fda\u0018\u0017\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"port": 82,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:82 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\/\ufffd\ufffdyC@\ufffd4\ufffdw\ufffd\"2\ufffd\ufffd\ufffdJ\ufffdw\ufffd.\ufffd7da\ufffd\ufffd \ufffdpGX\ufffdn\ufffdR\ufffd\ufffd\ufffd\ufffdmvV\ufffd\ufffd^\ufffd\ufffd\u4e31)\ufffdg\ufffde\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "82 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �3�*މ� N�n�DO69��*�_���5z�F�? (k ��U$�%��r�.�~�x_�#_(�en�m��W � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �3�*މ� N�n�DO69��*�_���5z�F�? (k ��U$�%��r�.�~�x_�#_(�en�m��W � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.0021249588574275,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "12314bd23a42a6c35a7ce46c74d530b8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\u0001*\u0789\ufffd\u0000N\ufffdn\ufffdDO69\ufffd\ufffd*\ufffd_\u001a\ufffd\ufffd\ufffd5z\u001a\ufffdF\ufffd? (k\u001e\ufffd\ufffdU$\ufffd%\u0015\ufffd\ufffdr\ufffd.\ufffd~\ufffdx_\ufffd#_(\ufffden\ufffdm\ufffd\ufffdW\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\u0001*\u0789\ufffd\u0000N\ufffdn\ufffdDO69\ufffd\ufffd*\ufffd_\u001a\ufffd\ufffd\ufffd5z\u001a\ufffdF\ufffd? (k\u001e\ufffd\ufffdU$\ufffd%\u0015\ufffd\ufffdr\ufffd.\ufffd~\ufffdx_\ufffd#_(\ufffden\ufffdm\ufffd\ufffdW\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\u0001*\u0789\ufffd\u0000N\ufffdn\ufffdDO69\ufffd\ufffd*\ufffd_\u001a\ufffd\ufffd\ufffd5z\u001a\ufffdF\ufffd? (k\u001e\ufffd\ufffdU$\ufffd%\u0015\ufffd\ufffdr\ufffd.\ufffd~\ufffdx_\ufffd#_(\ufffden\ufffdm\ufffd\ufffdW\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\u0001*\u0789\ufffd\u0000N\ufffdn\ufffdDO69\ufffd\ufffd*\ufffd_\u001a\ufffd\ufffd\ufffd5z\u001a\ufffdF\ufffd? (k\u001e\ufffd\ufffdU$\ufffd%\u0015\ufffd\ufffdr\ufffd.\ufffd~\ufffdx_\ufffd#_(\ufffden\ufffdm\ufffd\ufffdW\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00033\ufffd\u0001*\u0789\ufffd\u0000N\ufffdn\ufffdDO69\ufffd\ufffd*\ufffd_\u001a\ufffd\ufffd\ufffd5z\u001a\ufffdF\ufffd? (k\u001e\ufffd\ufffdU$\ufffd%\u0015\ufffd\ufffdr\ufffd.\ufffd~\ufffdx_\ufffd#_(\ufffden\ufffdm\ufffd\ufffdW\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "24b04fd00e21534c2cee0569ab3e2103ad38f9b7",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �X�L��E���;$'�`Z-SU���Vw�{�|+�lL {����[O��<G�9q_ֆ�V�2D�.��r � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �X�L��E���;$'�`Z-SU���Vw�{�|+�lL {����[O��<G�9q_ֆ�V�2D�.��r � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.011637006068489,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "2c32e8eb1c005e5d20f5f00af3b3cb5f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdL\ufffd\ufffdE\ufffd\ufffd\ufffd;$'\ufffd`Z-SU\ufffd\ufffd\ufffdV\u0004w\ufffd{\ufffd|+\ufffdlL {\ufffd\ufffd\ufffd\u0012\ufffd[O\ufffd\ufffd<G\ufffd9q_\u0586\ufffdV\ufffd2D\ufffd.\ufffd\ufffd\u0013r \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdL\ufffd\ufffdE\ufffd\ufffd\ufffd;$'\ufffd`Z-SU\ufffd\ufffd\ufffdV\u0004w\ufffd{\ufffd|+\ufffdlL {\ufffd\ufffd\ufffd\u0012\ufffd[O\ufffd\ufffd<G\ufffd9q_\u0586\ufffdV\ufffd2D\ufffd.\ufffd\ufffd\u0013r \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdL\ufffd\ufffdE\ufffd\ufffd\ufffd;$'\ufffd`Z-SU\ufffd\ufffd\ufffdV\u0004w\ufffd{\ufffd|+\ufffdlL {\ufffd\ufffd\ufffd\u0012\ufffd[O\ufffd\ufffd<G\ufffd9q_\u0586\ufffdV\ufffd2D\ufffd.\ufffd\ufffd\u0013r \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdL\ufffd\ufffdE\ufffd\ufffd\ufffd;$'\ufffd`Z-SU\ufffd\ufffd\ufffdV\u0004w\ufffd{\ufffd|+\ufffdlL {\ufffd\ufffd\ufffd\u0012\ufffd[O\ufffd\ufffd<G\ufffd9q_\u0586\ufffdV\ufffd2D\ufffd.\ufffd\ufffd\u0013r \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003X\ufffdL\ufffd\ufffdE\ufffd\ufffd\ufffd;$'\ufffd`Z-SU\ufffd\ufffd\ufffdV\u0004w\ufffd{\ufffd|+\ufffdlL {\ufffd\ufffd\ufffd\u0012\ufffd[O\ufffd\ufffd<G\ufffd9q_\u0586\ufffdV\ufffd2D\ufffd.\ufffd\ufffd\u0013r \u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe340bf63d227a88060b55333115bddab7aac115",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���. �y�H![��1f]�|�u̐Hr� @O%�� #LP�^$n�N ��(�v��F�p�PzW%&5� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���. �y�H![��1f]�|�u̐Hr� @O%�� #LP�^$n�N ��(�v��F�p�PzW%&5� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.957269477554789,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "f5bca657583f48b7f1b5a966a3de4511",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.\u001f\ufffdy\ufffdH\u000e![\ufffd\ufffd1f\u0002]\ufffd|\ufffdu\u0310Hr\ufffd\u0000@O%\ufffd\ufffd #LP\ufffd^\u0018$n\ufffd\u0013N\u001c\ufffd\ufffd(\ufffdv\ufffd\ufffd\u0004F\ufffdp\ufffdPzW%&5\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.\u001f\ufffdy\ufffdH\u000e![\ufffd\ufffd1f\u0002]\ufffd|\ufffdu\u0310Hr\ufffd\u0000@O%\ufffd\ufffd #LP\ufffd^\u0018$n\ufffd\u0013N\u001c\ufffd\ufffd(\ufffdv\ufffd\ufffd\u0004F\ufffdp\ufffdPzW%&5\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.\u001f\ufffdy\ufffdH\u000e![\ufffd\ufffd1f\u0002]\ufffd|\ufffdu\u0310Hr\ufffd\u0000@O%\ufffd\ufffd #LP\ufffd^\u0018$n\ufffd\u0013N\u001c\ufffd\ufffd(\ufffdv\ufffd\ufffd\u0004F\ufffdp\ufffdPzW%&5\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.\u001f\ufffdy\ufffdH\u000e![\ufffd\ufffd1f\u0002]\ufffd|\ufffdu\u0310Hr\ufffd\u0000@O%\ufffd\ufffd #LP\ufffd^\u0018$n\ufffd\u0013N\u001c\ufffd\ufffd(\ufffdv\ufffd\ufffd\u0004F\ufffdp\ufffdPzW%&5\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd.\u001f\ufffdy\ufffdH\u000e![\ufffd\ufffd1f\u0002]\ufffd|\ufffdu\u0310Hr\ufffd\u0000@O%\ufffd\ufffd #LP\ufffd^\u0018$n\ufffd\u0013N\u001c\ufffd\ufffd(\ufffdv\ufffd\ufffd\u0004F\ufffdp\ufffdPzW%&5\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dbb8d189df29cf203463eff1abb9d01f06fef3ab",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���W��e��/B?g�#��
$�wTT+��0y�w 9?7TY�~0��P� �����{����� �**����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ���W��e��/B?g�#�� $�wTT+��0y�w 9?7TY�~0��P� �����{����� �**����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "81187cd4027ed8a08ffabc8862183d04",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.960528500533798,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "002e63949488870c7a1666c4d0c1011d813a12e8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "81187cd4027ed8a08ffabc8862183d04",
"payload_hash": "f785b1c883e3edc9d70316f485ac4b31",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdW\u0002\ufffd\ufffde\ufffd\ufffd\/B?g\ufffd#\ufffd\ufffd\n$\ufffdwTT+\ufffd\ufffd0y\ufffdw \b9?7T\ue34b\u0006Y\ufffd~0\ufffd\u0013\ufffdP\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffd{\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdW\u0002\ufffd\ufffde\ufffd\ufffd\/B?g\ufffd#\ufffd\ufffd\n$\ufffdwTT+\ufffd\ufffd0y\ufffdw \b9?7T\ue34b\u0006Y\ufffd~0\ufffd\u0013\ufffdP\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffd{\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdW\u0002\ufffd\ufffde\ufffd\ufffd\/B?g\ufffd#\ufffd\ufffd\n$\ufffdwTT+\ufffd\ufffd0y\ufffdw \b9?7T\ue34b\u0006Y\ufffd~0\ufffd\u0013\ufffdP\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffd{\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdW\u0002\ufffd\ufffde\ufffd\ufffd\/B?g\ufffd#\ufffd\ufffd\n$\ufffdwTT+\ufffd\ufffd0y\ufffdw \b9?7T\ue34b\u0006Y\ufffd~0\ufffd\u0013\ufffdP\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffd{\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdW\u0002\ufffd\ufffde\ufffd\ufffd\/B?g\ufffd#\ufffd\ufffd\n$\ufffdwTT+\ufffd\ufffd0y\ufffdw \b9?7T\ue34b\u0006Y\ufffd~0\ufffd\u0013\ufffdP\ufffd\u000b\ufffd\ufffd\ufffd\ufffd\ufffd{\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\u0015\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23f74b62b04f84258a333d3a2d3d0e4fddc6113a",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �?�ܾ<�c�)�gg�[M�{����"���24� ��T�/z�g��[@C>+�Ɣ�����-
���S� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �?�ܾ<�c�)�gg�[M�{����"���24� ��T�/z�g��[@C>+�Ɣ�����- ���S� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.996238974708458,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "06e20bfc0a583723fd6ad8021e7330ae",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003?\ufffd\u073e<\ufffd\u001bc\ufffd)\ufffdgg\ufffd[M\ufffd{\ufffd\u0007\u0018\ufffd\ufffd\ufffd\"\u0018\ufffd\ufffd\ufffd24\ufffd \ufffd\ufffdT\ufffd\/z\ufffdg\ufffd\ufffd[@C>+\ufffd\u0194\u0016\ufffd\ufffd\ufffd\ufffd\u001a\ufffd-\r\ufffd\ufffd\ufffdS\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003?\ufffd\u073e<\ufffd\u001bc\ufffd)\ufffdgg\ufffd[M\ufffd{\ufffd\u0007\u0018\ufffd\ufffd\ufffd\"\u0018\ufffd\ufffd\ufffd24\ufffd \ufffd\ufffdT\ufffd\/z\ufffdg\ufffd\ufffd[@C>+\ufffd\u0194\u0016\ufffd\ufffd\ufffd\ufffd\u001a\ufffd-\r\ufffd\ufffd\ufffdS\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003?\ufffd\u073e<\ufffd\u001bc\ufffd)\ufffdgg\ufffd[M\ufffd{\ufffd\u0007\u0018\ufffd\ufffd\ufffd\"\u0018\ufffd\ufffd\ufffd24\ufffd \ufffd\ufffdT\ufffd\/z\ufffdg\ufffd\ufffd[@C>+\ufffd\u0194\u0016\ufffd\ufffd\ufffd\ufffd\u001a\ufffd-\r\ufffd\ufffd\ufffdS\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003?\ufffd\u073e<\ufffd\u001bc\ufffd)\ufffdgg\ufffd[M\ufffd{\ufffd\u0007\u0018\ufffd\ufffd\ufffd\"\u0018\ufffd\ufffd\ufffd24\ufffd \ufffd\ufffdT\ufffd\/z\ufffdg\ufffd\ufffd[@C>+\ufffd\u0194\u0016\ufffd\ufffd\ufffd\ufffd\u001a\ufffd-\r\ufffd\ufffd\ufffdS\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003?\ufffd\u073e<\ufffd\u001bc\ufffd)\ufffdgg\ufffd[M\ufffd{\ufffd\u0007\u0018\ufffd\ufffd\ufffd\"\u0018\ufffd\ufffd\ufffd24\ufffd \ufffd\ufffdT\ufffd\/z\ufffdg\ufffd\ufffd[@C>+\ufffd\u0194\u0016\ufffd\ufffd\ufffd\ufffd\u001a\ufffd-\r\ufffd\ufffd\ufffdS\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df0580e9010e44fc1ab56ef4fad1e0f0673d48a1",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P���q� ԻŬ��O���JS� �r� ��h�� ��E�>� G\nM��a�A�j{Ϸ���N� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P���q� ԻŬ��O���JS� �r� ��h�� ��E�>� G\nM��a�A�j{Ϸ���N� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.10109394461426,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "07e8b5bf3d57bbff09d03c07fa7be70f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u0016\u0001\ufffd\ufffdq\ufffd\u001f\t\u053b\u016c\ufffd\ufffdO\ufffd\ufffd\ufffdJS\ufffd \ufffdr\ufffd\u001f\ufffd\ufffdh\ufffd\ufffd \ufffd\ufffdE\ufffd>\ufffd\u001dG\\nM\ufffd\u0018\ufffda\ufffdA\ufffdj\u0004{\u009a\u03f7\ufffd\u0007\ufffd\ufffdN\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u0016\u0001\ufffd\ufffdq\ufffd\u001f\t\u053b\u016c\ufffd\ufffdO\ufffd\ufffd\ufffdJS\ufffd \ufffdr\ufffd\u001f\ufffd\ufffdh\ufffd\ufffd \ufffd\ufffdE\ufffd>\ufffd\u001dG\\nM\ufffd\u0018\ufffda\ufffdA\ufffdj\u0004{\u009a\u03f7\ufffd\u0007\ufffd\ufffdN\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u0016\u0001\ufffd\ufffdq\ufffd\u001f\t\u053b\u016c\ufffd\ufffdO\ufffd\ufffd\ufffdJS\ufffd \ufffdr\ufffd\u001f\ufffd\ufffdh\ufffd\ufffd \ufffd\ufffdE\ufffd>\ufffd\u001dG\\nM\ufffd\u0018\ufffda\ufffdA\ufffdj\u0004{\u009a\u03f7\ufffd\u0007\ufffd\ufffdN\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u0016\u0001\ufffd\ufffdq\ufffd\u001f\t\u053b\u016c\ufffd\ufffdO\ufffd\ufffd\ufffdJS\ufffd \ufffdr\ufffd\u001f\ufffd\ufffdh\ufffd\ufffd \ufffd\ufffdE\ufffd>\ufffd\u001dG\\nM\ufffd\u0018\ufffda\ufffdA\ufffdj\u0004{\u009a\u03f7\ufffd\u0007\ufffd\ufffdN\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u0016\u0001\ufffd\ufffdq\ufffd\u001f\t\u053b\u016c\ufffd\ufffdO\ufffd\ufffd\ufffdJS\ufffd \ufffdr\ufffd\u001f\ufffd\ufffdh\ufffd\ufffd \ufffd\ufffdE\ufffd>\ufffd\u001dG\\nM\ufffd\u0018\ufffda\ufffdA\ufffdj\u0004{\u009a\u03f7\ufffd\u0007\ufffd\ufffdN\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4e169e2588ea727f0ab258bf6b5ab5024f56db0",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B0$[��A&{�a&�=^�p�Z78�P٫��� �U# Z��a�T�K����(�+o���D �x��ח� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B0$[��A&{�a&�=^�p�Z78�P٫��� �U# Z��a�T�K����(�+o���D �x��ח� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.053696974738071,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "05ad0e01d9dfbf510bb2a9f5124ac5e0",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00030$[\ufffd\ufffdA&{\ufffda&\ufffd=^\ufffdp\ufffdZ78\ufffdP\u066b\ufffd\ufffd\ufffd\u001f\ufffdU#\u0017 Z\ufffd\ufffda\ufffdT\ufffdK\ufffd\ufffd\ufffd\ufffd\u0001(\ufffd\u0006\u001a+o\ufffd\ufffd\ufffdD\f\ufffdx\ufffd\ufffd\u05d7\u0003\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00030$[\ufffd\ufffdA&{\ufffda&\ufffd=^\ufffdp\ufffdZ78\ufffdP\u066b\ufffd\ufffd\ufffd\u001f\ufffdU#\u0017 Z\ufffd\ufffda\ufffdT\ufffdK\ufffd\ufffd\ufffd\ufffd\u0001(\ufffd\u0006\u001a+o\ufffd\ufffd\ufffdD\f\ufffdx\ufffd\ufffd\u05d7\u0003\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00030$[\ufffd\ufffdA&{\ufffda&\ufffd=^\ufffdp\ufffdZ78\ufffdP\u066b\ufffd\ufffd\ufffd\u001f\ufffdU#\u0017 Z\ufffd\ufffda\ufffdT\ufffdK\ufffd\ufffd\ufffd\ufffd\u0001(\ufffd\u0006\u001a+o\ufffd\ufffd\ufffdD\f\ufffdx\ufffd\ufffd\u05d7\u0003\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00030$[\ufffd\ufffdA&{\ufffda&\ufffd=^\ufffdp\ufffdZ78\ufffdP\u066b\ufffd\ufffd\ufffd\u001f\ufffdU#\u0017 Z\ufffd\ufffda\ufffdT\ufffdK\ufffd\ufffd\ufffd\ufffd\u0001(\ufffd\u0006\u001a+o\ufffd\ufffd\ufffdD\f\ufffdx\ufffd\ufffd\u05d7\u0003\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u00030$[\ufffd\ufffdA&{\ufffda&\ufffd=^\ufffdp\ufffdZ78\ufffdP\u066b\ufffd\ufffd\ufffd\u001f\ufffdU#\u0017 Z\ufffd\ufffda\ufffdT\ufffdK\ufffd\ufffd\ufffd\ufffd\u0001(\ufffd\u0006\u001a+o\ufffd\ufffd\ufffdD\f\ufffdx\ufffd\ufffd\u05d7\u0003\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5bf88ff31c4710a1bef9cfdb79456cfee54b567",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �·��� �LJ�X�)( ,��:ȴ���N/��h D�~ ���Z�Ӈ��|����E��r�뤙b��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �·��� �LJ�X�)( ,��:ȴ���N/��h D�~ ���Z�Ӈ��|����E��r�뤙b��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "8576cf4b92ab8c2634ab5a633f79e778",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.978137995181054,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "04d861f0af3f38aab0147994b3fd789bcdc2a4e9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8576cf4b92ab8c2634ab5a633f79e778",
"payload_hash": "80c1dd815d544f23d1b0e415ed1f001c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0387\ufffd\ufffd\ufffd\u0000\ufffd\u01c7\ufffdX\ufffd)(\u0000,\ufffd\ufffd\u0019\u0018:\u0234\ufffd\ufffd\ufffdN\/\ufffd\ufffdh\u0002 \u0012D\u0019\ufffd~\u001d\ufffd\ufffd\ufffdZ\ufffd\u04c7\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\ub919b\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0387\ufffd\ufffd\ufffd\u0000\ufffd\u01c7\ufffdX\ufffd)(\u0000,\ufffd\ufffd\u0019\u0018:\u0234\ufffd\ufffd\ufffdN\/\ufffd\ufffdh\u0002 \u0012D\u0019\ufffd~\u001d\ufffd\ufffd\ufffdZ\ufffd\u04c7\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\ub919b\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0387\ufffd\ufffd\ufffd\u0000\ufffd\u01c7\ufffdX\ufffd)(\u0000,\ufffd\ufffd\u0019\u0018:\u0234\ufffd\ufffd\ufffdN\/\ufffd\ufffdh\u0002 \u0012D\u0019\ufffd~\u001d\ufffd\ufffd\ufffdZ\ufffd\u04c7\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\ub919b\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0387\ufffd\ufffd\ufffd\u0000\ufffd\u01c7\ufffdX\ufffd)(\u0000,\ufffd\ufffd\u0019\u0018:\u0234\ufffd\ufffd\ufffdN\/\ufffd\ufffdh\u0002 \u0012D\u0019\ufffd~\u001d\ufffd\ufffd\ufffdZ\ufffd\u04c7\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\ub919b\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0387\ufffd\ufffd\ufffd\u0000\ufffd\u01c7\ufffdX\ufffd)(\u0000,\ufffd\ufffd\u0019\u0018:\u0234\ufffd\ufffd\ufffdN\/\ufffd\ufffdh\u0002 \u0012D\u0019\ufffd~\u001d\ufffd\ufffd\ufffdZ\ufffd\u04c7\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdr\ufffd\ub919b\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b9b2a28d0e202c46913ea2c8fbe094e46bef8fb",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �xq~��B�j !��OÍq@='io-�
���� ����q�V��CQ
��[���� �� 6Æ^ȯ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �xq~��B�j !��OÍq@='io-� ���� ����q�V��CQ ��[���� �� 6Æ^ȯ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.017872723821001,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "d7bbbde600e824d8d5d39f4c888eb577",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002xq~\ufffd\ufffdB\ufffdj\u001c!\u0004\ufffd\ufffdO\u00cdq@='io-\ufffd\n\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdq\u0016\ufffdV\ufffd\ufffdCQ\r\ufffd\ufffd[\ufffd\ufffd\u0006\ufffd\ufffd\u001d\ufffd\ufffd\u001d6\u00c6^\u022f\u001f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002xq~\ufffd\ufffdB\ufffdj\u001c!\u0004\ufffd\ufffdO\u00cdq@='io-\ufffd\n\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdq\u0016\ufffdV\ufffd\ufffdCQ\r\ufffd\ufffd[\ufffd\ufffd\u0006\ufffd\ufffd\u001d\ufffd\ufffd\u001d6\u00c6^\u022f\u001f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002xq~\ufffd\ufffdB\ufffdj\u001c!\u0004\ufffd\ufffdO\u00cdq@='io-\ufffd\n\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdq\u0016\ufffdV\ufffd\ufffdCQ\r\ufffd\ufffd[\ufffd\ufffd\u0006\ufffd\ufffd\u001d\ufffd\ufffd\u001d6\u00c6^\u022f\u001f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002xq~\ufffd\ufffdB\ufffdj\u001c!\u0004\ufffd\ufffdO\u00cdq@='io-\ufffd\n\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdq\u0016\ufffdV\ufffd\ufffdCQ\r\ufffd\ufffd[\ufffd\ufffd\u0006\ufffd\ufffd\u001d\ufffd\ufffd\u001d6\u00c6^\u022f\u001f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002xq~\ufffd\ufffdB\ufffdj\u001c!\u0004\ufffd\ufffdO\u00cdq@='io-\ufffd\n\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdq\u0016\ufffdV\ufffd\ufffdCQ\r\ufffd\ufffd[\ufffd\ufffd\u0006\ufffd\ufffd\u001d\ufffd\ufffd\u001d6\u00c6^\u022f\u001f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca8483bfdfcb3e1f9c0d8703cee3bdc5580e4e1b",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��e��@�F9Y� n�I+L�� H��� ;
>� ee��Q�
�GLa��&z��낟62�\r6��\�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��e��@�F9Y� n�I+L�� H��� ; >� ee��Q� �GLa��&z��낟62�\r6��\�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.951117337227169,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "40cbcd68c3ed2121f7f5cd25582c5e73",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c",
"tls_sni": "62.3.50.33"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde\ufffd\ufffd@\ufffdF9Y\u0017\ufffd\u0000\u0007n\ufffdI\u0014+L\ufffd\ufffd\u001cH\ufffd\ufffd\u0002\ufffd\u001f;\n>\ufffd ee\ufffd\ufffdQ\ufffd\n\ufffdGLa\ufffd\ufffd&\u001bz\ufffd\ufffd\ub09f62\ufffd\\r6\ufffd\ufffd\\\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde\ufffd\ufffd@\ufffdF9Y\u0017\ufffd\u0000\u0007n\ufffdI\u0014+L\ufffd\ufffd\u001cH\ufffd\ufffd\u0002\ufffd\u001f;\n>\ufffd ee\ufffd\ufffdQ\ufffd\n\ufffdGLa\ufffd\ufffd&\u001bz\ufffd\ufffd\ub09f62\ufffd\\r6\ufffd\ufffd\\\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde\ufffd\ufffd@\ufffdF9Y\u0017\ufffd\u0000\u0007n\ufffdI\u0014+L\ufffd\ufffd\u001cH\ufffd\ufffd\u0002\ufffd\u001f;\n>\ufffd ee\ufffd\ufffdQ\ufffd\n\ufffdGLa\ufffd\ufffd&\u001bz\ufffd\ufffd\ub09f62\ufffd\\r6\ufffd\ufffd\\\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde\ufffd\ufffd@\ufffdF9Y\u0017\ufffd\u0000\u0007n\ufffdI\u0014+L\ufffd\ufffd\u001cH\ufffd\ufffd\u0002\ufffd\u001f;\n>\ufffd ee\ufffd\ufffdQ\ufffd\n\ufffdGLa\ufffd\ufffd&\u001bz\ufffd\ufffd\ub09f62\ufffd\\r6\ufffd\ufffd\\\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffde\ufffd\ufffd@\ufffdF9Y\u0017\ufffd\u0000\u0007n\ufffdI\u0014+L\ufffd\ufffd\u001cH\ufffd\ufffd\u0002\ufffd\u001f;\n>\ufffd ee\ufffd\ufffdQ\ufffd\n\ufffdGLa\ufffd\ufffd&\u001bz\ufffd\ufffd\ub09f62\ufffd\\r6\ufffd\ufffd\\\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c65c199556e12fe88b280efeb240421f75b5828",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
���U��{3x�`����$��tE8�!kB͠ ��D��_L�4���N�H{2������L�6� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
���U��{3x�`����$��tE8�!kB͠ ��D��_L�4���N�H{2������L�6� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9137285303032527,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "cc2425983e24c6382aa2c9e9e8714137",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdU\ufffd\ufffd\u0015{3x\ufffd`\ufffd\ufffd\ufffd\ufffd\u0006$\ufffd\ufffdtE8\ufffd!k\u0002B\u000e\u0360 \ufffd\ufffd\u0001D\ufffd\ufffd_L\ufffd4\ufffd\ufffd\ufffdN\u0006\ufffdH{2\u0017\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd6\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdU\ufffd\ufffd\u0015{3x\ufffd`\ufffd\ufffd\ufffd\ufffd\u0006$\ufffd\ufffdtE8\ufffd!k\u0002B\u000e\u0360 \ufffd\ufffd\u0001D\ufffd\ufffd_L\ufffd4\ufffd\ufffd\ufffdN\u0006\ufffdH{2\u0017\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd6\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdU\ufffd\ufffd\u0015{3x\ufffd`\ufffd\ufffd\ufffd\ufffd\u0006$\ufffd\ufffdtE8\ufffd!k\u0002B\u000e\u0360 \ufffd\ufffd\u0001D\ufffd\ufffd_L\ufffd4\ufffd\ufffd\ufffdN\u0006\ufffdH{2\u0017\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd6\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdU\ufffd\ufffd\u0015{3x\ufffd`\ufffd\ufffd\ufffd\ufffd\u0006$\ufffd\ufffdtE8\ufffd!k\u0002B\u000e\u0360 \ufffd\ufffd\u0001D\ufffd\ufffd_L\ufffd4\ufffd\ufffd\ufffdN\u0006\ufffdH{2\u0017\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd6\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdU\ufffd\ufffd\u0015{3x\ufffd`\ufffd\ufffd\ufffd\ufffd\u0006$\ufffd\ufffdtE8\ufffd!k\u0002B\u000e\u0360 \ufffd\ufffd\u0001D\ufffd\ufffd_L\ufffd4\ufffd\ufffd\ufffdN\u0006\ufffdH{2\u0017\ufffd\u000e\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd6\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56307d9e91098937e9af7dc63adb73b7ebb01f04",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 82,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique"
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��9�V�-XzP���r��l��f̖������4 �gR��d,����N���\�j��`�P
