06/08/2026 00:25:39 UTC
TCP
22222 · TLS
Scan de ports
port scan syn · via TLS:22222 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22222
Chemin / cible
—
Service
TLS
Payload
� � b ���P��X%�ZG�oԦ{�okj��7ߛ%Q �s�]g�#�i��7�ɥ�f~I���d�� �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � b ���P��X%�ZG�oԦ{�okj��7ߛ%Q �s�]g�#�i��7�ɥ�f~I���d�� �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� � b ���P��X%�ZG�oԦ{�okj��7ߛ%Q �s�]g�#�i��7�ɥ�f~I���d�� �+�/�,�0̨̩� �� � _ � ��� 2 + 3����(� ʤdՁ�xQ��iz6�5��
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.733700438713335,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 22222,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6c6f5de52c74ebac313ce792cae78bc3fd2343e6",
"event_fingerprint": "605148a7ff7fdf22a2c0d9270db534e648d24b93",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "95a33de90eb170028b6d65304faeea19",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 22222,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000bb\u001e\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffd\u001a\u0012okj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\u0002\ufffd#\ufffd\u0005i\u0006\u0010\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000bb\u001e\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffd\u001a\u0012okj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\u0002\ufffd#\ufffd\u0005i\u0006\u0010\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd(\ufffd\u0000\u0011\u02a4d\u0541\u0017\ufffdxQ\u001a\ufffd\ufffd\u0018iz\u00106\ufffd5\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000bb\u001e\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffd\u001a\u0012okj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\u0002\ufffd#\ufffd\u0005i\u0006\u0010\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c720a29608b746f4acaa05ad70821d732bc7f4f5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000bb\u001e\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffd\u001a\u0012okj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\u0002\ufffd#\ufffd\u0005i\u0006\u0010\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 22222,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdb\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffdokj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\ufffd#\ufffdi\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:22222 \u00b7 (reconnaissance)",
"target_port_label": "22222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 22222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u000bb\u001e\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffd\u001a\u0012okj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\u0002\ufffd#\ufffd\u0005i\u0006\u0010\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 22222,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:22222 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdb\ufffd\ufffd\ufffdP\ufffd\ufffdX%\ufffdZG\ufffdo\u0526{\ufffdokj\ufffd\ufffd7\u07db%Q \ufffds\ufffd]g\ufffd#\ufffdi\ufffd\ufffd7\ufffd\u0265\ufffdf~I\ufffd\ufffd\ufffdd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "22222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "22222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 31.32,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
06/08/2026 00:25:39 UTC
TCP
20150 · TLS
Scan de ports
port scan syn · via TLS:20150 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
20150
Chemin / cible
—
Service
TLS
Payload
� ��5[߃��ȯ|�j�` �_$Ӽ�h�/N���t �O�` >�p��E�#hN�d��$Yi&Xc�� �V �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��5[߃��ȯ|�j�` �_$Ӽ�h�/N���t �O�` >�p��E�#hN�d��$Yi&Xc�� �V �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� ��5[߃��ȯ|�j�` �_$Ӽ�h�/N���t �O�` >�p��E�#hN�d��$Yi&Xc�� �V �+�/�,�0̨̩� �� � _ � ��� 2 + 3����C���[�$�������6� Y� 8.
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.765354362289027,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 20150,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cd55c2009a24be148b81bc3d416ec6d9505de170",
"event_fingerprint": "cef056fe02fa49ead33d3a1fa57311be475db32a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "8f70d7f1ff7a7dbe6156eea1eccbd3a9",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 20150,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\u0015[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd\u0018`\u001f\ufffd_$\u04fc\u001a\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`\u000b>\ufffd\u0003p\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\u0000\ufffdV\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\u0015[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd\u0018`\u001f\ufffd_$\u04fc\u001a\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`\u000b>\ufffd\u0003p\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\u0000\ufffdV\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdC\ufffd\u0015\ufffd\ufffd[\ufffd$\ufffd\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\u000bY\ufffd\t8.",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\u0015[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd\u0018`\u001f\ufffd_$\u04fc\u001a\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`\u000b>\ufffd\u0003p\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\u0000\ufffdV\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dbe0df1719da34f0431b57226f7af89219739a51",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\u0015[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd\u0018`\u001f\ufffd_$\u04fc\u001a\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`\u000b>\ufffd\u0003p\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\u0000\ufffdV\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 20150,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd5[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd`\ufffd_$\u04fc\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`>\ufffdp\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\ufffdV\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:20150 \u00b7 (reconnaissance)",
"target_port_label": "20150 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 20150,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd5\u0015[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd\u0018`\u001f\ufffd_$\u04fc\u001a\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`\u000b>\ufffd\u0003p\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\u0000\ufffdV\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 20150,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:20150 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd5[\u07c3\ufffd\ufffd\u022f|\ufffdj\ufffd`\ufffd_$\u04fc\ufffdh\ufffd\/N\ufffd\ufffd\ufffdt \ufffdO\ufffd`>\ufffdp\ufffd\ufffdE\ufffd#hN\ufffdd\ufffd\ufffd$Yi&Xc\ufffd\ufffd\ufffdV\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "20150 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "20150"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 30.78,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
06/08/2026 00:25:39 UTC
TCP
8467 · TLS
Scan de ports
port scan syn · via TLS:8467 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8467
Chemin / cible
—
Service
TLS
Payload
� �}q 7��_��$`��A2���L�O��f~�0V=i {y=��?���Vx������� �x�H���v�X �+�/�,�0̨̩� �� � _ �
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �}q
7��_��$`��A2���L�O��f~�0V=i {y=��?���Vx������� �x�H���v�X �+�/�,�0̨̩� ��
� _ �
Requête brute (extrait)
� �}q 7��_��$`��A2���L�O��f~�0V=i {y=��?���Vx������� �x�H���v�X �+�/�,�0̨̩� �� � _ � ��� 2 + 3����WSy�R%/vff�v���4k/ZJbD�C<
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1483,
"payload_entropy": 7.720774565666109,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "819786be0f84c07004a23a5d5b79c38a3aab016d",
"event_fingerprint": "c046e9456f1ec9214d940d24c3f45b581d789df9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "e607072fc0ae22573f21b6504f2cf7f6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8467,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003}q\n7\ufffd\ufffd\u0006_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\u000e\ufffdf~\ufffd0V=i {y=\ufffd\ufffd\u0004?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffdx\ufffd\u0010H\ufffd\ufffd\ufffdv\ufffd\u0002X\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003}q\n7\ufffd\ufffd\u0006_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\u000e\ufffdf~\ufffd0V=i {y=\ufffd\ufffd\u0004?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffdx\ufffd\u0010H\ufffd\ufffd\ufffdv\ufffd\u0002X\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdWSy\ufffdR%\/vff\ufffdv\ufffd\ufffd\ufffd4k\/ZJbD\ufffdC<",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003}q\n7\ufffd\ufffd\u0006_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\u000e\ufffdf~\ufffd0V=i {y=\ufffd\ufffd\u0004?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffdx\ufffd\u0010H\ufffd\ufffd\ufffdv\ufffd\u0002X\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8a776778c25abcc87d1646d69fa36a53afd1ffd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003}q\n7\ufffd\ufffd\u0006_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\u000e\ufffdf~\ufffd0V=i {y=\ufffd\ufffd\u0004?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffdx\ufffd\u0010H\ufffd\ufffd\ufffdv\ufffd\u0002X\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8467,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd}q\n7\ufffd\ufffd_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\ufffdf~\ufffd0V=i {y=\ufffd\ufffd?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffdH\ufffd\ufffd\ufffdv\ufffdX\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"attack_vector": "port scan syn \u00b7 via TLS:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003}q\n7\ufffd\ufffd\u0006_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\u000e\ufffdf~\ufffd0V=i {y=\ufffd\ufffd\u0004?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffdx\ufffd\u0010H\ufffd\ufffd\ufffdv\ufffd\u0002X\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8467,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd}q\n7\ufffd\ufffd_\ufffd\ufffd$`\ufffd\ufffdA2\ufffd\ufffd\ufffdL\ufffdO\ufffd\ufffdf~\ufffd0V=i {y=\ufffd\ufffd?\ufffd\ufffd\ufffdVx\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdx\ufffdH\ufffd\ufffd\ufffdv\ufffdX\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd",