�c� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��9�V�-XzP���r��l��f̖������4 �gR��d,����N���\�j��`�P �c� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.985585945212759,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "a8cb191a8f01d27a2b07612d32791141",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9\ufffdV\ufffd\u0014-XzP\ufffd\ufffd\u0004\ufffdr\ufffd\ufffdl\ufffd\ufffdf\u0005\u0316\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd4 \ufffdgR\ufffd\ufffdd,\ufffd\ufffd\u0001\ufffd\ufffdN\ufffd\u07fb\ufffd\ufffd\\\ufffdj\ufffd\ufffd\u000e`\ufffdP\r\ufffdc\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9\ufffdV\ufffd\u0014-XzP\ufffd\ufffd\u0004\ufffdr\ufffd\ufffdl\ufffd\ufffdf\u0005\u0316\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd4 \ufffdgR\ufffd\ufffdd,\ufffd\ufffd\u0001\ufffd\ufffdN\ufffd\u07fb\ufffd\ufffd\\\ufffdj\ufffd\ufffd\u000e`\ufffdP\r\ufffdc\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9\ufffdV\ufffd\u0014-XzP\ufffd\ufffd\u0004\ufffdr\ufffd\ufffdl\ufffd\ufffdf\u0005\u0316\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd4 \ufffdgR\ufffd\ufffdd,\ufffd\ufffd\u0001\ufffd\ufffdN\ufffd\u07fb\ufffd\ufffd\\\ufffdj\ufffd\ufffd\u000e`\ufffdP\r\ufffdc\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9\ufffdV\ufffd\u0014-XzP\ufffd\ufffd\u0004\ufffdr\ufffd\ufffdl\ufffd\ufffdf\u0005\u0316\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd4 \ufffdgR\ufffd\ufffdd,\ufffd\ufffd\u0001\ufffd\ufffdN\ufffd\u07fb\ufffd\ufffd\\\ufffdj\ufffd\ufffd\u000e`\ufffdP\r\ufffdc\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd9\ufffdV\ufffd\u0014-XzP\ufffd\ufffd\u0004\ufffdr\ufffd\ufffdl\ufffd\ufffdf\u0005\u0316\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd4 \ufffdgR\ufffd\ufffdd,\ufffd\ufffd\u0001\ufffd\ufffdN\ufffd\u07fb\ufffd\ufffd\\\ufffdj\ufffd\ufffd\u000e`\ufffdP\r\ufffdc\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94eb39c9068738cfd7dadaa2dd5eef2577774893",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �rm��1&��[�*c~nzdߔ�����\�b�� �b
�p��M�vtzH���G� �oN���C1-�b� �
����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �rm��1&��[�*c~nzdߔ�����\�b�� �b �p��M�vtzH���G� �oN���C1-�b� � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ٪� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "a736c444cf383085724df4b5e47253cb",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.994959620475183,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "be71338c4134e2541dff31a343834529cc520e53",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a736c444cf383085724df4b5e47253cb",
"payload_hash": "e41667970a1fc9fefffda8f9e2c50d16",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003rm\ufffd\ufffd1&\ufffd\ufffd[\u001b\ufffd*c~nzd\u07d4\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdb\ufffd\ufffd \ufffdb\n\ufffdp\ufffd\ufffdM\ufffd\u0010vtzH\ufffd\ufffd\ufffdG\ufffd \ufffdoN\ufffd\ufffd\ufffdC1-\ufffdb\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003rm\ufffd\ufffd1&\ufffd\ufffd[\u001b\ufffd*c~nzd\u07d4\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdb\ufffd\ufffd \ufffdb\n\ufffdp\ufffd\ufffdM\ufffd\u0010vtzH\ufffd\ufffd\ufffdG\ufffd \ufffdoN\ufffd\ufffd\ufffdC1-\ufffdb\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u066a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003rm\ufffd\ufffd1&\ufffd\ufffd[\u001b\ufffd*c~nzd\u07d4\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdb\ufffd\ufffd \ufffdb\n\ufffdp\ufffd\ufffdM\ufffd\u0010vtzH\ufffd\ufffd\ufffdG\ufffd \ufffdoN\ufffd\ufffd\ufffdC1-\ufffdb\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003rm\ufffd\ufffd1&\ufffd\ufffd[\u001b\ufffd*c~nzd\u07d4\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdb\ufffd\ufffd \ufffdb\n\ufffdp\ufffd\ufffdM\ufffd\u0010vtzH\ufffd\ufffd\ufffdG\ufffd \ufffdoN\ufffd\ufffd\ufffdC1-\ufffdb\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u066a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003rm\ufffd\ufffd1&\ufffd\ufffd[\u001b\ufffd*c~nzd\u07d4\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdb\ufffd\ufffd \ufffdb\n\ufffdp\ufffd\ufffdM\ufffd\u0010vtzH\ufffd\ufffd\ufffdG\ufffd \ufffdoN\ufffd\ufffd\ufffdC1-\ufffdb\ufffd\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea58be58653851444e0fa2192e9809cce677fa5a",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �p B�Ƈ�|:�kB�
d��ɋ"� 'M/�� �� ��}� ] w���ijv���/n�x��杂B � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �p B�Ƈ�|:�kB� d��ɋ"� 'M/�� �� ��}� ] w���ijv���/n�x��杂B � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.943134198985002,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "025ed9289e60f59e5f84302b54316c0b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003p\tB\ufffd\u0187\ufffd|:\ufffdkB\ufffd\nd\u0016\u0012\ufffd\ufffd\u024b\u001a\"\ufffd\u001c'\u0014M\/\ufffd\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\u001b}\ufffd\u001f]\u0000w\ufffd\ufffd\ufffdijv\u0003\ufffd\ufffd\ufffd\/n\ufffdx\ufffd\ufffd\u6742B\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003p\tB\ufffd\u0187\ufffd|:\ufffdkB\ufffd\nd\u0016\u0012\ufffd\ufffd\u024b\u001a\"\ufffd\u001c'\u0014M\/\ufffd\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\u001b}\ufffd\u001f]\u0000w\ufffd\ufffd\ufffdijv\u0003\ufffd\ufffd\ufffd\/n\ufffdx\ufffd\ufffd\u6742B\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003p\tB\ufffd\u0187\ufffd|:\ufffdkB\ufffd\nd\u0016\u0012\ufffd\ufffd\u024b\u001a\"\ufffd\u001c'\u0014M\/\ufffd\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\u001b}\ufffd\u001f]\u0000w\ufffd\ufffd\ufffdijv\u0003\ufffd\ufffd\ufffd\/n\ufffdx\ufffd\ufffd\u6742B\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003p\tB\ufffd\u0187\ufffd|:\ufffdkB\ufffd\nd\u0016\u0012\ufffd\ufffd\u024b\u001a\"\ufffd\u001c'\u0014M\/\ufffd\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\u001b}\ufffd\u001f]\u0000w\ufffd\ufffd\ufffdijv\u0003\ufffd\ufffd\ufffd\/n\ufffdx\ufffd\ufffd\u6742B\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003p\tB\ufffd\u0187\ufffd|:\ufffdkB\ufffd\nd\u0016\u0012\ufffd\ufffd\u024b\u001a\"\ufffd\u001c'\u0014M\/\ufffd\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\u001b}\ufffd\u001f]\u0000w\ufffd\ufffd\ufffdijv\u0003\ufffd\ufffd\ufffd\/n\ufffdx\ufffd\ufffd\u6742B\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fff497287b58bd78757d8ef96641e4f9968a781a",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����`�g���b�'m��S=BO_XB��[ 9X:ò�r�P�M���zA3T)�9 ��~� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ����`�g���b�'m��S=BO_XB��[ 9X:ò�r�P�M���zA3T)�9 ��~� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "dfdc1042618f4583170eb9c6d386a23f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.950689103865736,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "9e701b1e69e98cfd00ac3faa5d4cfd0b94a4cbfb",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "dfdc1042618f4583170eb9c6d386a23f",
"payload_hash": "e52b02354c87b9932bfa0cd8a13634ec",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd`\ufffdg\ufffd\ufffd\u0019\ufffdb\ufffd'\bm\ufffd\u0017\ufffdS\u0016\u0013=BO_XB\ufffd\ufffd[ 9X\u0001:\u00f2\ufffdr\ufffd\u0006P\ufffdM\ufffd\ufffd\u0006\ufffd\u0003zA3T)\u0015\ufffd\u00069\u000b\ufffd\ufffd~\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd`\ufffdg\ufffd\ufffd\u0019\ufffdb\ufffd'\bm\ufffd\u0017\ufffdS\u0016\u0013=BO_XB\ufffd\ufffd[ 9X\u0001:\u00f2\ufffdr\ufffd\u0006P\ufffdM\ufffd\ufffd\u0006\ufffd\u0003zA3T)\u0015\ufffd\u00069\u000b\ufffd\ufffd~\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd`\ufffdg\ufffd\ufffd\u0019\ufffdb\ufffd'\bm\ufffd\u0017\ufffdS\u0016\u0013=BO_XB\ufffd\ufffd[ 9X\u0001:\u00f2\ufffdr\ufffd\u0006P\ufffdM\ufffd\ufffd\u0006\ufffd\u0003zA3T)\u0015\ufffd\u00069\u000b\ufffd\ufffd~\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd`\ufffdg\ufffd\ufffd\u0019\ufffdb\ufffd'\bm\ufffd\u0017\ufffdS\u0016\u0013=BO_XB\ufffd\ufffd[ 9X\u0001:\u00f2\ufffdr\ufffd\u0006P\ufffdM\ufffd\ufffd\u0006\ufffd\u0003zA3T)\u0015\ufffd\u00069\u000b\ufffd\ufffd~\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0012\ufffd\ufffd`\ufffdg\ufffd\ufffd\u0019\ufffdb\ufffd'\bm\ufffd\u0017\ufffdS\u0016\u0013=BO_XB\ufffd\ufffd[ 9X\u0001:\u00f2\ufffdr\ufffd\u0006P\ufffdM\ufffd\ufffd\u0006\ufffd\u0003zA3T)\u0015\ufffd\u00069\u000b\ufffd\ufffd~\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e178f51ab78f0bec4e0e7f18b5999c6992b5764",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �t�'WsU��H�� ���V��r_:W�� ��� 4.1��Ѓ�ت$��6fa�G�G���Rs �� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �t�'WsU��H�� ���V��r_:W�� ��� 4.1��Ѓ�ت$��6fa�G�G���Rs �� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.992745208404094,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "8c671420ef779f1cc80d678fc557e843",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002t\ufffd'WsU\ufffd\ufffd\u001bH\ufffd\ufffd\u001c\u001a\ufffd\ufffd\ufffdV\ufffd\u0016\ufffd\u000fr_:W\ufffd\ufffd \ufffd\ufffd\ufffd 4.1\ufffd\ufffd\u0403\ufffd\u062a$\ufffd\u0015\ufffd6fa\ufffdG\u0016\ufffdG\u001a\ufffd\ufffd\ufffdRs\u001d\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002t\ufffd'WsU\ufffd\ufffd\u001bH\ufffd\ufffd\u001c\u001a\ufffd\ufffd\ufffdV\ufffd\u0016\ufffd\u000fr_:W\ufffd\ufffd \ufffd\ufffd\ufffd 4.1\ufffd\ufffd\u0403\ufffd\u062a$\ufffd\u0015\ufffd6fa\ufffdG\u0016\ufffdG\u001a\ufffd\ufffd\ufffdRs\u001d\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002t\ufffd'WsU\ufffd\ufffd\u001bH\ufffd\ufffd\u001c\u001a\ufffd\ufffd\ufffdV\ufffd\u0016\ufffd\u000fr_:W\ufffd\ufffd \ufffd\ufffd\ufffd 4.1\ufffd\ufffd\u0403\ufffd\u062a$\ufffd\u0015\ufffd6fa\ufffdG\u0016\ufffdG\u001a\ufffd\ufffd\ufffdRs\u001d\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002t\ufffd'WsU\ufffd\ufffd\u001bH\ufffd\ufffd\u001c\u001a\ufffd\ufffd\ufffdV\ufffd\u0016\ufffd\u000fr_:W\ufffd\ufffd \ufffd\ufffd\ufffd 4.1\ufffd\ufffd\u0403\ufffd\u062a$\ufffd\u0015\ufffd6fa\ufffdG\u0016\ufffdG\u001a\ufffd\ufffd\ufffdRs\u001d\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002t\ufffd'WsU\ufffd\ufffd\u001bH\ufffd\ufffd\u001c\u001a\ufffd\ufffd\ufffdV\ufffd\u0016\ufffd\u000fr_:W\ufffd\ufffd \ufffd\ufffd\ufffd 4.1\ufffd\ufffd\u0403\ufffd\u062a$\ufffd\u0015\ufffd6fa\ufffdG\u0016\ufffdG\u001a\ufffd\ufffd\ufffdRs\u001d\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0480519642df371b18189fff0f399d14394423fa",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �7ψ �݀�G���m~?�[���\����j