"target_port_label": "8467 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 30.22,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
8143 · TLS
Scan de ports
port scan syn · via TLS:8143 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8143
Chemin / cible
—
Service
TLS
Payload
� �N���Ųs� #��نC����NE-y�2W ��͓ĕ�96E��*�>�V��?$�I5�oj���� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �N���Ųs� #��نC����NE-y�2W ��͓ĕ�96E��*�>�V��?$�I5�oj���� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �N���Ųs� #��نC����NE-y�2W ��͓ĕ�96E��*�>�V��?$�I5�oj���� �+�/�,�0̨̩� �� �� { � + 3 & $ �2G�L���i6 EC� ��/S���_�j9vV
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.811187360501796,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 8143,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "54dae29a467fef77cf03ae0dd8bdf1c0d23d8b10",
"event_fingerprint": "a5dda295315f74d5d3f8602817e66732938ed3d8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "7bb4d603f6faefc75d386dd8aed6c1a0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8143,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002N\ufffd\ufffd\ufffd\u0001\u0172s\ufffd\u001e#\ufffd\ufffd\u0646C\u001b\ufffd\ufffd\u0004\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd\u001896E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002N\ufffd\ufffd\ufffd\u0001\u0172s\ufffd\u001e#\ufffd\ufffd\u0646C\u001b\ufffd\ufffd\u0004\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd\u001896E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd2G\ufffd\u001aL\ufffd\ufffd\ufffdi6 EC\ufffd\n\ufffd\ufffd\/\u0011S\ufffd\ufffd\ufffd_\u05ca\ufffdj9vV",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002N\ufffd\ufffd\ufffd\u0001\u0172s\ufffd\u001e#\ufffd\ufffd\u0646C\u001b\ufffd\ufffd\u0004\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd\u001896E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "728b6c943d08ee221beb8fb75f21c509d2adba23",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002N\ufffd\ufffd\ufffd\u0001\u0172s\ufffd\u001e#\ufffd\ufffd\u0646C\u001b\ufffd\ufffd\u0004\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd\u001896E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8143,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd\u0172s\ufffd#\ufffd\ufffd\u0646C\ufffd\ufffd\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd96E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:8143 \u00b7 (reconnaissance)",
"target_port_label": "8143 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002N\ufffd\ufffd\ufffd\u0001\u0172s\ufffd\u001e#\ufffd\ufffd\u0646C\u001b\ufffd\ufffd\u0004\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd\u001896E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8143,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8143 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdN\ufffd\ufffd\ufffd\u0172s\ufffd#\ufffd\ufffd\u0646C\ufffd\ufffd\ufffd\ufffdNE-y\ufffd2W \ufffd\ufffd\u0353\u0115\ufffd96E\ufffd\ufffd*\ufffd>\ufffdV\ufffd\ufffd?$\ufffdI5\ufffdoj\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "8143 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 110,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
8467 · TLS
Scan de ports
port scan syn · via TLS:8467 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8467
Chemin / cible
—
Service
TLS
Payload
� ��������8�gA�@��e�=��bʪ�� z�a�����ެ@�g Z`D�qo � ��M�Z �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��������8�gA�@��e�=��bʪ�� z�a�����ެ@�g Z`D�qo � ��M�Z �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� ��������8�gA�@��e�=��bʪ�� z�a�����ެ@�g Z`D�qo � ��M�Z �+�/�,�0̨̩� �� �� { � + 3 & $ ~A)�y���x��G�wh+��̍�sk���@�v
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.833921570631099,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "913a4db70f720178a7d3c7250a4fb4efe2b779dd",
"event_fingerprint": "8a34551123eac55813f537fab7602a5caa36fce5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "a39d8400a310ffacfba8a3829961f54e",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8467,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd8\ufffdg\u0016A\u0016\ufffd\u0007@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd\u0016 z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdg\u0000Z`D\u001b\ufffd\u0001qo\u001f\ufffd\u009e\u001f\ufffd\ufffdM\ufffdZ\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd8\ufffdg\u0016A\u0016\ufffd\u0007@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd\u0016 z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdg\u0000Z`D\u001b\ufffd\u0001qo\u001f\ufffd\u009e\u001f\ufffd\ufffdM\ufffdZ\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ~A)\ufffdy\ufffd\ufffd\ufffdx\ufffd\ufffdG\ufffd\u0016wh+\ufffd\u0014\ufffd\u030d\ufffd\u0010sk\ufffd\ufffd\ufffd@\ufffdv",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd8\ufffdg\u0016A\u0016\ufffd\u0007@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd\u0016 z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdg\u0000Z`D\u001b\ufffd\u0001qo\u001f\ufffd\u009e\u001f\ufffd\ufffdM\ufffdZ\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66c70a6fd11dacac102ad6362a37e044b515df20",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd8\ufffdg\u0016A\u0016\ufffd\u0007@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd\u0016 z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdg\u0000Z`D\u001b\ufffd\u0001qo\u001f\ufffd\u009e\u001f\ufffd\ufffdM\ufffdZ\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8467,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffdgA\ufffd@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdgZ`D\ufffdqo\ufffd\u009e\ufffd\ufffdM\ufffdZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017\ufffd\ufffd\b\ufffd\ufffd\ufffd\ufffd8\ufffdg\u0016A\u0016\ufffd\u0007@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd\u0016 z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdg\u0000Z`D\u001b\ufffd\u0001qo\u001f\ufffd\u009e\u001f\ufffd\ufffdM\ufffdZ\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8467,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffdgA\ufffd@\ufffd\ufffde\ufffd=\ufffd\ufffdb\u02aa\ufffd\ufffd z\ufffda\ufffd\ufffd\ufffd\ufffd\ufffd\u07ac@\ufffdgZ`D\ufffdqo\ufffd\u009e\ufffd\ufffdM\ufffdZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "8467 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 120,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
12559 · HTTP
Scan de ports
port scan syn · via HTTP:12559 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
12559
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:12559
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:12559 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "1c94fa7850d9043fa77f2875c9e0697bafc06a3b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.470711148664903,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 12559,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "59af5a033242eb880b4165c40dc38c9c3d92ad8b",
"event_fingerprint": "1b6ecf417c2b202418ae0fdccd6f02234fdb6be5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "f4f5801224732c133a314d92875612ee",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12559,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb62601aa5020b77644554afc261652a394f2709",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 12559,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "port scan syn \u00b7 via HTTP:12559 \u00b7 (reconnaissance)",
"target_port_label": "12559 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12559,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 12559,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:12559 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:12559\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "12559 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12559"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 39.87,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
1181 · HTTP
Scan de ports
port scan syn · via HTTP:1181 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
1181
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1181
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1181 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "6ca13b4122eb170756a5ed53a757a137dc3cbe5f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.4637946375207305,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 1181,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d683536f7875c48f3620ecb303ef7b3a82a1fa3d",