{ �3քs��� ��B�!�A�v���"x��e���N � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �7ψ �݀�G���m~?�[���\����j { �3քs��� ��B�!�A�v���"x��e���N � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.038322605961104,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "19a7310147555b6f58c7025d948712c1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u03c8\u001f\ufffd\u0740\u0018\u001b\ufffdG\ufffd\ufffd\ufffdm~?\ufffd[\ufffd\u001a\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffdj\r\u001d{ \ufffd3\u0584s\ufffd\ufffd\ufffd \ufffd\ufffdB\ufffd!\ufffdA\ufffdv\ufffd\ufffd\ufffd\u001a\"x\ufffd\ufffde\ufffd\ufffd\ufffdN\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u03c8\u001f\ufffd\u0740\u0018\u001b\ufffdG\ufffd\ufffd\ufffdm~?\ufffd[\ufffd\u001a\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffdj\r\u001d{ \ufffd3\u0584s\ufffd\ufffd\ufffd \ufffd\ufffdB\ufffd!\ufffdA\ufffdv\ufffd\ufffd\ufffd\u001a\"x\ufffd\ufffde\ufffd\ufffd\ufffdN\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u03c8\u001f\ufffd\u0740\u0018\u001b\ufffdG\ufffd\ufffd\ufffdm~?\ufffd[\ufffd\u001a\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffdj\r\u001d{ \ufffd3\u0584s\ufffd\ufffd\ufffd \ufffd\ufffdB\ufffd!\ufffdA\ufffdv\ufffd\ufffd\ufffd\u001a\"x\ufffd\ufffde\ufffd\ufffd\ufffdN\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u03c8\u001f\ufffd\u0740\u0018\u001b\ufffdG\ufffd\ufffd\ufffdm~?\ufffd[\ufffd\u001a\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffdj\r\u001d{ \ufffd3\u0584s\ufffd\ufffd\ufffd \ufffd\ufffdB\ufffd!\ufffdA\ufffdv\ufffd\ufffd\ufffd\u001a\"x\ufffd\ufffde\ufffd\ufffd\ufffdN\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00037\u03c8\u001f\ufffd\u0740\u0018\u001b\ufffdG\ufffd\ufffd\ufffdm~?\ufffd[\ufffd\u001a\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffdj\r\u001d{ \ufffd3\u0584s\ufffd\ufffd\ufffd \ufffd\ufffdB\ufffd!\ufffdA\ufffdv\ufffd\ufffd\ufffd\u001a\"x\ufffd\ufffde\ufffd\ufffd\ufffdN\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2a578fad807fbc0c4b8f53abf7db5a16e214895",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��P|�յ� ���n�l�� ��I�_��W�� �ǃ��l/ �p*pg%W/��MR�v��ÿ�D� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��P|�յ� ���n�l�� ��I�_��W�� �ǃ��l/ �p*pg%W/��MR�v��ÿ�D� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.992869090257861,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "176ec8464e117ff9399c70d235ab40ab",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdP|\ufffd\u0575\ufffd\u001e\ufffd\ufffd\ufffdn\ufffdl\ufffd\ufffd \ufffd\ufffdI\ufffd_\ufffd\ufffdW\u001a\u000f\ufffd\u07fb\ufffd \ufffd\u01c3\ufffd\ufffd\u0013l\/\u000b\ufffdp*pg%W\u0004\/\ufffd\ufffdMR\ufffdv\ufffd\u0014\ufffd\u00ff\ufffdD\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdP|\ufffd\u0575\ufffd\u001e\ufffd\ufffd\ufffdn\ufffdl\ufffd\ufffd \ufffd\ufffdI\ufffd_\ufffd\ufffdW\u001a\u000f\ufffd\u07fb\ufffd \ufffd\u01c3\ufffd\ufffd\u0013l\/\u000b\ufffdp*pg%W\u0004\/\ufffd\ufffdMR\ufffdv\ufffd\u0014\ufffd\u00ff\ufffdD\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdP|\ufffd\u0575\ufffd\u001e\ufffd\ufffd\ufffdn\ufffdl\ufffd\ufffd \ufffd\ufffdI\ufffd_\ufffd\ufffdW\u001a\u000f\ufffd\u07fb\ufffd \ufffd\u01c3\ufffd\ufffd\u0013l\/\u000b\ufffdp*pg%W\u0004\/\ufffd\ufffdMR\ufffdv\ufffd\u0014\ufffd\u00ff\ufffdD\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdP|\ufffd\u0575\ufffd\u001e\ufffd\ufffd\ufffdn\ufffdl\ufffd\ufffd \ufffd\ufffdI\ufffd_\ufffd\ufffdW\u001a\u000f\ufffd\u07fb\ufffd \ufffd\u01c3\ufffd\ufffd\u0013l\/\u000b\ufffdp*pg%W\u0004\/\ufffd\ufffdMR\ufffdv\ufffd\u0014\ufffd\u00ff\ufffdD\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdP|\ufffd\u0575\ufffd\u001e\ufffd\ufffd\ufffdn\ufffdl\ufffd\ufffd \ufffd\ufffdI\ufffd_\ufffd\ufffdW\u001a\u000f\ufffd\u07fb\ufffd \ufffd\u01c3\ufffd\ufffd\u0013l\/\u000b\ufffdp*pg%W\u0004\/\ufffd\ufffdMR\ufffdv\ufffd\u0014\ufffd\u00ff\ufffdD\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f042a527a380c1a9e44e9d3ee94bf3759d98ffe",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Injection PHP
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
—
Recommandation
Investiguer
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
97%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���
�${^�#w�����v�'�}�
�Ѻi� Ȃm:*����B�J]\0�B��~I�\� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��� �${^�#w�����v�'�}� �Ѻi� Ȃm:*����B�J]\0�B��~I�\� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.949928136927116,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"CRS 933135",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0162",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "b4b4720d6f1b60084ff6f6dd3744cfb9",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 52
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\b\ufffd\ufffd\n\ufffd${^\ufffd\u0001#w\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd'\ufffd}\u001a\ufffd\u0015\r\u0005\ufffd\u047ai\ufffd \u000b\u0202m:*\u0015\u0017\ufffd\ufffd\ufffd\u0005\ufffdB\ufffdJ]\u0012\\0\ufffdB\ufffd\ufffd~I\ufffd\\\ufffd\u0014\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\b\ufffd\ufffd\n\ufffd${^\ufffd\u0001#w\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd'\ufffd}\u001a\ufffd\u0015\r\u0005\ufffd\u047ai\ufffd \u000b\u0202m:*\u0015\u0017\ufffd\ufffd\ufffd\u0005\ufffdB\ufffdJ]\u0012\\0\ufffdB\ufffd\ufffd~I\ufffd\\\ufffd\u0014\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\b\ufffd\ufffd\n\ufffd${^\ufffd\u0001#w\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd'\ufffd}\u001a\ufffd\u0015\r\u0005\ufffd\u047ai\ufffd \u000b\u0202m:*\u0015\u0017\ufffd\ufffd\ufffd\u0005\ufffdB\ufffdJ]\u0012\\0\ufffdB\ufffd\ufffd~I\ufffd\\\ufffd\u0014\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\b\ufffd\ufffd\n\ufffd${^\ufffd\u0001#w\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd'\ufffd}\u001a\ufffd\u0015\r\u0005\ufffd\u047ai\ufffd \u000b\u0202m:*\u0015\u0017\ufffd\ufffd\ufffd\u0005\ufffdB\ufffdJ]\u0012\\0\ufffdB\ufffd\ufffd~I\ufffd\\\ufffd\u0014\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\b\ufffd\ufffd\n\ufffd${^\ufffd\u0001#w\ufffd\ufffd\ufffd\ufffd\ufffdv\ufffd'\ufffd}\u001a\ufffd\u0015\r\u0005\ufffd\u047ai\ufffd \u000b\u0202m:*\u0015\u0017\ufffd\ufffd\ufffd\u0005\ufffdB\ufffdJ]\u0012\\0\ufffdB\ufffd\ufffd~I\ufffd\\\ufffd\u0014\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b6fcbb8a19eb55013b60e9f5f7d6c4e88b4f2696",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P��
���=��A�w_� y���%��̒g�<L�� � ���6����Z_׀�p@e`�� מ�a F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�� ���=��A�w_� y���%��̒g�<L�� � ���6����Z_׀�p@e`�� מ�a F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.0871190989229085,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "4d82fa8c88c4b645a0dd88048ef33eba",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\r\ufffd\ufffd\ufffd=\ufffd\ufffdA\ufffdw_\ufffd\u001fy\ufffd\ufffd\u0014\ufffd%\ufffd\ufffd\u0312g\ufffd<L\ufffd\ufffd \u0002\ufffd \ufffd\ufffd\ufffd\u00196\ufffd\ufffd\u0006\ufffd\ufffdZ_\u0017\u05c0\ufffdp@\u0017e`\ufffd\ufffd \u05de\ufffda\u0004\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\r\ufffd\ufffd\ufffd=\ufffd\ufffdA\ufffdw_\ufffd\u001fy\ufffd\ufffd\u0014\ufffd%\ufffd\ufffd\u0312g\ufffd<L\ufffd\ufffd \u0002\ufffd \ufffd\ufffd\ufffd\u00196\ufffd\ufffd\u0006\ufffd\ufffdZ_\u0017\u05c0\ufffdp@\u0017e`\ufffd\ufffd \u05de\ufffda\u0004\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\r\ufffd\ufffd\ufffd=\ufffd\ufffdA\ufffdw_\ufffd\u001fy\ufffd\ufffd\u0014\ufffd%\ufffd\ufffd\u0312g\ufffd<L\ufffd\ufffd \u0002\ufffd \ufffd\ufffd\ufffd\u00196\ufffd\ufffd\u0006\ufffd\ufffdZ_\u0017\u05c0\ufffdp@\u0017e`\ufffd\ufffd \u05de\ufffda\u0004\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\r\ufffd\ufffd\ufffd=\ufffd\ufffdA\ufffdw_\ufffd\u001fy\ufffd\ufffd\u0014\ufffd%\ufffd\ufffd\u0312g\ufffd<L\ufffd\ufffd \u0002\ufffd \ufffd\ufffd\ufffd\u00196\ufffd\ufffd\u0006\ufffd\ufffdZ_\u0017\u05c0\ufffdp@\u0017e`\ufffd\ufffd \u05de\ufffda\u0004\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\ufffd\r\ufffd\ufffd\ufffd=\ufffd\ufffdA\ufffdw_\ufffd\u001fy\ufffd\ufffd\u0014\ufffd%\ufffd\ufffd\u0312g\ufffd<L\ufffd\ufffd \u0002\ufffd \ufffd\ufffd\ufffd\u00196\ufffd\ufffd\u0006\ufffd\ufffdZ_\u0017\u05c0\ufffdp@\u0017e`\ufffd\ufffd \u05de\ufffda\u0004\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe6f5617f75b3f4a9b2a9de98e93205158a1f277",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B��,P�>_q'�b� � .X�*�%=�5 ��V Ie96�X��su �ۂE�ؕ�ߎ��Oc D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B��,P�>_q'�b� � .X�*�%=�5 ��V Ie96�X��su �ۂE�ؕ�ߎ��Oc D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.98277637512812,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "d119f1acca185e9b5488f89121c37ddc",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd,P\u0013\ufffd>\u0006\u0012_q'\ufffdb\u0016\ufffd\u001c\ufffd\u0000.X\ufffd*\ufffd%=\ufffd5\u0000\ufffd\ufffdV \u0016I\u000ee9\u00046\ufffdX\ufffd\ufffds\u0012\u0001u \ufffd\u06c2E\ufffd\u0615\ufffd\u07ce\ufffd\u0002\ufffdOc\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd,P\u0013\ufffd>\u0006\u0012_q'\ufffdb\u0016\ufffd\u001c\ufffd\u0000.X\ufffd*\ufffd%=\ufffd5\u0000\ufffd\ufffdV \u0016I\u000ee9\u00046\ufffdX\ufffd\ufffds\u0012\u0001u \ufffd\u06c2E\ufffd\u0615\ufffd\u07ce\ufffd\u0002\ufffdOc\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd,P\u0013\ufffd>\u0006\u0012_q'\ufffdb\u0016\ufffd\u001c\ufffd\u0000.X\ufffd*\ufffd%=\ufffd5\u0000\ufffd\ufffdV \u0016I\u000ee9\u00046\ufffdX\ufffd\ufffds\u0012\u0001u \ufffd\u06c2E\ufffd\u0615\ufffd\u07ce\ufffd\u0002\ufffdOc\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd,P\u0013\ufffd>\u0006\u0012_q'\ufffdb\u0016\ufffd\u001c\ufffd\u0000.X\ufffd*\ufffd%=\ufffd5\u0000\ufffd\ufffdV \u0016I\u000ee9\u00046\ufffdX\ufffd\ufffds\u0012\u0001u \ufffd\u06c2E\ufffd\u0615\ufffd\u07ce\ufffd\u0002\ufffdOc\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffd,P\u0013\ufffd>\u0006\u0012_q'\ufffdb\u0016\ufffd\u001c\ufffd\u0000.X\ufffd*\ufffd%=\ufffd5\u0000\ufffd\ufffdV \u0016I\u000ee9\u00046\ufffdX\ufffd\ufffds\u0012\u0001u \ufffd\u06c2E\ufffd\u0615\ufffd\u07ce\ufffd\u0002\ufffdOc\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8b0d382cef830e7b0134ed0400d7e3b02239177d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 2,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�����*꺻~��D^
&�;��'�'$M�l ��ŭ�����
���D�!�|_]��V�t^}�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�����*꺻~��D^ &�;��'�'$M�l ��ŭ����� ���D�!�|_]��V�t^}�� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9228124025138844,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "16eceb990c933ec32788bec94ca2b55a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0017*\u001b\u0017\uaebb~\ufffd\ufffdD^\n\u0006&\ufffd\b;\ufffd\ufffd'\ufffd'$M\ufffdl \ufffd\ufffd\u016d\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0014\u0003\ufffd\ufffd\ufffdD\ufffd!\ufffd|_]\ufffd\ufffdV\ufffdt^}\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0017*\u001b\u0017\uaebb~\ufffd\ufffdD^\n\u0006&\ufffd\b;\ufffd\ufffd'\ufffd'$M\ufffdl \ufffd\ufffd\u016d\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0014\u0003\ufffd\ufffd\ufffdD\ufffd!\ufffd|_]\ufffd\ufffdV\ufffdt^}\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0017*\u001b\u0017\uaebb~\ufffd\ufffdD^\n\u0006&\ufffd\b;\ufffd\ufffd'\ufffd'$M\ufffdl \ufffd\ufffd\u016d\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0014\u0003\ufffd\ufffd\ufffdD\ufffd!\ufffd|_]\ufffd\ufffdV\ufffdt^}\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0017*\u001b\u0017\uaebb~\ufffd\ufffdD^\n\u0006&\ufffd\b;\ufffd\ufffd'\ufffd'$M\ufffdl \ufffd\ufffd\u016d\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0014\u0003\ufffd\ufffd\ufffdD\ufffd!\ufffd|_]\ufffd\ufffdV\ufffdt^}\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0017*\u001b\u0017\uaebb~\ufffd\ufffdD^\n\u0006&\ufffd\b;\ufffd\ufffd'\ufffd'$M\ufffdl \ufffd\ufffd\u016d\ufffd\ufffd\ufffd\ufffd\ufffd\n\u0014\u0003\ufffd\ufffd\ufffdD\ufffd!\ufffd|_]\ufffd\ufffdV\ufffdt^}\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d764bc21a4e4dab0bd2d5f681c7c2656e9dfb395",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �<;�vg��W�lA�P.