"event_fingerprint": "cf97419636a00f8cb1610b3a29edc161770f9d36",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "be992bfa506b916a48845bf7121e58b7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1181,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e602425f5f8b20572f107f2b4e626b1ddeb4313b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 1181,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:1181 \u00b7 (reconnaissance)",
"target_port_label": "1181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1181,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 1181,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1181 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "1181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 37.39,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
19222 · HTTP
Scan de ports
port scan syn · via HTTP:19222 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
19222
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:19222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:19222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "88be4b5acf0ad4175438541703a4bea003b4a4cb",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.473440407131793,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 19222,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a81b6a8462c9915d1af73f707d30f13313d03e56",
"event_fingerprint": "4955d51f4a013d23b9b5a874f69141591445a943",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "efd0ddd0c9d57174865c420d6b3bca7d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 19222,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7495c776be8e76a9ac1f410c152a155bfc19cd7d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 19222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "port scan syn \u00b7 via HTTP:19222 \u00b7 (reconnaissance)",
"target_port_label": "19222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 19222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 19222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:19222 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:19222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "19222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "19222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 35.81,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
16993 · HTTP
Scan de ports
port scan syn · via HTTP:16993 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
16993
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:16993
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:16993 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "72527336106ae1a15384684942ea87a431e21082",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.46763250253507,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "88f35d2d3887797f7e5b7417d78d661aa47ae2af",
"event_fingerprint": "e8eafef0ec0a9ddcc4360808b423f1cd2d490d31",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "f368ea8b1a40a1e9a8649fb8a56d5f9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 16993,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3d5a9fae47d08c5f10f4a7b08b430dd4b7b8dd2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 34.37,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
8142 · HTTP
Scan de ports
port scan syn · via HTTP:8142 · (reconnaissance)
Élevée
Moyen · 56
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8142
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8142
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "7ba1527130ab470e4de6d7f8e26df7bd078f94b2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.472337917771637,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8142,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "34aff994435cb5321c4e4f3c2ba01246d9219463",
"event_fingerprint": "85c5f0e86b97c1a7d2a945e58ba4b7d08e5beca1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "273b7b36249eafa68742da46aa7eb09c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8142,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b9d462ed92eeb4b09f723421e22d5a80fa39ddf0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8142,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8142"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 32.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
20150 · HTTP
Scan de ports
port scan syn · via HTTP:20150 · (reconnaissance)
Élevée
Moyen · 52
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
20150
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:20150
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:20150 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "a3221944d56e8f8a3322c881561e9063e2401ea9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.455609947572656,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 20150,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0539177527453a44e21db0c1550eb34bffd0de92",
"event_fingerprint": "604115d995c11e35b9dad880de112f0d9f627b0a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "4ce8a9827e42c127593fc345607ed457",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 20150,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "361baaaf508633759a3a0f8f57a7ba7fcffe1fac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 20150,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "port scan syn \u00b7 via HTTP:20150 \u00b7 (reconnaissance)",
"target_port_label": "20150 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20150,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 20150,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:20150 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "20150 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20150"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 31.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
189 · HTTP
Scan de ports
port scan syn · via HTTP:189 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
189
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:189 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "ad87aaa3220137ffdbcbc5d689c3883ddd06a36e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 238,
"payload_entropy": 5.472891692887868,
"port_category": "well_known",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 189,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bdff728a3e16343e7f6d6fda7143e719e366db4e",
"event_fingerprint": "7c5df7c6c3e7d670f5e50a1f4335e4b389a5ff4e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "456b1a2948a223a5472ee3a3d836c123",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 189,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f7845cb997a92c2429e9f15c8d6296b6cf77bf6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 189,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
"attack_vector": "port scan syn \u00b7 via HTTP:189 \u00b7 (reconnaissance)",
"target_port_label": "189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 189,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 189,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:189 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:189\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck",
"target_port_label": "189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "189"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 30.96,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
22222 · HTTP
Scan de ports
port scan syn · via HTTP:22222 · (reconnaissance)
Élevée
Moyen · 57
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
22222
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:22222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:22222 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "8ccdbc069a681fa930ac8d7f48511c3a9fab10c0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 240,
"payload_entropy": 5.463306225858753,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 22222,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "05987675919dd544c73e9e45de6d3002cf88c70e",
"event_fingerprint": "a1d52f3174b9d040f6173e0b9873bf372b78cb4a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "ce5e64453f66a0e13de3ec5e1c081da2",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 22222,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed0ac5c1e3a9cd0347d85b2ee1eb278a47ca46ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 22222,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "port scan syn \u00b7 via HTTP:22222 \u00b7 (reconnaissance)",
"target_port_label": "22222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 22222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 22222,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:22222 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:22222\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "22222 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "22222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 30.15,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
4104 · HTTP
Scan de ports
port scan syn · via HTTP:4104 · (reconnaissance)
Élevée
Moyen · 54
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4104
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4104
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4104 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "31845410db1bba6b82d90e270aa9b3f8568d5f3b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.457506499745836,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 4104,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "51e7bcec5b2c92557df0894cb97bbc7d75c70bf4",
"event_fingerprint": "eeae5791c15bdd88cc83257f249448b7d4a4c61e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "16a354b0fba6ad62c976ba3bf8d177f5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4104,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ade15bde3aa84a5910fe87aaf6f0b1e4e40d34b8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 4104,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:4104 \u00b7 (reconnaissance)",
"target_port_label": "4104 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4104,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 4104,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:4104 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4104\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "4104 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4104"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 29.56,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
2068 · HTTP
Scan de ports
port scan syn · via HTTP:2068 · (reconnaissance)
Élevée
Moyen · 56
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2068
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2068
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2068 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "e892378195df50512cd6f344fdcf040308a67711",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.4650770914389595,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 2068,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "99dbcc312dbc5320fdef89c9b9b3293829557368",
"event_fingerprint": "d2e80d02df618cdc38bc684e59a942c11cb5147f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "89281ac0d957c75a1d5b2d9632d9a840",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2068,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f33e033ced7258e12d8869c341a91005999fb1c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance)",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 28.98,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
8143 · HTTP
Scan de ports
port scan syn · via HTTP:8143 · (reconnaissance)
Élevée
Moyen · 56
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8143
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8143 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "4533845a46c90ea23265311352052ab71392890e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.465670018008319,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8143,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "65e3b6af3be951bd886ca288fc6615198fcf9e3f",
"event_fingerprint": "e3b48866de4de7ca5dd4444f696fe05a67e2b7a0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "82571254b68ac5fdebd5c62330b82942",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8143,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1db4310726401a4db7a7ac4447e4b80ea4d9e84b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 28.22,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:01 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_port_scan_fast
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8467
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 941130
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6f5b0a9fc247c6bb758a70fc6a40934213981d54",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 239,
"payload_entropy": 5.471122461472668,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ffb0b9ae530bb8f203b9517402fafa3f96753742",
"event_fingerprint": "2c217b628a374f9ec64804cac44b45557cc106ca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bd33e731a9dc71ed698fb3458da6dbe5",
"payload_hash": "cf874f85f28a991033df485f70980bee",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1bad514a06697e0d3efadd28bc215928ed036db5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 27.49,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_port_scan_fast"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
12559 · TLS
Sonde PostgreSQL
postgres probe · via TLS:12559 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12559
Chemin / cible
—
Service
TLS
Payload
� � �e�{�䔮��>@J�T�$� ڲ`d c��� ��� cG��4�i�L���� �a|�dhW�у� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� � �e�{�䔮��>@J�T�$�
ڲ`d c��� ��� cG��4�i�L���� �a|�dhW�у� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� � �e�{�䔮��>@J�T�$� ڲ`d c��� ��� cG��4�i�L���� �a|�dhW�у� �+�/�,�0̨̩� �� �� { � + 3 & $ ��� l�z��>=-��p�q&�g�G��A�
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.802723032886273,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 12559,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3e0b1f9f97ab68d468288d111f8f4b613d38dd34",
"event_fingerprint": "64ed2dc2375b11594ee829eefc48ff58761aeeff",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "dbdc8882a853eaf53f314360d5d2c4f4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 12559,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\u0019e\ufffd{\ufffd\u452e\ufffd\ufffd\b>@J\ufffdT\ufffd$\ufffd\n\u06b2\u0016`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u0000cG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\u001c\ufffda|\ufffddh\u0002\u001bW\ufffd\u0443\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\u0019e\ufffd{\ufffd\u452e\ufffd\ufffd\b>@J\ufffdT\ufffd$\ufffd\n\u06b2\u0016`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u0000cG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\u001c\ufffda|\ufffddh\u0002\u001bW\ufffd\u0443\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0014\ufffd\u0004\fl\ufffdz\ufffd\ufffd>=-\ufffd\ufffdp\ufffd\u0002\u0018q&\ufffdg\ufffdG\ufffd\ufffdA\ufffd\u0011",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\u0019e\ufffd{\ufffd\u452e\ufffd\ufffd\b>@J\ufffdT\ufffd$\ufffd\n\u06b2\u0016`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u0000cG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\u001c\ufffda|\ufffddh\u0002\u001bW\ufffd\u0443\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "107aba96c14ca39bea7a95b24125b6f0ca3d364b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\u0019e\ufffd{\ufffd\u452e\ufffd\ufffd\b>@J\ufffdT\ufffd$\ufffd\n\u06b2\u0016`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u0000cG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\u001c\ufffda|\ufffddh\u0002\u001bW\ufffd\u0443\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 12559,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\t\ufffde\ufffd{\ufffd\u452e\ufffd\ufffd>@J\ufffdT\ufffd$\ufffd\n\u06b2`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdcG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffda|\ufffddhW\ufffd\u0443\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "postgres probe \u00b7 via TLS:12559 \u00b7 (sonde \/ probe)",
"target_port_label": "12559 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 12559,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\u0019e\ufffd{\ufffd\u452e\ufffd\ufffd\b>@J\ufffdT\ufffd$\ufffd\n\u06b2\u0016`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\u0000cG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\u001c\ufffda|\ufffddh\u0002\u001bW\ufffd\u0443\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 12559,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:12559 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\t\ufffde\ufffd{\ufffd\u452e\ufffd\ufffd>@J\ufffdT\ufffd$\ufffd\n\u06b2`d c\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdcG\ufffd\ufffd4\ufffdi\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffda|\ufffddhW\ufffd\u0443\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "12559 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "12559"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 72
}
05/08/2026 23:17:00 UTC
TCP
1181 · TLS
Sonde PostgreSQL
postgres probe · via TLS:1181 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1181
Chemin / cible
—
Service
TLS
Payload
� �/�R2�ǧ�!�8�i,h�H����k�M�q��R � ��E�Ų������HÙ�}� d� :�na��� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �/�R2�ǧ�!�8�i,h�H����k�M�q��R � ��E�Ų������HÙ�}� d� :�na��� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �/�R2�ǧ�!�8�i,h�H����k�M�q��R � ��E�Ų������HÙ�}� d� :�na��� �+�/�,�0̨̩� �� �� { � + 3 & $ =��� �`O n��=+ �?rյ3i
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.757433955239163,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 1181,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "23f4ce9479cfb100150dd815e1dd07296ecdb839",
"event_fingerprint": "513b3e7246738525f55c3f8f4cb116d0ae405f52",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "f9a8d36b59ba929ce5a28513e5b4b8d5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1181,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\u0018R2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffd\u0004H\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\u001e\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\u0006\ufffd\u0000d\ufffd\u001e:\ufffdna\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\u0018R2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffd\u0004H\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\u001e\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\u0006\ufffd\u0000d\ufffd\u001e:\ufffdna\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 =\ufffd\ufffd\ufffd\u0003\u001f\ufffd`O\u0017 n\u0011\ufffd\ufffd=\u0013\u0007+\u001c\ufffd?r\u0004\u05753\u0013\u000f\u000f\bi",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\u0018R2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffd\u0004H\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\u001e\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\u0006\ufffd\u0000d\ufffd\u001e:\ufffdna\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f8316e08aa5201862ebf8df85a9258d0f75487e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\u0018R2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffd\u0004H\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\u001e\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\u0006\ufffd\u0000d\ufffd\u001e:\ufffdna\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 1181,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\/\ufffdR2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffdH\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\ufffdd\ufffd:\ufffdna\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "postgres probe \u00b7 via TLS:1181 \u00b7 (sonde \/ probe)",