Ď���E�"Y�B\N��#V ���NI�a�Y�ݞh�؊�A����a8 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �<;�vg��W�lA�P.Ď���E�"Y�B\N��#V ���NI�a�Y�ݞh�؊�A����a8 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.00220330561389,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "3d6c884273ce5f4c8ba5ecb86f5bfe6d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003<;\ufffdvg\ufffd\ufffdW\ufffdlA\ufffdP.\u010e\ufffd\ufffd\ufffdE\ufffd\u0011\"Y\ufffdB\\N\ufffd\ufffd#V \ufffd\ufffd\ufffdNI\ufffda\ufffdY\ufffd\u075eh\ufffd\u001b\u060a\ufffd\u001b\u0017A\udb08\ude7d\ufffd\ufffd\ufffd\ufffda8\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003<;\ufffdvg\ufffd\ufffdW\ufffdlA\ufffdP.\u010e\ufffd\ufffd\ufffdE\ufffd\u0011\"Y\ufffdB\\N\ufffd\ufffd#V \ufffd\ufffd\ufffdNI\ufffda\ufffdY\ufffd\u075eh\ufffd\u001b\u060a\ufffd\u001b\u0017A\udb08\ude7d\ufffd\ufffd\ufffd\ufffda8\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003<;\ufffdvg\ufffd\ufffdW\ufffdlA\ufffdP.\u010e\ufffd\ufffd\ufffdE\ufffd\u0011\"Y\ufffdB\\N\ufffd\ufffd#V \ufffd\ufffd\ufffdNI\ufffda\ufffdY\ufffd\u075eh\ufffd\u001b\u060a\ufffd\u001b\u0017A\udb08\ude7d\ufffd\ufffd\ufffd\ufffda8\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003<;\ufffdvg\ufffd\ufffdW\ufffdlA\ufffdP.\u010e\ufffd\ufffd\ufffdE\ufffd\u0011\"Y\ufffdB\\N\ufffd\ufffd#V \ufffd\ufffd\ufffdNI\ufffda\ufffdY\ufffd\u075eh\ufffd\u001b\u060a\ufffd\u001b\u0017A\udb08\ude7d\ufffd\ufffd\ufffd\ufffda8\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003<;\ufffdvg\ufffd\ufffdW\ufffdlA\ufffdP.\u010e\ufffd\ufffd\ufffdE\ufffd\u0011\"Y\ufffdB\\N\ufffd\ufffd#V \ufffd\ufffd\ufffdNI\ufffda\ufffdY\ufffd\u075eh\ufffd\u001b\u060a\ufffd\u001b\u0017A\udb08\ude7d\ufffd\ufffd\ufffd\ufffda8\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d64ac2b52f0910e7b347f80858f35073b7c82d93",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �6.,�A �10�D�p�'�����Dۏ���@� r�G���uO� �Ġ'�,��LۜN� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �6.,�A �10�D�p�'�����Dۏ���@� r�G���uO� �Ġ'�,��LۜN� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.916676470458546,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "bd7d7f60aea192846c5399d24451c1ad",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00036.,\ufffdA\u000b\ufffd10\ufffdD\ufffdp\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdD\u06cf\ufffd\u0a79\ufffd\ufffd@\ufffd \u0000r\ufffdG\ufffd\ufffd\u0012\ufffduO\ufffd\u0003\u0000\ufffd\u0120'\ufffd,\ufffd\u05fc\ufffdL\u0013\u06dcN\u0017\ufffd\u0012\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00036.,\ufffdA\u000b\ufffd10\ufffdD\ufffdp\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdD\u06cf\ufffd\u0a79\ufffd\ufffd@\ufffd \u0000r\ufffdG\ufffd\ufffd\u0012\ufffduO\ufffd\u0003\u0000\ufffd\u0120'\ufffd,\ufffd\u05fc\ufffdL\u0013\u06dcN\u0017\ufffd\u0012\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00036.,\ufffdA\u000b\ufffd10\ufffdD\ufffdp\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdD\u06cf\ufffd\u0a79\ufffd\ufffd@\ufffd \u0000r\ufffdG\ufffd\ufffd\u0012\ufffduO\ufffd\u0003\u0000\ufffd\u0120'\ufffd,\ufffd\u05fc\ufffdL\u0013\u06dcN\u0017\ufffd\u0012\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00036.,\ufffdA\u000b\ufffd10\ufffdD\ufffdp\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdD\u06cf\ufffd\u0a79\ufffd\ufffd@\ufffd \u0000r\ufffdG\ufffd\ufffd\u0012\ufffduO\ufffd\u0003\u0000\ufffd\u0120'\ufffd,\ufffd\u05fc\ufffdL\u0013\u06dcN\u0017\ufffd\u0012\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00036.,\ufffdA\u000b\ufffd10\ufffdD\ufffdp\ufffd'\ufffd\ufffd\ufffd\ufffd\ufffdD\u06cf\ufffd\u0a79\ufffd\ufffd@\ufffd \u0000r\ufffdG\ufffd\ufffd\u0012\ufffduO\ufffd\u0003\u0000\ufffd\u0120'\ufffd,\ufffd\u05fc\ufffdL\u0013\u06dcN\u0017\ufffd\u0012\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31dc64e804abf8ab179b09053a5759697b22dad6",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �>�x�Ueh� o� ��i��
�{�#E��% B �>��]��9l z �p�98�(B�R �j����E � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �>�x�Ueh� o� ��i�� �{�#E��% B �>��]��9l z �p�98�(B�R �j����E � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.97984094628014,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "f33342746a6615aad99f9f162bcdc9f3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013>\ufffdx\ufffdU\u0007eh\ufffd\fo\ufffd\u001e\ufffd\ufffdi\ufffd\ufffd\n\ufffd{\ufffd\u000f#E\ufffd\ufffd% B \u0015\ufffd>\ufffd\ufffd]\ufffd\ufffd9l\u001fz\u0000\ufffdp\ufffd98\u0019\ufffd(B\ufffdR\t\ufffdj\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013>\ufffdx\ufffdU\u0007eh\ufffd\fo\ufffd\u001e\ufffd\ufffdi\ufffd\ufffd\n\ufffd{\ufffd\u000f#E\ufffd\ufffd% B \u0015\ufffd>\ufffd\ufffd]\ufffd\ufffd9l\u001fz\u0000\ufffdp\ufffd98\u0019\ufffd(B\ufffdR\t\ufffdj\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013>\ufffdx\ufffdU\u0007eh\ufffd\fo\ufffd\u001e\ufffd\ufffdi\ufffd\ufffd\n\ufffd{\ufffd\u000f#E\ufffd\ufffd% B \u0015\ufffd>\ufffd\ufffd]\ufffd\ufffd9l\u001fz\u0000\ufffdp\ufffd98\u0019\ufffd(B\ufffdR\t\ufffdj\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013>\ufffdx\ufffdU\u0007eh\ufffd\fo\ufffd\u001e\ufffd\ufffdi\ufffd\ufffd\n\ufffd{\ufffd\u000f#E\ufffd\ufffd% B \u0015\ufffd>\ufffd\ufffd]\ufffd\ufffd9l\u001fz\u0000\ufffdp\ufffd98\u0019\ufffd(B\ufffdR\t\ufffdj\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0013>\ufffdx\ufffdU\u0007eh\ufffd\fo\ufffd\u001e\ufffd\ufffdi\ufffd\ufffd\n\ufffd{\ufffd\u000f#E\ufffd\ufffd% B \u0015\ufffd>\ufffd\ufffd]\ufffd\ufffd9l\u001fz\u0000\ufffdp\ufffd98\u0019\ufffd(B\ufffdR\t\ufffdj\ufffd\ufffd\ufffd\ufffdE\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9e0770f2df97ab29591ea84c234b5d2f9d68946",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���u)�r���^-ӌ�#c���Nc}G��mI� ���\�� p~��p���7qU|/�<�� �jj����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ���u)�r���^-ӌ�#c���Nc}G��mI� ���\�� p~��p���7qU|/�<�� �jj����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ي� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "b250061d3598591bd7cb252e793a1781",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.947834900648686,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "8be74bc76dcb18ef537f476f3ed335d3849419de",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b250061d3598591bd7cb252e793a1781",
"payload_hash": "9db6c33e8819ae2070d5606e61a678d5",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdu)\u0003\ufffdr\ufffd\ufffd\ufffd^-\u04cc\ufffd\u0017#c\ufffd\ufffd\ufffd\u000fNc}G\ufffd\ufffdmI\ufffd \ufffd\ufffd\ufffd\\\ufffd\ufffd\u001d\u000fp\u001a~\u0013\ufffd\ufffdp\u0010\ufffd\ufffd\ufffd7qU|\/\ufffd<\ufffd\ufffd\b\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdu)\u0003\ufffdr\ufffd\ufffd\ufffd^-\u04cc\ufffd\u0017#c\ufffd\ufffd\ufffd\u000fNc}G\ufffd\ufffdmI\ufffd \ufffd\ufffd\ufffd\\\ufffd\ufffd\u001d\u000fp\u001a~\u0013\ufffd\ufffdp\u0010\ufffd\ufffd\ufffd7qU|\/\ufffd<\ufffd\ufffd\b\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u064a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdu)\u0003\ufffdr\ufffd\ufffd\ufffd^-\u04cc\ufffd\u0017#c\ufffd\ufffd\ufffd\u000fNc}G\ufffd\ufffdmI\ufffd \ufffd\ufffd\ufffd\\\ufffd\ufffd\u001d\u000fp\u001a~\u0013\ufffd\ufffdp\u0010\ufffd\ufffd\ufffd7qU|\/\ufffd<\ufffd\ufffd\b\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdu)\u0003\ufffdr\ufffd\ufffd\ufffd^-\u04cc\ufffd\u0017#c\ufffd\ufffd\ufffd\u000fNc}G\ufffd\ufffdmI\ufffd \ufffd\ufffd\ufffd\\\ufffd\ufffd\u001d\u000fp\u001a~\u0013\ufffd\ufffdp\u0010\ufffd\ufffd\ufffd7qU|\/\ufffd<\ufffd\ufffd\b\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u064a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdu)\u0003\ufffdr\ufffd\ufffd\ufffd^-\u04cc\ufffd\u0017#c\ufffd\ufffd\ufffd\u000fNc}G\ufffd\ufffdmI\ufffd \ufffd\ufffd\ufffd\\\ufffd\ufffd\u001d\u000fp\u001a~\u0013\ufffd\ufffdp\u0010\ufffd\ufffd\ufffd7qU|\/\ufffd<\ufffd\ufffd\b\u0000\ufffdjj\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70a546eb6aa6205aa2d96ddaf96343c6378622d5",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B�� �8��5~�Q4g��6�q�"�$�߉:�F�� 荧/ŋ������"J6~�y
Q{W[C�'HY D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B�� �8��5~�Q4g��6�q�"�$�߉:�F�� 荧/ŋ������"J6~�y Q{W[C�'HY D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.004930528677601,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "64115c4b85d89699c848027ae4325913",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0016\ufffd\f\ufffd8\ufffd\ufffd5~\ufffdQ4g\ufffd\ufffd6\u000f\ufffdq\ufffd\"\ufffd$\ufffd\u07c9:\ufffdF\ufffd\ufffd \u8367\/\u0012\u014b\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\"\u0016J6~\ufffdy\nQ{W[C\ufffd'HY\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0016\ufffd\f\ufffd8\ufffd\ufffd5~\ufffdQ4g\ufffd\ufffd6\u000f\ufffdq\ufffd\"\ufffd$\ufffd\u07c9:\ufffdF\ufffd\ufffd \u8367\/\u0012\u014b\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\"\u0016J6~\ufffdy\nQ{W[C\ufffd'HY\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0016\ufffd\f\ufffd8\ufffd\ufffd5~\ufffdQ4g\ufffd\ufffd6\u000f\ufffdq\ufffd\"\ufffd$\ufffd\u07c9:\ufffdF\ufffd\ufffd \u8367\/\u0012\u014b\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\"\u0016J6~\ufffdy\nQ{W[C\ufffd'HY\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0016\ufffd\f\ufffd8\ufffd\ufffd5~\ufffdQ4g\ufffd\ufffd6\u000f\ufffdq\ufffd\"\ufffd$\ufffd\u07c9:\ufffdF\ufffd\ufffd \u8367\/\u0012\u014b\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\"\u0016J6~\ufffdy\nQ{W[C\ufffd'HY\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0016\ufffd\f\ufffd8\ufffd\ufffd5~\ufffdQ4g\ufffd\ufffd6\u000f\ufffdq\ufffd\"\ufffd$\ufffd\u07c9:\ufffdF\ufffd\ufffd \u8367\/\u0012\u014b\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd\"\u0016J6~\ufffdy\nQ{W[C\ufffd'HY\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1859bd3cce27d84ba8d63c46b35bc351efeaf99",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��̐��`�V�噗ۨJ8�y2��x��(��U �?����E�0@rϘ�̜6���=��M��� �����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��̐��`�V�噗ۨJ8�y2��x��(��U �?����E�0@rϘ�̜6���=��M��� �����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "7653270cc40fe7916f89072baed63de2",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.00618389834911,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "a636f2958bd5aba527b8bcabb0f5568412211d5f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "7653270cc40fe7916f89072baed63de2",