"target_port_label": "1181 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1181,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\/\ufffd\u0018R2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffd\u0004H\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\u001e\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\u0006\ufffd\u0000d\ufffd\u001e:\ufffdna\ufffd\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 1181,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1181 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\/\ufffdR2\ufffd\u01e7\ufffd!\ufffd8\ufffdi,h\ufffdH\ufffd\ufffd\ufffd\ufffdk\ufffdM\ufffdq\ufffd\ufffdR \ufffd\ufffd\ufffdE\ufffd\u0172\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\u00d9\ufffd}\ufffdd\ufffd:\ufffdna\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "1181 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
16993 · TLS
Scan de ports
port scan syn · via TLS:16993 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
16993
Chemin / cible
—
Service
TLS
Payload
� �z%���<�Ҁ ��T@t��f�6��i �?��� 7}�TmZ�k]_" W�R������X�TBo� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +4
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �z%���<�Ҁ ��T@t��f�6��i
�?��� 7}�TmZ�k]_" W�R������X�TBo� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �z%���<�Ҁ ��T@t��f�6��i �?��� 7}�TmZ�k]_" W�R������X�TBo� �+�/�,�0̨̩� �� �� { � + 3 & $ }�Lr7k>�( ���t�롖m�u��z~!��t
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.824272534682309,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8e55e3fb36ca0644ed18a82c7834210d72984b4f",
"event_fingerprint": "480a9ee93296f01074652a3a697682875a4979ca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 4
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "b6b0e81ab0f4300e8cfbe8ef1dae9da0",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 16993,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z%\ufffd\ufffd\u000f\ufffd<\ufffd\u0480\t\ufffd\u0016\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffd\u0011TmZ\ufffdk]_\u0010\"\u001dW\ufffdR\ufffd\u0001\u0002\ufffd\ufffd\ufffd\ufffd\u0003\ufffdX\ufffdTBo\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z%\ufffd\ufffd\u000f\ufffd<\ufffd\u0480\t\ufffd\u0016\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffd\u0011TmZ\ufffdk]_\u0010\"\u001dW\ufffdR\ufffd\u0001\u0002\ufffd\ufffd\ufffd\ufffd\u0003\ufffdX\ufffdTBo\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 }\ufffdLr7k>\u0002\ufffd( \ufffd\u0014\ufffd\ufffdt\ufffd\ub856m\ufffdu\ufffd\ufffdz~!\ufffd\ufffdt",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z%\ufffd\ufffd\u000f\ufffd<\ufffd\u0480\t\ufffd\u0016\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffd\u0011TmZ\ufffdk]_\u0010\"\u001dW\ufffdR\ufffd\u0001\u0002\ufffd\ufffd\ufffd\ufffd\u0003\ufffdX\ufffdTBo\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a980664ff5e6b4b7313963378871a65738443cbe",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z%\ufffd\ufffd\u000f\ufffd<\ufffd\u0480\t\ufffd\u0016\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffd\u0011TmZ\ufffdk]_\u0010\"\u001dW\ufffdR\ufffd\u0001\u0002\ufffd\ufffd\ufffd\ufffd\u0003\ufffdX\ufffdTBo\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 16993,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdz%\ufffd\ufffd\ufffd<\ufffd\u0480\t\ufffd\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffdTmZ\ufffdk]_\"W\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffdTBo\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:16993 \u00b7 (reconnaissance)",
"target_port_label": "16993 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 4
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z%\ufffd\ufffd\u000f\ufffd<\ufffd\u0480\t\ufffd\u0016\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffd\u0011TmZ\ufffdk]_\u0010\"\u001dW\ufffdR\ufffd\u0001\u0002\ufffd\ufffd\ufffd\ufffd\u0003\ufffdX\ufffdTBo\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 16993,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:16993 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdz%\ufffd\ufffd\ufffd<\ufffd\u0480\t\ufffd\ufffdT@t\ufffd\ufffdf\ufffd6\ufffd\ufffdi\n\ufffd?\ufffd\ufffd\ufffd 7}\ufffdTmZ\ufffdk]_\"W\ufffdR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffdTBo\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "16993 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +4",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 30,
"behavior_alerts": [
"rapid_port_scan"
],
"correlation_confidence_boost": 4,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
189 · TLS
Scan de ports
port scan syn · via TLS:189 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
189
Chemin / cible
—
Service
TLS
Payload
� �Ŏ��,Pn�&�n���ɞ�'���$�U ��G�G ����YJ:2���&�~Y� CUt�� ���g �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Ŏ��,Pn�&�n���ɞ�'���$�U ��G�G ����YJ:2���&�~Y� CUt�� ���g �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �Ŏ��,Pn�&�n���ɞ�'���$�U ��G�G ����YJ:2���&�~Y� CUt�� ���g �+�/�,�0̨̩� �� �� { � + 3 & $ ���݆�p���m���giL��b\�����=9
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.821179761486606,
"port_category": "well_known",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 189,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "306457448046cd9a3e0a1582196bf220411e4e92",
"event_fingerprint": "bffd34234d3f75c4395cf2f256a6af6a2c0a8994",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "fdadc60c3571c800ea383043ffc48d83",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 189,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u014e\ufffd\u001b\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG\u0005 \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\u0017\ufffd~Y\ufffd\fCUt\u0016\ufffd\ufffd\t\ufffd\ufffd\ufffdg\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u014e\ufffd\u001b\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG\u0005 \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\u0017\ufffd~Y\ufffd\fCUt\u0016\ufffd\ufffd\t\ufffd\ufffd\ufffdg\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\u0746\ufffdp\ufffd\u0001\ufffd\ufffdm\ufffd\ufffd\u0013\ufffdgiL\ufffd\ufffdb\\\ufffd\ufffd\ufffd\ufffd\u0015\ufffd=9",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u014e\ufffd\u001b\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG\u0005 \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\u0017\ufffd~Y\ufffd\fCUt\u0016\ufffd\ufffd\t\ufffd\ufffd\ufffdg\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "027a1d6231ce79d18a99a16300da415d3700ce3a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u014e\ufffd\u001b\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG\u0005 \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\u0017\ufffd~Y\ufffd\fCUt\u0016\ufffd\ufffd\t\ufffd\ufffd\ufffdg\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 189,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u014e\ufffd\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\ufffd~Y\ufffdCUt\ufffd\ufffd\t\ufffd\ufffd\ufffdg\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:189 \u00b7 (reconnaissance)",
"target_port_label": "189 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 189,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u014e\ufffd\u001b\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG\u0005 \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\u0017\ufffd~Y\ufffd\fCUt\u0016\ufffd\ufffd\t\ufffd\ufffd\ufffdg\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 189,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:189 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\u014e\ufffd\ufffd,Pn\ufffd&\ufffdn\ufffd\ufffd\ufffd\u025e\ufffd'\ufffd\ufffd\ufffd$\ufffdU\t\ufffd\ufffdG\ufffdG \ufffd\ufffd\ufffd\ufffdYJ:2\ufffd\ufffd\ufffd&\ufffd~Y\ufffdCUt\ufffd\ufffd\t\ufffd\ufffd\ufffdg\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "189 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "189"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
189,
1181,
12559,
16993
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 4,
"scan_velocity_ports_per_s": 40,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
19222 · TLS
Scan de ports
port scan syn · via TLS:19222 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
19222
Chemin / cible
—
Service
TLS
Payload
� ��eOL� k�wl�Ԁ����!���;�@��u� ?���*�]^�����TN2��d��j�m�S� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��eOL� k�wl�Ԁ����!���;�@��u� ?���*�]^�����TN2��d��j�m�S� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� ��eOL� k�wl�Ԁ����!���;�@��u� ?���*�]^�����TN2��d��j�m�S� �+�/�,�0̨̩� �� �� { � + 3 & $ �.,d|H�Y/�� rN0�,�o��g��0C
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.886256775267663,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 19222,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d98b549d77a6e75de1881f9e0c0a5e186e3e65a7",
"event_fingerprint": "4e7eb53f1b7b734a269df8fc7c01a1792efd7b8e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "34fd83be0560c160fff9bea866d95597",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 19222,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdeOL\ufffd\u001ck\ufffdwl\ufffd\u0500\u0002\ufffd\ufffd\u0006\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd\u001d ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffd\u000eTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffd\u0004S\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdeOL\ufffd\u001ck\ufffdwl\ufffd\u0500\u0002\ufffd\ufffd\u0006\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd\u001d ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffd\u000eTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffd\u0004S\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \f\u0007\ufffd.\u0015,d|H\ufffdY\/\ufffd\ufffd\nrN\u00180\u0013\ufffd,\ufffdo\ufffd\ufffdg\ufffd\ufffd0C",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdeOL\ufffd\u001ck\ufffdwl\ufffd\u0500\u0002\ufffd\ufffd\u0006\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd\u001d ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffd\u000eTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffd\u0004S\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e47bbb1db3d125c9e04579b38c9acac8968f31ae",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdeOL\ufffd\u001ck\ufffdwl\ufffd\u0500\u0002\ufffd\ufffd\u0006\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd\u001d ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffd\u000eTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffd\u0004S\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 19222,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdeOL\ufffdk\ufffdwl\ufffd\u0500\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffdTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffdS\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:19222 \u00b7 (reconnaissance)",
"target_port_label": "19222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 19222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdeOL\ufffd\u001ck\ufffdwl\ufffd\u0500\u0002\ufffd\ufffd\u0006\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd\u001d ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffd\u000eTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffd\u0004S\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 19222,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:19222 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdeOL\ufffdk\ufffdwl\ufffd\u0500\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd;\ufffd@\ufffd\ufffdu\ufffd ?\ufffd\ufffd\ufffd*\ufffd]^\ufffd\ufffd\ufffd\ufffd\ufffdTN2\ufffd\ufffdd\ufffd\ufffdj\ufffdm\ufffdS\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "19222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "19222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
189,
1181,
12559,
16993,
19222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 50,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
20150 · TLS
Scan de ports
port scan syn · via TLS:20150 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
20150
Chemin / cible
—
Service
TLS
Payload
� �5&�`E��fr��q�M(?D��e�Y:��/�"h k��vϑ���ie~��� a�i.3 |��S�; �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5&�`E��fr��q�M(?D��e�Y:��/�"h k��vϑ���ie~��� a�i.3 |��S�; �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �5&�`E��fr��q�M(?D��e�Y:��/�"h k��vϑ���ie~��� a�i.3 |��S�; �+�/�,�0̨̩� �� �� { � + 3 & $ �% ��y���<�PZ�_��a �i�O���UI
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.8744214470924625,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 20150,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "30d192786ba7f7715a5af680974acabaa45e915c",
"event_fingerprint": "89104ccee5fb0c10d91a23cfb1278a2d539d0dcb",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "1dc3300d3c2acb0604e915b3a85ef7e4",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 20150,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035&\ufffd`E\ufffd\ufffdfr\ufffd\ufffd\u0017q\ufffdM(\u0004?D\ufffd\ufffde\ufffd\u000fY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffd\bie~\ufffd\ufffd\ufffd\u001ea\ufffdi\u0006.3\u001c|\ufffd\u001b\ufffdS\ufffd;\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035&\ufffd`E\ufffd\ufffdfr\ufffd\ufffd\u0017q\ufffdM(\u0004?D\ufffd\ufffde\ufffd\u000fY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffd\bie~\ufffd\ufffd\ufffd\u001ea\ufffdi\u0006.3\u001c|\ufffd\u001b\ufffdS\ufffd;\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd%\t\ufffd\ufffdy\ufffd\ufffd\ufffd\u0012<\ufffdPZ\u0017\ufffd_\b\ufffd\u0011\ufffda\t\ufffdi\ufffdO\ufffd\ufffd\ufffdUI",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035&\ufffd`E\ufffd\ufffdfr\ufffd\ufffd\u0017q\ufffdM(\u0004?D\ufffd\ufffde\ufffd\u000fY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffd\bie~\ufffd\ufffd\ufffd\u001ea\ufffdi\u0006.3\u001c|\ufffd\u001b\ufffdS\ufffd;\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5608ece66e17f09763df99a6708727895821615e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035&\ufffd`E\ufffd\ufffdfr\ufffd\ufffd\u0017q\ufffdM(\u0004?D\ufffd\ufffde\ufffd\u000fY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffd\bie~\ufffd\ufffd\ufffd\u001ea\ufffdi\u0006.3\u001c|\ufffd\u001b\ufffdS\ufffd;\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 20150,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd5&\ufffd`E\ufffd\ufffdfr\ufffd\ufffdq\ufffdM(?D\ufffd\ufffde\ufffdY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffdie~\ufffd\ufffd\ufffda\ufffdi.3|\ufffd\ufffdS\ufffd;\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:20150 \u00b7 (reconnaissance)",
"target_port_label": "20150 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 20150,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035&\ufffd`E\ufffd\ufffdfr\ufffd\ufffd\u0017q\ufffdM(\u0004?D\ufffd\ufffde\ufffd\u000fY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffd\bie~\ufffd\ufffd\ufffd\u001ea\ufffdi\u0006.3\u001c|\ufffd\u001b\ufffdS\ufffd;\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 20150,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:20150 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd5&\ufffd`E\ufffd\ufffdfr\ufffd\ufffdq\ufffdM(?D\ufffd\ufffde\ufffdY:\ufffd\ufffd\/\ufffd\"h k\ufffd\ufffdv\u03d1\ufffd\ufffd\ufffdie~\ufffd\ufffd\ufffda\ufffdi.3|\ufffd\ufffdS\ufffd;\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "20150 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "20150"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
189,
1181,
12559,
16993,
19222,
20150
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 60,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
8142 · TLS
Scan de ports
port scan syn · via TLS:8142 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8142
Chemin / cible
—
Service
TLS
Payload
� ���6��@�"M�+�S���B���vQ��� Z:�� 8��+f�N�����1x<� �L gQF �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���6��@�"M�+�S���B���vQ��� Z:��
8��+f�N�����1x<� �L gQF �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� ���6��@�"M�+�S���B���vQ��� Z:�� 8��+f�N�����1x<� �L gQF �+�/�,�0̨̩� �� �� { � + 3 & $ X��نx��F`�fN�>��D���5 ��$g�o
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.758655599830277,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 8142,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5ae1de1aba75bea2ecfa299f856076c4a48e9732",
"event_fingerprint": "a3b9fe2008ed968fde4986c91ca3d1e9fe5e03f8",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "3c23edd58e957122134f56e573ffecdd",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8142,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffd\ufffd@\u0011\ufffd\"M\ufffd+\u0001\ufffd\u0017\u0013S\u000f\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\u0002\ufffd\ufffd\ufffd \u0013Z:\ufffd\ufffd\r8\ufffd\ufffd+\u0016f\ufffdN\ufffd\u0013\ufffd\ufffd\ufffd\ufffd1x<\ufffd\u001d\ufffdL\u0000gQF\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffd\ufffd@\u0011\ufffd\"M\ufffd+\u0001\ufffd\u0017\u0013S\u000f\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\u0002\ufffd\ufffd\ufffd \u0013Z:\ufffd\ufffd\r8\ufffd\ufffd+\u0016f\ufffdN\ufffd\u0013\ufffd\ufffd\ufffd\ufffd1x<\ufffd\u001d\ufffdL\u0000gQF\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 X\ufffd\ufffd\u0015\u0646x\ufffd\ufffdF`\ufffdfN\ufffd>\ufffd\ufffdD\ufffd\u0003\ufffd\ufffd5\n\u0016\ufffd\ufffd$g\ufffdo",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffd\ufffd@\u0011\ufffd\"M\ufffd+\u0001\ufffd\u0017\u0013S\u000f\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\u0002\ufffd\ufffd\ufffd \u0013Z:\ufffd\ufffd\r8\ufffd\ufffd+\u0016f\ufffdN\ufffd\u0013\ufffd\ufffd\ufffd\ufffd1x<\ufffd\u001d\ufffdL\u0000gQF\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "739d0fd5cc3696580f2de4c077f47851a6f6916b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffd\ufffd@\u0011\ufffd\"M\ufffd+\u0001\ufffd\u0017\u0013S\u000f\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\u0002\ufffd\ufffd\ufffd \u0013Z:\ufffd\ufffd\r8\ufffd\ufffd+\u0016f\ufffdN\ufffd\u0013\ufffd\ufffd\ufffd\ufffd1x<\ufffd\u001d\ufffdL\u0000gQF\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8142,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd@\ufffd\"M\ufffd+\ufffdS\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\ufffd\ufffd\ufffd Z:\ufffd\ufffd\r8\ufffd\ufffd+f\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd1x<\ufffd\ufffdLgQF\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:8142 \u00b7 (reconnaissance)",