"payload_hash": "a0a2d17eada778518cd340e9bc4cb29a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0310\ufffd\ufffd`\ufffdV\ufffd\u5657\u06e8J8\ufffd\u0004y2\ufffd\ufffdx\ufffd\ufffd(\ufffd\u0016\ufffdU \ufffd?\ufffd\ufffd\u0002\u0007\ufffd\ufffdE\u0013\ufffd0\u001b@r\u03d8\ufffd\u031c6\ufffd\ufffd\ufffd=\ufffd\ufffdM\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0310\ufffd\ufffd`\ufffdV\ufffd\u5657\u06e8J8\ufffd\u0004y2\ufffd\ufffdx\ufffd\ufffd(\ufffd\u0016\ufffdU \ufffd?\ufffd\ufffd\u0002\u0007\ufffd\ufffdE\u0013\ufffd0\u001b@r\u03d8\ufffd\u031c6\ufffd\ufffd\ufffd=\ufffd\ufffdM\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0310\ufffd\ufffd`\ufffdV\ufffd\u5657\u06e8J8\ufffd\u0004y2\ufffd\ufffdx\ufffd\ufffd(\ufffd\u0016\ufffdU \ufffd?\ufffd\ufffd\u0002\u0007\ufffd\ufffdE\u0013\ufffd0\u001b@r\u03d8\ufffd\u031c6\ufffd\ufffd\ufffd=\ufffd\ufffdM\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0310\ufffd\ufffd`\ufffdV\ufffd\u5657\u06e8J8\ufffd\u0004y2\ufffd\ufffdx\ufffd\ufffd(\ufffd\u0016\ufffdU \ufffd?\ufffd\ufffd\u0002\u0007\ufffd\ufffdE\u0013\ufffd0\u001b@r\u03d8\ufffd\u031c6\ufffd\ufffd\ufffd=\ufffd\ufffdM\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0310\ufffd\ufffd`\ufffdV\ufffd\u5657\u06e8J8\ufffd\u0004y2\ufffd\ufffdx\ufffd\ufffd(\ufffd\u0016\ufffdU \ufffd?\ufffd\ufffd\u0002\u0007\ufffd\ufffdE\u0013\ufffd0\u001b@r\u03d8\ufffd\u031c6\ufffd\ufffd\ufffd=\ufffd\ufffdM\ufffd\ufffd\ufffd\u0000\ufffd\u001a\u001a\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35a9530f01962d43b4a69fc5919bce3d896373d9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �u��"��Y�B�㕃L�XdIb�E���0�ܗ_ �[����g�*�7��DU��r� ���hHE�J��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �u��"��Y�B�㕃L�XdIb�E���0�ܗ_ �[����g�*�7��DU��r� ���hHE�J��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.067153889992083,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "b6fa3618400614e97d21e9fdd403284d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002u\ufffd\ufffd\"\u0003\ufffd\ufffdY\ufffdB\ufffd\u3543L\ufffdXdIb\ufffdE\ufffd\ufffd\u001a\ufffd0\ufffd\u0717_ \ufffd[\ufffd\u0004\ufffd\ufffd\ufffdg\ufffd*\ufffd7\ufffd\ufffdDU\ufffd\ufffdr\ufffd \ufffd\ufffd\ufffdhHE\ufffdJ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002u\ufffd\ufffd\"\u0003\ufffd\ufffdY\ufffdB\ufffd\u3543L\ufffdXdIb\ufffdE\ufffd\ufffd\u001a\ufffd0\ufffd\u0717_ \ufffd[\ufffd\u0004\ufffd\ufffd\ufffdg\ufffd*\ufffd7\ufffd\ufffdDU\ufffd\ufffdr\ufffd \ufffd\ufffd\ufffdhHE\ufffdJ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002u\ufffd\ufffd\"\u0003\ufffd\ufffdY\ufffdB\ufffd\u3543L\ufffdXdIb\ufffdE\ufffd\ufffd\u001a\ufffd0\ufffd\u0717_ \ufffd[\ufffd\u0004\ufffd\ufffd\ufffdg\ufffd*\ufffd7\ufffd\ufffdDU\ufffd\ufffdr\ufffd \ufffd\ufffd\ufffdhHE\ufffdJ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002u\ufffd\ufffd\"\u0003\ufffd\ufffdY\ufffdB\ufffd\u3543L\ufffdXdIb\ufffdE\ufffd\ufffd\u001a\ufffd0\ufffd\u0717_ \ufffd[\ufffd\u0004\ufffd\ufffd\ufffdg\ufffd*\ufffd7\ufffd\ufffdDU\ufffd\ufffdr\ufffd \ufffd\ufffd\ufffdhHE\ufffdJ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002u\ufffd\ufffd\"\u0003\ufffd\ufffdY\ufffdB\ufffd\u3543L\ufffdXdIb\ufffdE\ufffd\ufffd\u001a\ufffd0\ufffd\u0717_ \ufffd[\ufffd\u0004\ufffd\ufffd\ufffdg\ufffd*\ufffd7\ufffd\ufffdDU\ufffd\ufffdr\ufffd \ufffd\ufffd\ufffdhHE\ufffdJ\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "53e53812cf505ce6972c328d0e9049375845e049",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Od ̆#U��
d�t���}�N������.�' ��=XgDG
�. |e��Mo�N���]A�?��{p� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��Od ̆#U�� d�t���}�N������.�' ��=XgDG �. |e��Mo�N���]A�?��{p� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.91449395229649,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "a3dc3fef3d2aed9c341b08c53c7405af",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdOd\u001c\u0306#U\ufffd\ufffd\r\u0002d\ufffdt\ufffd\ufffd\ufffd}\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd'\u0000 \ufffd\ufffd=XgDG\n\ufffd.\t|e\ufffd\ufffdMo\ufffdN\ufffd\ufffd\ufffd]A\ufffd?\ufffd\ufffd\u0007{p\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdOd\u001c\u0306#U\ufffd\ufffd\r\u0002d\ufffdt\ufffd\ufffd\ufffd}\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd'\u0000 \ufffd\ufffd=XgDG\n\ufffd.\t|e\ufffd\ufffdMo\ufffdN\ufffd\ufffd\ufffd]A\ufffd?\ufffd\ufffd\u0007{p\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdOd\u001c\u0306#U\ufffd\ufffd\r\u0002d\ufffdt\ufffd\ufffd\ufffd}\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd'\u0000 \ufffd\ufffd=XgDG\n\ufffd.\t|e\ufffd\ufffdMo\ufffdN\ufffd\ufffd\ufffd]A\ufffd?\ufffd\ufffd\u0007{p\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdOd\u001c\u0306#U\ufffd\ufffd\r\u0002d\ufffdt\ufffd\ufffd\ufffd}\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd'\u0000 \ufffd\ufffd=XgDG\n\ufffd.\t|e\ufffd\ufffdMo\ufffdN\ufffd\ufffd\ufffd]A\ufffd?\ufffd\ufffd\u0007{p\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdOd\u001c\u0306#U\ufffd\ufffd\r\u0002d\ufffdt\ufffd\ufffd\ufffd}\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd'\u0000 \ufffd\ufffd=XgDG\n\ufffd.\t|e\ufffd\ufffdMo\ufffdN\ufffd\ufffd\ufffd]A\ufffd?\ufffd\ufffd\u0007{p\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0d9380ea999c3cb8c88b156cdaf1df7924efd1d",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P�W��GS)�oɦ��|���X��C����p ���� LB����S��� 6Ս?�Ő���?� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�W��GS)�oɦ��|���X��C����p ���� LB����S��� 6Ս?�Ő���?� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.121986474777744,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "f41a2416d278759e650b70d65bbc3cf4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdW\ufffd\ufffdGS)\ufffdo\u0001\u0266\ufffd\ufffd|\ufffd\u0012\ufffd\ufffdX\u0018\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\u0004 \ufffd\ufffd\ufffd\ufffd\u001c\u001bLB\ufffd\ufffd\ufffd\ufffd\u0006S\ufffd\ufffd\ufffd\t6\u054d?\ufffd\u0150\ufffd\ufffd\u0002\ufffd?\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdW\ufffd\ufffdGS)\ufffdo\u0001\u0266\ufffd\ufffd|\ufffd\u0012\ufffd\ufffdX\u0018\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\u0004 \ufffd\ufffd\ufffd\ufffd\u001c\u001bLB\ufffd\ufffd\ufffd\ufffd\u0006S\ufffd\ufffd\ufffd\t6\u054d?\ufffd\u0150\ufffd\ufffd\u0002\ufffd?\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdW\ufffd\ufffdGS)\ufffdo\u0001\u0266\ufffd\ufffd|\ufffd\u0012\ufffd\ufffdX\u0018\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\u0004 \ufffd\ufffd\ufffd\ufffd\u001c\u001bLB\ufffd\ufffd\ufffd\ufffd\u0006S\ufffd\ufffd\ufffd\t6\u054d?\ufffd\u0150\ufffd\ufffd\u0002\ufffd?\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdW\ufffd\ufffdGS)\ufffdo\u0001\u0266\ufffd\ufffd|\ufffd\u0012\ufffd\ufffdX\u0018\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\u0004 \ufffd\ufffd\ufffd\ufffd\u001c\u001bLB\ufffd\ufffd\ufffd\ufffd\u0006S\ufffd\ufffd\ufffd\t6\u054d?\ufffd\u0150\ufffd\ufffd\u0002\ufffd?\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdW\ufffd\ufffdGS)\ufffdo\u0001\u0266\ufffd\ufffd|\ufffd\u0012\ufffd\ufffdX\u0018\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffdp\u0004 \ufffd\ufffd\ufffd\ufffd\u001c\u001bLB\ufffd\ufffd\ufffd\ufffd\u0006S\ufffd\ufffd\ufffd\t6\u054d?\ufffd\u0150\ufffd\ufffd\u0002\ufffd?\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "372ac245798138eec427f2af2246f31d6be9eb9c",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �o�C�Jk���3��W/^`� ��u9>�� �}�������~,�T�8QV\�� E�M � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �o�C�Jk���3��W/^`� ��u9>�� �}�ñ��������~,�T�8QV\�� E�M � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 6.009798743520645,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "30948726be03f2946d591e6f2d26709e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003o\ufffdC\u001b\ufffdJk\ufffd\ufffd\ufffd3\u0002\ufffd\ufffdW\/^`\ufffd\u0604\u001f\ufffd\ufffdu9>\ufffd\ufffd \ufffd\u0006}\ufffd\u00f1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05fe\u0003~,\ufffdT\ufffd8QV\\\ufffd\ufffd\tE\ufffdM\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003o\ufffdC\u001b\ufffdJk\ufffd\ufffd\ufffd3\u0002\ufffd\ufffdW\/^`\ufffd\u0604\u001f\ufffd\ufffdu9>\ufffd\ufffd \ufffd\u0006}\ufffd\u00f1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05fe\u0003~,\ufffdT\ufffd8QV\\\ufffd\ufffd\tE\ufffdM\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003o\ufffdC\u001b\ufffdJk\ufffd\ufffd\ufffd3\u0002\ufffd\ufffdW\/^`\ufffd\u0604\u001f\ufffd\ufffdu9>\ufffd\ufffd \ufffd\u0006}\ufffd\u00f1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05fe\u0003~,\ufffdT\ufffd8QV\\\ufffd\ufffd\tE\ufffdM\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003o\ufffdC\u001b\ufffdJk\ufffd\ufffd\ufffd3\u0002\ufffd\ufffdW\/^`\ufffd\u0604\u001f\ufffd\ufffdu9>\ufffd\ufffd \ufffd\u0006}\ufffd\u00f1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05fe\u0003~,\ufffdT\ufffd8QV\\\ufffd\ufffd\tE\ufffdM\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003o\ufffdC\u001b\ufffdJk\ufffd\ufffd\ufffd3\u0002\ufffd\ufffdW\/^`\ufffd\u0604\u001f\ufffd\ufffdu9>\ufffd\ufffd \ufffd\u0006}\ufffd\u00f1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05fe\u0003~,\ufffdT\ufffd8QV\\\ufffd\ufffd\tE\ufffdM\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c620dd312c4672ffc46613faf9e17ca4cf1bbba",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82 · TLS
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�Y�CY�5�\�*A��). tE-ωK��;o} ��9 ӛs�RL��x@
b�=�dH�xH
rm�8����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�Y�CY�5�\�*A��). tE-ωK��;o} ��9 ӛs�RL��x@ b�=�dH�xH rm�8����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9386513319032233,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "2752cec3fc2354cc460d997193e7aa5e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffdCY\ufffd5\ufffd\\\ufffd\u0004*A\ufffd\ufffd).\u0000tE-\u03c9K\ufffd\ufffd;o}\f\ufffd\ufffd9 \u04dbs\u0017\u0011\ufffdRL\ufffd\ufffdx@\nb\ufffd=\ufffddH\ufffdxH\rrm\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffdCY\ufffd5\ufffd\\\ufffd\u0004*A\ufffd\ufffd).\u0000tE-\u03c9K\ufffd\ufffd;o}\f\ufffd\ufffd9 \u04dbs\u0017\u0011\ufffdRL\ufffd\ufffdx@\nb\ufffd=\ufffddH\ufffdxH\rrm\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffdCY\ufffd5\ufffd\\\ufffd\u0004*A\ufffd\ufffd).\u0000tE-\u03c9K\ufffd\ufffd;o}\f\ufffd\ufffd9 \u04dbs\u0017\u0011\ufffdRL\ufffd\ufffdx@\nb\ufffd=\ufffddH\ufffdxH\rrm\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffdCY\ufffd5\ufffd\\\ufffd\u0004*A\ufffd\ufffd).\u0000tE-\u03c9K\ufffd\ufffd;o}\f\ufffd\ufffd9 \u04dbs\u0017\u0011\ufffdRL\ufffd\ufffdx@\nb\ufffd=\ufffddH\ufffdxH\rrm\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Y\ufffdCY\ufffd5\ufffd\\\ufffd\u0004*A\ufffd\ufffd).\u0000tE-\u03c9K\ufffd\ufffd;o}\f\ufffd\ufffd9 \u04dbs\u0017\u0011\ufffdRL\ufffd\ufffdx@\nb\ufffd=\ufffddH\ufffdxH\rrm\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "594b2a015d49494b2416e12ea54936cd82923ce8",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "82"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �c&�i�+���� 9�"�7]H���o��
�� EjQ�
�}�Y!I�&`�[�l�1��Kt�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �c&�i�+���� 9�"�7]H���o�� �� EjQ� �}�Y!I�&`�[�l�1��Kt�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.97127977127443,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "13d15c39b9c587d73052d13f88287def",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003c&\ufffdi\ufffd+\u0001\u0012\u0019\ufffd\ufffd\ufffd\ufffd\u001c9\ufffd\"\ufffd7]H\ufffd\ufffd\ufffdo\ufffd\ufffd\u0018\u0010\r\ufffd\ufffd \u000bEjQ\ufffd\u0002\n\ufffd}\ufffdY\u0012!I\ufffd&`\ufffd[\ufffdl\ufffd1\u0013\ufffd\ufffdKt\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003c&\ufffdi\ufffd+\u0001\u0012\u0019\ufffd\ufffd\ufffd\ufffd\u001c9\ufffd\"\ufffd7]H\ufffd\ufffd\ufffdo\ufffd\ufffd\u0018\u0010\r\ufffd\ufffd \u000bEjQ\ufffd\u0002\n\ufffd}\ufffdY\u0012!I\ufffd&`\ufffd[\ufffdl\ufffd1\u0013\ufffd\ufffdKt\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003c&\ufffdi\ufffd+\u0001\u0012\u0019\ufffd\ufffd\ufffd\ufffd\u001c9\ufffd\"\ufffd7]H\ufffd\ufffd\ufffdo\ufffd\ufffd\u0018\u0010\r\ufffd\ufffd \u000bEjQ\ufffd\u0002\n\ufffd}\ufffdY\u0012!I\ufffd&`\ufffd[\ufffdl\ufffd1\u0013\ufffd\ufffdKt\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003c&\ufffdi\ufffd+\u0001\u0012\u0019\ufffd\ufffd\ufffd\ufffd\u001c9\ufffd\"\ufffd7]H\ufffd\ufffd\ufffdo\ufffd\ufffd\u0018\u0010\r\ufffd\ufffd \u000bEjQ\ufffd\u0002\n\ufffd}\ufffdY\u0012!I\ufffd&`\ufffd[\ufffdl\ufffd1\u0013\ufffd\ufffdKt\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003c&\ufffdi\ufffd+\u0001\u0012\u0019\ufffd\ufffd\ufffd\ufffd\u001c9\ufffd\"\ufffd7]H\ufffd\ufffd\ufffdo\ufffd\ufffd\u0018\u0010\r\ufffd\ufffd \u000bEjQ\ufffd\u0002\n\ufffd}\ufffdY\u0012!I\ufffd&`\ufffd[\ufffdl\ufffd1\u0013\ufffd\ufffdKt\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6a0f880876dd22dca09d7eaeaff1e4d4ddb6f75",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �<%���_*� e�y�� ���9iWh�f`;c) ���!��thwO���T������������9 �
����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �<%���_*� e�y�� ���9iWh�f`;c) ���!��thwO���T������������9 � ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �ZZ 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "30c3a12744bf3032a039413120e0f51e",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.970655755331493,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "62e9efe5769b622df308b48c15428207c46fc9d9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "30c3a12744bf3032a039413120e0f51e",
"payload_hash": "7f350107cf11111ea40ccee8994eb3e3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\u0004<%\ufffd\ufffd\ufffd_*\u000f\ufffd\u001fe\ufffdy\ufffd\ufffd\u0000\ufffd\ufffd\ufffd9iWh\ufffd\u0010f`;c) \ufffd\ufffd\ufffd!\ufffd\ufffdthwO\ue614\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\u0004<%\ufffd\ufffd\ufffd_*\u000f\ufffd\u001fe\ufffdy\ufffd\ufffd\u0000\ufffd\ufffd\ufffd9iWh\ufffd\u0010f`;c) \ufffd\ufffd\ufffd!\ufffd\ufffdthwO\ue614\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdZZ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\u0004<%\ufffd\ufffd\ufffd_*\u000f\ufffd\u001fe\ufffdy\ufffd\ufffd\u0000\ufffd\ufffd\ufffd9iWh\ufffd\u0010f`;c) \ufffd\ufffd\ufffd!\ufffd\ufffdthwO\ue614\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\u0004<%\ufffd\ufffd\ufffd_*\u000f\ufffd\u001fe\ufffdy\ufffd\ufffd\u0000\ufffd\ufffd\ufffd9iWh\ufffd\u0010f`;c) \ufffd\ufffd\ufffd!\ufffd\ufffdthwO\ue614\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdZZ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u001b\u0004<%\ufffd\ufffd\ufffd_*\u000f\ufffd\u001fe\ufffdy\ufffd\ufffd\u0000\ufffd\ufffd\ufffd9iWh\ufffd\u0010f`;c) \ufffd\ufffd\ufffd!\ufffd\ufffdthwO\ue614\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9\u0000\ufffd\n\n\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bbf8b690833a65dcd3f1c712e9305772c6b8faec",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �"��1e"Q ��d'D9y��W��\���x�
� �z��I� ��؆ �j� -��1�]�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �"��1e"Q ��d'D9y��W��\���x� � �z��I� ��؆ �j� -��1�]�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "9a9407e57b72f87e2dfa24fbf6405f5f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.967862083248579,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "9b0d5c20c584cbe18c8652deae8ea0a0b76564b8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "9a9407e57b72f87e2dfa24fbf6405f5f",
"payload_hash": "90de92891e6f2d7f197e66eb2eaa614b",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd1e\"Q\u0003\u001c\ufffd\ufffd\u0006d'D9y\ufffd\ufffdW\ufffd\ufffd\\\ufffd\ufffd\ufffdx\ufffd\n\ufffd\f\u000f \ufffdz\u0019\u000e\ufffd\ufffd\u001aI\ufffd\t\b\ufffd\ufffd\u0011\u0606\u000b\ufffdj\ufffd\u0000-\ufffd\ufffd1\ufffd\u0012]\u0004\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd1e\"Q\u0003\u001c\ufffd\ufffd\u0006d'D9y\ufffd\ufffdW\ufffd\ufffd\\\ufffd\ufffd\ufffdx\ufffd\n\ufffd\f\u000f \ufffdz\u0019\u000e\ufffd\ufffd\u001aI\ufffd\t\b\ufffd\ufffd\u0011\u0606\u000b\ufffdj\ufffd\u0000-\ufffd\ufffd1\ufffd\u0012]\u0004\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd1e\"Q\u0003\u001c\ufffd\ufffd\u0006d'D9y\ufffd\ufffdW\ufffd\ufffd\\\ufffd\ufffd\ufffdx\ufffd\n\ufffd\f\u000f \ufffdz\u0019\u000e\ufffd\ufffd\u001aI\ufffd\t\b\ufffd\ufffd\u0011\u0606\u000b\ufffdj\ufffd\u0000-\ufffd\ufffd1\ufffd\u0012]\u0004\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd1e\"Q\u0003\u001c\ufffd\ufffd\u0006d'D9y\ufffd\ufffdW\ufffd\ufffd\\\ufffd\ufffd\ufffdx\ufffd\n\ufffd\f\u000f \ufffdz\u0019\u000e\ufffd\ufffd\u001aI\ufffd\t\b\ufffd\ufffd\u0011\u0606\u000b\ufffdj\ufffd\u0000-\ufffd\ufffd1\ufffd\u0012]\u0004\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd1e\"Q\u0003\u001c\ufffd\ufffd\u0006d'D9y\ufffd\ufffdW\ufffd\ufffd\\\ufffd\ufffd\ufffdx\ufffd\n\ufffd\f\u000f \ufffdz\u0019\u000e\ufffd\ufffd\u001aI\ufffd\t\b\ufffd\ufffd\u0011\u0606\u000b\ufffdj\ufffd\u0000-\ufffd\ufffd1\ufffd\u0012]\u0004\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c37ed22fdd6b5da427d5e32a6f52323da896deed",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �M/��`��I�7�,� z6p�0寫V�yB`t˄ ���1�� ��LHm�����UJ�*se�E4 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �M/��`��I�7�,� z6p�0寫V�yB`t˄ ���1�� ��LHm�����UJ�*se�E4 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.995399423008765,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "1be81ade9e74f4c1d89dbd3551836291",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\/\ufffd\ufffd`\ufffd\ufffdI\ufffd7\ufffd,\ufffd\u001dz6\u000fp\ufffd0\u5bebV\u0001\ufffdyB`t\u02c4 \ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\u0000\ufffd\ufffdLHm\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\u0007UJ\ufffd*se\ufffdE4\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\/\ufffd\ufffd`\ufffd\ufffdI\ufffd7\ufffd,\ufffd\u001dz6\u000fp\ufffd0\u5bebV\u0001\ufffdyB`t\u02c4 \ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\u0000\ufffd\ufffdLHm\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\u0007UJ\ufffd*se\ufffdE4\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\/\ufffd\ufffd`\ufffd\ufffdI\ufffd7\ufffd,\ufffd\u001dz6\u000fp\ufffd0\u5bebV\u0001\ufffdyB`t\u02c4 \ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\u0000\ufffd\ufffdLHm\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\u0007UJ\ufffd*se\ufffdE4\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\/\ufffd\ufffd`\ufffd\ufffdI\ufffd7\ufffd,\ufffd\u001dz6\u000fp\ufffd0\u5bebV\u0001\ufffdyB`t\u02c4 \ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\u0000\ufffd\ufffdLHm\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\u0007UJ\ufffd*se\ufffdE4\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002M\/\ufffd\ufffd`\ufffd\ufffdI\ufffd7\ufffd,\ufffd\u001dz6\u000fp\ufffd0\u5bebV\u0001\ufffdyB`t\u02c4 \ufffd\ufffd\ufffd1\u0003\ufffd\ufffd\u0000\ufffd\ufffdLHm\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\u0007UJ\ufffd*se\ufffdE4\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e498a4a843504805814be0163f76d00f09fdb676",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��I�N~~���j^��L�(���3ϕC�F ^ ��5�2�2�t#��9�Fꢇ ��-]�D � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��I�N~~���j^��L�(���3ϕC�F ^ ��5�2�2�t#��9�Fꢇ ��-]�D � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.967438160907306,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "b325350286afefcbf90f20d606cc6614",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffdN~\u0001~\u0004\ufffd\ufffd\ufffdj\u0011^\ufffd\ufffd\u0012L\ufffd(\u0001\ufffd\ufffd\ufffd3\u03d5C\u0013\ufffdF ^\u001e\ufffd\ufffd5\ufffd2\ufffd2\ufffdt#\ufffd\u001a\ufffd\u00139\ufffdF\ua887 \ufffd\ufffd-]\ufffdD\u0012\u001a\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffdN~\u0001~\u0004\ufffd\ufffd\ufffdj\u0011^\ufffd\ufffd\u0012L\ufffd(\u0001\ufffd\ufffd\ufffd3\u03d5C\u0013\ufffdF ^\u001e\ufffd\ufffd5\ufffd2\ufffd2\ufffdt#\ufffd\u001a\ufffd\u00139\ufffdF\ua887 \ufffd\ufffd-]\ufffdD\u0012\u001a\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffdN~\u0001~\u0004\ufffd\ufffd\ufffdj\u0011^\ufffd\ufffd\u0012L\ufffd(\u0001\ufffd\ufffd\ufffd3\u03d5C\u0013\ufffdF ^\u001e\ufffd\ufffd5\ufffd2\ufffd2\ufffdt#\ufffd\u001a\ufffd\u00139\ufffdF\ua887 \ufffd\ufffd-]\ufffdD\u0012\u001a\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffdN~\u0001~\u0004\ufffd\ufffd\ufffdj\u0011^\ufffd\ufffd\u0012L\ufffd(\u0001\ufffd\ufffd\ufffd3\u03d5C\u0013\ufffdF ^\u001e\ufffd\ufffd5\ufffd2\ufffd2\ufffdt#\ufffd\u001a\ufffd\u00139\ufffdF\ua887 \ufffd\ufffd-]\ufffdD\u0012\u001a\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdI\ufffdN~\u0001~\u0004\ufffd\ufffd\ufffdj\u0011^\ufffd\ufffd\u0012L\ufffd(\u0001\ufffd\ufffd\ufffd3\u03d5C\u0013\ufffdF ^\u001e\ufffd\ufffd5\ufffd2\ufffd2\ufffdt#\ufffd\u001a\ufffd\u00139\ufffdF\ua887 \ufffd\ufffd-]\ufffdD\u0012\u001a\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0891d562f71875831e6f0efbf352098841518165",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �x-%� �+��
^��V�J��.@) R\�c�k�8� ��Z�SY���aT��
� ��F.].�Ky�3�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �x-%� �+�� ^��V�J��.@) R\�c�k�8� ��Z�SY���aT�� � ��F.].�Ky�3�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.015655339255379,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "5b1b6fbe4a13962a59cbce8b75255aa8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003x-%\ufffd \ufffd+\ufffd\ufffd\n^\ufffd\ufffdV\ufffdJ\ufffd\ufffd.@) R\\\ufffdc\u0005\ufffdk\ufffd8\ufffd \ufffd\ufffdZ\ufffdSY\ufffd\ufffd\ufffdaT\ufffd\ufffd\n\ufffd\f\ufffd\ufffdF.].\ufffdKy\ufffd\u00023\u0006\ufffd\u001b\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003x-%\ufffd \ufffd+\ufffd\ufffd\n^\ufffd\ufffdV\ufffdJ\ufffd\ufffd.@) R\\\ufffdc\u0005\ufffdk\ufffd8\ufffd \ufffd\ufffdZ\ufffdSY\ufffd\ufffd\ufffdaT\ufffd\ufffd\n\ufffd\f\ufffd\ufffdF.].\ufffdKy\ufffd\u00023\u0006\ufffd\u001b\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003x-%\ufffd \ufffd+\ufffd\ufffd\n^\ufffd\ufffdV\ufffdJ\ufffd\ufffd.@) R\\\ufffdc\u0005\ufffdk\ufffd8\ufffd \ufffd\ufffdZ\ufffdSY\ufffd\ufffd\ufffdaT\ufffd\ufffd\n\ufffd\f\ufffd\ufffdF.].\ufffdKy\ufffd\u00023\u0006\ufffd\u001b\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003x-%\ufffd \ufffd+\ufffd\ufffd\n^\ufffd\ufffdV\ufffdJ\ufffd\ufffd.@) R\\\ufffdc\u0005\ufffdk\ufffd8\ufffd \ufffd\ufffdZ\ufffdSY\ufffd\ufffd\ufffdaT\ufffd\ufffd\n\ufffd\f\ufffd\ufffdF.].\ufffdKy\ufffd\u00023\u0006\ufffd\u001b\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003x-%\ufffd \ufffd+\ufffd\ufffd\n^\ufffd\ufffdV\ufffdJ\ufffd\ufffd.@) R\\\ufffdc\u0005\ufffdk\ufffd8\ufffd \ufffd\ufffdZ\ufffdSY\ufffd\ufffd\ufffdaT\ufffd\ufffd\n\ufffd\f\ufffd\ufffdF.].\ufffdKy\ufffd\u00023\u0006\ufffd\u001b\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3dd4418192eea08bac2c833ea0114c82317bfb8c",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �{�\P��X��y��<˽́�Yo$PC�/Z�|�36� �ͪ+l
��w���,2����N�36M�a��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �{�\P��X��y��<˽́�Yo$PC�/Z�|�36� �ͪ+l ��w���,2����N�36M�a��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.947612819063883,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "cefbe37b9269d7fe3cece88af6fd038c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003{\ufffd\\P\ufffd\ufffdX\ufffd\ufffdy\ufffd\ufffd<\u02fd\u0341\ufffdYo$PC\ufffd\/Z\ufffd|\ufffd36\ufffd \ufffd\u0004\u036a+l\n\ufffd\u0004\ufffdw\ufffd\ufffd\ufffd,2\ufffd\ufffd\u0012\ufffd\ufffdN\ufffd36M\ufffda\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003{\ufffd\\P\ufffd\ufffdX\ufffd\ufffdy\ufffd\ufffd<\u02fd\u0341\ufffdYo$PC\ufffd\/Z\ufffd|\ufffd36\ufffd \ufffd\u0004\u036a+l\n\ufffd\u0004\ufffdw\ufffd\ufffd\ufffd,2\ufffd\ufffd\u0012\ufffd\ufffdN\ufffd36M\ufffda\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003{\ufffd\\P\ufffd\ufffdX\ufffd\ufffdy\ufffd\ufffd<\u02fd\u0341\ufffdYo$PC\ufffd\/Z\ufffd|\ufffd36\ufffd \ufffd\u0004\u036a+l\n\ufffd\u0004\ufffdw\ufffd\ufffd\ufffd,2\ufffd\ufffd\u0012\ufffd\ufffdN\ufffd36M\ufffda\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003{\ufffd\\P\ufffd\ufffdX\ufffd\ufffdy\ufffd\ufffd<\u02fd\u0341\ufffdYo$PC\ufffd\/Z\ufffd|\ufffd36\ufffd \ufffd\u0004\u036a+l\n\ufffd\u0004\ufffdw\ufffd\ufffd\ufffd,2\ufffd\ufffd\u0012\ufffd\ufffdN\ufffd36M\ufffda\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003{\ufffd\\P\ufffd\ufffdX\ufffd\ufffdy\ufffd\ufffd<\u02fd\u0341\ufffdYo$PC\ufffd\/Z\ufffd|\ufffd36\ufffd \ufffd\u0004\u036a+l\n\ufffd\u0004\ufffdw\ufffd\ufffd\ufffd,2\ufffd\ufffd\u0012\ufffd\ufffdN\ufffd36M\ufffda\ufffd\u0003\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ceadbd32e599a0508c5bdd222711baa1f313c999",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����_�Ũ���Q�Y�I�#�5;�6T��"F �~K�r3'��o���?!u16TiC,#�3�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ����_�Ũ���Q�Y�I�#�5;�6T��"F �~K�r3'��o���?!u16TiC,#�3�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.926793978579014,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "b9a5eddc030b94293aae916147ed44f1",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0168\ufffd\ufffd\ufffd\u0018Q\u001b\ufffdY\ufffd\u0007I\ufffd\u001b#\ufffd5;\ufffd6T\ufffd\ufffd\"F\u0017 \ufffd~K\ufffdr3'\ufffd\ufffdo\ufffd\ufffd\ufffd?!u16T\u0006i\u001b\u0017C,#\u001b\ufffd3\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0168\ufffd\ufffd\ufffd\u0018Q\u001b\ufffdY\ufffd\u0007I\ufffd\u001b#\ufffd5;\ufffd6T\ufffd\ufffd\"F\u0017 \ufffd~K\ufffdr3'\ufffd\ufffdo\ufffd\ufffd\ufffd?!u16T\u0006i\u001b\u0017C,#\u001b\ufffd3\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0168\ufffd\ufffd\ufffd\u0018Q\u001b\ufffdY\ufffd\u0007I\ufffd\u001b#\ufffd5;\ufffd6T\ufffd\ufffd\"F\u0017 \ufffd~K\ufffdr3'\ufffd\ufffdo\ufffd\ufffd\ufffd?!u16T\u0006i\u001b\u0017C,#\u001b\ufffd3\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0168\ufffd\ufffd\ufffd\u0018Q\u001b\ufffdY\ufffd\u0007I\ufffd\u001b#\ufffd5;\ufffd6T\ufffd\ufffd\"F\u0017 \ufffd~K\ufffdr3'\ufffd\ufffdo\ufffd\ufffd\ufffd?!u16T\u0006i\u001b\u0017C,#\u001b\ufffd3\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0168\ufffd\ufffd\ufffd\u0018Q\u001b\ufffdY\ufffd\u0007I\ufffd\u001b#\ufffd5;\ufffd6T\ufffd\ufffd\"F\u0017 \ufffd~K\ufffdr3'\ufffd\ufffdo\ufffd\ufffd\ufffd?!u16T\u0006i\u001b\u0017C,#\u001b\ufffd3\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a7c483105a8e36f70e32573241937aa67d6e6acf",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T PGT�O6+�B~z�V`�J���>#��(��ax� ���R$��
r�EN�HZ�כ�6�s#\7S?!� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T PGT�O6+�B~z�V`�J���>#��(��ax� ���R$�� r�EN�HZ�כ�6�s#\7S?!� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.084834117152126,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "4e36316936647cde473190ea1ee25420",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003GT\ufffd\u0010O\u00126+\ufffdB~\u0014\u0013z\ufffdV`\ufffdJ\ufffd\ufffd\ufffd>#\ufffd\ufffd(\ufffd\ufffdax\ufffd \ufffd\ufffd\ufffdR$\ufffd\ufffd\u0002\r\u0001r\ufffdEN\ufffd\u0018HZ\ufffd\u05db\ufffd6\ufffds#\\7S?!\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003GT\ufffd\u0010O\u00126+\ufffdB~\u0014\u0013z\ufffdV`\ufffdJ\ufffd\ufffd\ufffd>#\ufffd\ufffd(\ufffd\ufffdax\ufffd \ufffd\ufffd\ufffdR$\ufffd\ufffd\u0002\r\u0001r\ufffdEN\ufffd\u0018HZ\ufffd\u05db\ufffd6\ufffds#\\7S?!\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003GT\ufffd\u0010O\u00126+\ufffdB~\u0014\u0013z\ufffdV`\ufffdJ\ufffd\ufffd\ufffd>#\ufffd\ufffd(\ufffd\ufffdax\ufffd \ufffd\ufffd\ufffdR$\ufffd\ufffd\u0002\r\u0001r\ufffdEN\ufffd\u0018HZ\ufffd\u05db\ufffd6\ufffds#\\7S?!\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003GT\ufffd\u0010O\u00126+\ufffdB~\u0014\u0013z\ufffdV`\ufffdJ\ufffd\ufffd\ufffd>#\ufffd\ufffd(\ufffd\ufffdax\ufffd \ufffd\ufffd\ufffdR$\ufffd\ufffd\u0002\r\u0001r\ufffdEN\ufffd\u0018HZ\ufffd\u05db\ufffd6\ufffds#\\7S?!\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003GT\ufffd\u0010O\u00126+\ufffdB~\u0014\u0013z\ufffdV`\ufffdJ\ufffd\ufffd\ufffd>#\ufffd\ufffd(\ufffd\ufffdax\ufffd \ufffd\ufffd\ufffdR$\ufffd\ufffd\u0002\r\u0001r\ufffdEN\ufffd\u0018HZ\ufffd\u05db\ufffd6\ufffds#\\7S?!\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33bf3e69472ccc6b6299a3b941d686b8f88b5edd",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F BM-q
���j�زt��F�� X%Sg�jlP���K� %�a�� f_ N�oס0����P6�:�tn9L� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F BM-q ���j�زt��F�� X%Sg�jlP���K� %�a�� f_ N�oס0����P6�:�tn9L� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.993944071346987,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0771"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "99f7f874bd8a9ad9d2a6d56501c6da71",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003M-q\n\ufffd\ufffd\ufffdj\ufffd\u0632t\ufffd\ufffdF\ufffd\ufffd\u001dX%Sg\ufffdjlP\ufffd\ufffd\u0011\ufffdK\ufffd %\ufffda\ufffd\ufffd f_\u0000N\ufffdo\u05e10\ufffd\ufffd\ufffd\ufffdP6\ufffd\u0002:\ufffdtn9L\u0004\u001a\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003M-q\n\ufffd\ufffd\ufffdj\ufffd\u0632t\ufffd\ufffdF\ufffd\ufffd\u001dX%Sg\ufffdjlP\ufffd\ufffd\u0011\ufffdK\ufffd %\ufffda\ufffd\ufffd f_\u0000N\ufffdo\u05e10\ufffd\ufffd\ufffd\ufffdP6\ufffd\u0002:\ufffdtn9L\u0004\u001a\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003M-q\n\ufffd\ufffd\ufffdj\ufffd\u0632t\ufffd\ufffdF\ufffd\ufffd\u001dX%Sg\ufffdjlP\ufffd\ufffd\u0011\ufffdK\ufffd %\ufffda\ufffd\ufffd f_\u0000N\ufffdo\u05e10\ufffd\ufffd\ufffd\ufffdP6\ufffd\u0002:\ufffdtn9L\u0004\u001a\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003M-q\n\ufffd\ufffd\ufffdj\ufffd\u0632t\ufffd\ufffdF\ufffd\ufffd\u001dX%Sg\ufffdjlP\ufffd\ufffd\u0011\ufffdK\ufffd %\ufffda\ufffd\ufffd f_\u0000N\ufffdo\u05e10\ufffd\ufffd\ufffd\ufffdP6\ufffd\u0002:\ufffdtn9L\u0004\u001a\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003M-q\n\ufffd\ufffd\ufffdj\ufffd\u0632t\ufffd\ufffdF\ufffd\ufffd\u001dX%Sg\ufffdjlP\ufffd\ufffd\u0011\ufffdK\ufffd %\ufffda\ufffd\ufffd f_\u0000N\ufffdo\u05e10\ufffd\ufffd\ufffd\ufffdP6\ufffd\u0002:\ufffdtn9L\u0004\u001a\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a9ae497df0c83d858fbd4897dbcb2e2b80de705",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�3�J���h��-|�&S��q�|��#y6DIK ���{
��'p$���f����V��v��A� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�3�J���h��-|�&S��q�|��#y6DIK ���{ ��'p$���f����V��v��A� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9331851899235755,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "bd304403684feb15edfbe65033dc6708",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffdJ\ufffd\ufffd\ufffdh\ufffd\ufffd-|\ufffd&S\ufffd\ufffdq\ufffd\u0002|\ufffd\ufffd\u0006\u0379#\u0019y6DIK \ufffd\ufffd\ufffd{\n\ufffd\ufffd'p$\ufffd\u0012\uf534\ufffd\ufffdf\ufffd\ufffd\ufffd\u0003\ufffdV\u0016\ufffd\ufffdv\ufffd\ufffdA\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffdJ\ufffd\ufffd\ufffdh\ufffd\ufffd-|\ufffd&S\ufffd\ufffdq\ufffd\u0002|\ufffd\ufffd\u0006\u0379#\u0019y6DIK \ufffd\ufffd\ufffd{\n\ufffd\ufffd'p$\ufffd\u0012\uf534\ufffd\ufffdf\ufffd\ufffd\ufffd\u0003\ufffdV\u0016\ufffd\ufffdv\ufffd\ufffdA\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffdJ\ufffd\ufffd\ufffdh\ufffd\ufffd-|\ufffd&S\ufffd\ufffdq\ufffd\u0002|\ufffd\ufffd\u0006\u0379#\u0019y6DIK \ufffd\ufffd\ufffd{\n\ufffd\ufffd'p$\ufffd\u0012\uf534\ufffd\ufffdf\ufffd\ufffd\ufffd\u0003\ufffdV\u0016\ufffd\ufffdv\ufffd\ufffdA\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffdJ\ufffd\ufffd\ufffdh\ufffd\ufffd-|\ufffd&S\ufffd\ufffdq\ufffd\u0002|\ufffd\ufffd\u0006\u0379#\u0019y6DIK \ufffd\ufffd\ufffd{\n\ufffd\ufffd'p$\ufffd\u0012\uf534\ufffd\ufffdf\ufffd\ufffd\ufffd\u0003\ufffdV\u0016\ufffd\ufffdv\ufffd\ufffdA\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00033\ufffdJ\ufffd\ufffd\ufffdh\ufffd\ufffd-|\ufffd&S\ufffd\ufffdq\ufffd\u0002|\ufffd\ufffd\u0006\u0379#\u0019y6DIK \ufffd\ufffd\ufffd{\n\ufffd\ufffd'p$\ufffd\u0012\uf534\ufffd\ufffdf\ufffd\ufffd\ufffd\u0003\ufffdV\u0016\ufffd\ufffdv\ufffd\ufffdA\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9701a0f2339114fbe892922c391f7d493cc7bf5",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����M� �� u?o��nN-� GNE�� R�A�cj|�W�6*W�*����ĥ�JUʹ � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����M� �� u?o��nN-� GNE�� R�A�cj|�W�6*W�*����ĥ�JUʹ � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.977511091898649,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "75d118e3a66e31ffae5e6f6e26b1e31e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u038b\ufffd\ufffdM\ufffd\t\ufffd\ufffd\u000b\u0014u?o\ufffd\ufffdnN\u0018-\ufffd\u001fGN\u0013E\ufffd\ufffd\u0013\u001f \fR\u0006\ufffdA\ufffdc\u0013j|\ufffdW\u0017\ufffd6*W\ufffd*\ufffd\ufffd\ufffd\ufffd\u0012\b\u0125\ufffdJU\u0374\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u038b\ufffd\ufffdM\ufffd\t\ufffd\ufffd\u000b\u0014u?o\ufffd\ufffdnN\u0018-\ufffd\u001fGN\u0013E\ufffd\ufffd\u0013\u001f \fR\u0006\ufffdA\ufffdc\u0013j|\ufffdW\u0017\ufffd6*W\ufffd*\ufffd\ufffd\ufffd\ufffd\u0012\b\u0125\ufffdJU\u0374\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u038b\ufffd\ufffdM\ufffd\t\ufffd\ufffd\u000b\u0014u?o\ufffd\ufffdnN\u0018-\ufffd\u001fGN\u0013E\ufffd\ufffd\u0013\u001f \fR\u0006\ufffdA\ufffdc\u0013j|\ufffdW\u0017\ufffd6*W\ufffd*\ufffd\ufffd\ufffd\ufffd\u0012\b\u0125\ufffdJU\u0374\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u038b\ufffd\ufffdM\ufffd\t\ufffd\ufffd\u000b\u0014u?o\ufffd\ufffdnN\u0018-\ufffd\u001fGN\u0013E\ufffd\ufffd\u0013\u001f \fR\u0006\ufffdA\ufffdc\u0013j|\ufffdW\u0017\ufffd6*W\ufffd*\ufffd\ufffd\ufffd\ufffd\u0012\b\u0125\ufffdJU\u0374\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u038b\ufffd\ufffdM\ufffd\t\ufffd\ufffd\u000b\u0014u?o\ufffd\ufffdnN\u0018-\ufffd\u001fGN\u0013E\ufffd\ufffd\u0013\u001f \fR\u0006\ufffdA\ufffdc\u0013j|\ufffdW\u0017\ufffd6*W\ufffd*\ufffd\ufffd\ufffd\ufffd\u0012\b\u0125\ufffdJU\u0374\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eda33bc7c35c3f34669817ef1a011035c78f171c",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|