"target_port_label": "8142 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8142,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd6\ufffd\ufffd@\u0011\ufffd\"M\ufffd+\u0001\ufffd\u0017\u0013S\u000f\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\u0002\ufffd\ufffd\ufffd \u0013Z:\ufffd\ufffd\r8\ufffd\ufffd+\u0016f\ufffdN\ufffd\u0013\ufffd\ufffd\ufffd\ufffd1x<\ufffd\u001d\ufffdL\u0000gQF\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 8142,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:8142 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd@\ufffd\"M\ufffd+\ufffdS\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdvQ\ufffd\ufffd\ufffd Z:\ufffd\ufffd\r8\ufffd\ufffd+f\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd1x<\ufffd\ufffdLgQF\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "8142 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8142"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
189,
1181,
8142,
12559,
16993,
19222,
20150
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 70,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
4104 · TLS
Scan de ports
port scan syn · via TLS:4104 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
4104
Chemin / cible
—
Service
TLS
Payload
� ��J F�0������SJ��\� §&��K� /'��i� ��؋c�����M�U 8։;�� �5 �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��J F�0������SJ��\� §&��K� /'��i�
��؋c�����M�U 8։;�� �5 �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� ��J F�0������SJ��\� §&��K� /'��i� ��؋c�����M�U 8։;�� �5 �+�/�,�0̨̩� �� �� { � + 3 & $ 2�N��H!���!+�"J��K)�YDeJ���dX
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.782409470788868,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 4104,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e65571edf833972048581cbf9614070d8fb32191",
"event_fingerprint": "abaea405e8200ef079193e3e1553ad0941d74f06",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "75cf82f390577ea2de2685aa4ceb6141",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 4104,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffdJ\fF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\u001b\\\ufffd\u000b\u00a7\u0014\u0004\u0019&\ufffd\ufffdK\ufffd\u0003 \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\u0003\ufffd\u0017\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\u001d\ufffd5\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffdJ\fF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\u001b\\\ufffd\u000b\u00a7\u0014\u0004\u0019&\ufffd\ufffdK\ufffd\u0003 \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\u0003\ufffd\u0017\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\u001d\ufffd5\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 2\ufffdN\ufffd\ufffdH\u0005!\ufffd\b\ufffd\ufffd!+\ufffd\"J\ufffd\ufffdK)\ufffdYDe\u0015J\ufffd\ufffd\ufffddX",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffdJ\fF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\u001b\\\ufffd\u000b\u00a7\u0014\u0004\u0019&\ufffd\ufffdK\ufffd\u0003 \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\u0003\ufffd\u0017\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\u001d\ufffd5\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebd7c5c8d542d46babd74624487f192c77d65d35",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffdJ\fF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\u001b\\\ufffd\u000b\u00a7\u0014\u0004\u0019&\ufffd\ufffdK\ufffd\u0003 \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\u0003\ufffd\u0017\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\u001d\ufffd5\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 4104,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdJF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\\\ufffd\u00a7&\ufffd\ufffdK\ufffd \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\ufffd5\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:4104 \u00b7 (reconnaissance)",
"target_port_label": "4104 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4104,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffdJ\fF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\u001b\\\ufffd\u000b\u00a7\u0014\u0004\u0019&\ufffd\ufffdK\ufffd\u0003 \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\u0003\ufffd\u0017\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\u001d\ufffd5\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 4104,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:4104 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd\ufffdJF\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdSJ\ufffd\ufffd\\\ufffd\u00a7&\ufffd\ufffdK\ufffd \/'\ufffd\ufffdi\ufffd\n\ufffd\ufffd\u060bc\ufffd\ufffd\ufffd\ufffd\ufffdM\ufffdU\t8\u0589;\ufffd\ufffd\ufffd5\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "4104 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4104"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 8,
"port_scan_ports_sample": [
189,
1181,
4104,
8142,
12559,
16993,
19222,
20150
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 80,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
2068 · TLS
Scan de ports
port scan syn · via TLS:2068 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2068
Chemin / cible
—
Service
TLS
Payload
� �lEBQ�W����j'.�2�lۃ6�Ss� ^ �#~E���֏2.,�r�����Ϯ c��Qw �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �lEBQ�W����j'.�2�lۃ6�Ss� ^ �#~E���֏2.,�r�����Ϯ c��Qw �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �lEBQ�W����j'.�2�lۃ6�Ss� ^ �#~E���֏2.,�r�����Ϯ c��Qw �+�/�,�0̨̩� �� �� { � + 3 & $ Y��/�� �~�5Y ���u 88�N^Rk�K�f
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.84374747125363,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 2068,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "346edefa85ac2c3816d8ec6ae67524e95af99a5e",
"event_fingerprint": "5476e55edd6d2d5721159dbb66020ab0960f9843",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "78d670bc09cfb2b8ee2565f8f547b9c5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2068,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\u001bE\u001aBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdS\u0011\u0010\u0005s\u0016\ufffd\u001e^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\u0011\u0002\ufffd\u0018\ufffd\ufffd\ufffd\u03ee\u001ec\ufffd\ufffdQw\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\u001bE\u001aBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdS\u0011\u0010\u0005s\u0016\ufffd\u001e^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\u0011\u0002\ufffd\u0018\ufffd\ufffd\ufffd\u03ee\u001ec\ufffd\ufffdQw\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 Y\ufffd\ufffd\/\ufffd\ufffd\u0000\ufffd~\ufffd5Y\u001e\ufffd\ufffd\ufffdu\u001d88\ufffdN^Rk\u0006\ufffdK\ufffdf",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\u001bE\u001aBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdS\u0011\u0010\u0005s\u0016\ufffd\u001e^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\u0011\u0002\ufffd\u0018\ufffd\ufffd\ufffd\u03ee\u001ec\ufffd\ufffdQw\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ecb6b7e6ae6e91cb6454e232dbc83d030fd7b682",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\u001bE\u001aBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdS\u0011\u0010\u0005s\u0016\ufffd\u001e^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\u0011\u0002\ufffd\u0018\ufffd\ufffd\ufffd\u03ee\u001ec\ufffd\ufffdQw\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 2068,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdlEBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdSs\ufffd^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u03eec\ufffd\ufffdQw\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:2068 \u00b7 (reconnaissance)",
"target_port_label": "2068 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\u001bE\u001aBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdS\u0011\u0010\u0005s\u0016\ufffd\u001e^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\u0011\u0002\ufffd\u0018\ufffd\ufffd\ufffd\u03ee\u001ec\ufffd\ufffdQw\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 2068,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:2068 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffdlEBQ\ufffdW\ufffd\ufffd\ufffd\ufffdj'.\ufffd2\ufffdl\u06c36\ufffdSs\ufffd^ \ufffd#~E\ufffd\ufffd\ufffd\u058f2.,\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\u03eec\ufffd\ufffdQw\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "2068 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 9,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
12559,
16993,
19222,
20150
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 90,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:17:00 UTC
TCP
22222 · TLS
Scan de ports
port scan syn · via TLS:22222 · (reconnaissance)
Élevée
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Protocole
JA3 ea4a9ae049cfc614
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
22222
Chemin / cible
—
Service
TLS
Payload
� �4�<h���j���� V^�a��LQ�Jқ#�O ����0* Rv�}�B�,B�� 0o��x�" �� �+�/�,�0̨̩� �� �� {
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �4�<h���j���� V^�a��LQ�Jқ#�O ����0* Rv�}�B�,B�� 0o��x�" �� �+�/�,�0̨̩� ��
�� {
Requête brute (extrait)
� �4�<h���j���� V^�a��LQ�Jқ#�O ����0* Rv�}�B�,B�� 0o��x�" �� �+�/�,�0̨̩� �� �� { � + 3 & $ ���RiU@#� �c�1<p�0;��Ԝ�B���t
Meta JSON brut
{
"tls_ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 233,
"payload_entropy": 5.842593238671554,
"port_category": "registered",
"org": "DIGI VPS",
"service": "tls",
"app_proto": "tls",
"asn": 142430,
"country": "US",
"dst_port": 22222,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ccd397c4776fe9f9f1cf1e7614cf0ff25d9049ea",
"event_fingerprint": "e1d9ddd7b6a0b37d7d0026068647591d6bd64a16",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"payload_hash": "07ff5e84b6478f7e6e3f07b5a7ea3634",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9",
"ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e409f8f7d178e6f80ea4e6fb771b3160",
"tls_ja4": "t13d0114_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 14,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 22222,
"service": "tls",
"service_name": "tls",
"risk_score": 42
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd<h\ufffd\ufffd\ufffdj\ufffd\u0015\ufffd\ufffd\ufffd\u0000V^\ufffda\u000f\ufffd\ufffdLQ\ufffdJ\u049b\u0019#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd\u001d0o\ufffd\u0003\ufffdx\ufffd\"\u001c\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd<h\ufffd\ufffd\ufffdj\ufffd\u0015\ufffd\ufffd\ufffd\u0000V^\ufffda\u000f\ufffd\ufffdLQ\ufffdJ\u049b\u0019#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd\u001d0o\ufffd\u0003\ufffdx\ufffd\"\u001c\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0015\ufffd\ufffdRiU\u001b@#\ufffd\u001e\ufffdc\ufffd1<p\ufffd0;\ufffd\ufffd\u051c\ufffdB\ufffd\u0002\ufffd\ufffdt",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd<h\ufffd\ufffd\ufffdj\ufffd\u0015\ufffd\ufffd\ufffd\u0000V^\ufffda\u000f\ufffd\ufffdLQ\ufffdJ\u049b\u0019#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd\u001d0o\ufffd\u0003\ufffdx\ufffd\"\u001c\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a186b79c28b5ff99b710031b4c08fd7e7c0c8b6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd<h\ufffd\ufffd\ufffdj\ufffd\u0015\ufffd\ufffd\ufffd\u0000V^\ufffda\u000f\ufffd\ufffdLQ\ufffdJ\u049b\u0019#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd\u001d0o\ufffd\u0003\ufffdx\ufffd\"\u001c\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 22222,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd4\ufffd<h\ufffd\ufffd\ufffdj\ufffd\ufffd\ufffd\ufffdV^\ufffda\ufffd\ufffdLQ\ufffdJ\u049b#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd0o\ufffd\ufffdx\ufffd\"\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"attack_vector": "port scan syn \u00b7 via TLS:22222 \u00b7 (reconnaissance)",
"target_port_label": "22222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TLS \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 22222,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"scan_rapide",
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00034\ufffd<h\ufffd\ufffd\ufffdj\ufffd\u0015\ufffd\ufffd\ufffd\u0000V^\ufffda\u000f\ufffd\ufffdLQ\ufffdJ\u049b\u0019#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd\u001d0o\ufffd\u0003\ufffdx\ufffd\"\u001c\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000",
"tls_ja3": "ea4a9ae049cfc614efbb3c244abb3fc7",
"tls_ja4": "e409f8f7d178e6f80ea4e6fb771b3160",
"port": 22222,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "port scan syn \u00b7 via TLS:22222 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd\ufffd4\ufffd<h\ufffd\ufffd\ufffdj\ufffd\ufffd\ufffd\ufffdV^\ufffda\ufffd\ufffdLQ\ufffdJ\u049b#\ufffdO \ufffd\ufffd\ufffd\ufffd0*\tRv\ufffd}\ufffdB\ufffd,B\ufffd\ufffd0o\ufffd\ufffdx\ufffd\"\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd{",
"target_port_label": "22222 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "22222"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 10,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 100,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:40 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance) · → /wp-json/batch/v1/
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
TA0043
Protocole
POST /wp-json/batch/v1/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
46
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950406:ssrf-3
Cible HTTP
POST
/wp-json/batch/v1/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/wp-json/batch/v1/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 8 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /wp-json/batch/v1/ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
lfi-14
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /wp-json/batch/v1/ HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
Requête brute (extrait)
POST /wp-json/batch/v1/ HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: clos
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "1fa0f34835cb8c45ffe2c175859da1d2641bdbc8",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 643,
"payload_entropy": 5.4291981215153235,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 59,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "117bf7a0e87d07f377eaf5d0537106579ae92cf7",
"event_fingerprint": "35a8b6687d9fde993e623fe368e20e93c11918e3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "5a566e84ad314ed392f13e663fe1f484",
"path_pattern_hash": "0c320379c99f581838e466828f2923b3"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"method": "POST",
"path": "\/wp-json\/batch\/v1\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1",
"request_sample": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: clos",
"payload_snippet": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"evidence": {
"method": "POST",
"path": "\/wp-json\/batch\/v1\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1",
"request_sample": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: clos",
"payload_snippet": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "800b8791d6b0fa8897347208dbf0c13bc66d4961",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/batch\/v1\/",
"request_line": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/batch\/v1\/",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/batch\/v1\/",
"request_line": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/batch\/v1\/",
"evidence_snippet": "POST \/wp-json\/batch\/v1\/ HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.03,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_probe_wp_json",
"http_wp_scan",
"http_xff_loopback"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:39 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance) · → /wp-json/Batch/v1
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
TA0043
Protocole
POST /wp-json/Batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/wp-json/Batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/wp-json/Batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /wp-json/Batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /wp-json/Batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64
Requête brute (extrait)
POST /wp-json/Batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: close
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "bb7cf68be391311aa9412d0a0057b42d1b90b4e8",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 642,
"payload_entropy": 5.43254051852999,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 59,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "34e0284302c7a13d41743dddab761daecf263972",
"event_fingerprint": "ce6fc65a6875fa42bf005b85c43b93ef58bb31d4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "5a546df7d0034410883210abe28d4d46",
"path_pattern_hash": "016beb137830bc56d82e7885000dd62f"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"method": "POST",
"path": "\/wp-json\/Batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close",
"payload_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"evidence": {
"method": "POST",
"path": "\/wp-json\/Batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close",
"payload_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b272c247fabaeec12846512b6c739a93383da4e6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/Batch\/v1",
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/Batch\/v1",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/Batch\/v1",
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/Batch\/v1",
"evidence_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_probe_wp_json",
"http_wp_scan",
"http_xff_loopback"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:39 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance) · → //wp-json/batch/v1
Élevée
Moyen · 64
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST //wp-json/batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
//wp-json/batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
//wp-json/batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST //wp-json/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
Payload (extrait)
POST //wp-json/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
Requête brute (extrait)
POST //wp-json/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: clos
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "75a8db03db753bfd1bdb875322bb0406c56bb897",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 643,
"payload_entropy": 5.4291981215153235,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "264c464cdf5f3e79684391670558db8fbd2f4e70",
"event_fingerprint": "de1cef87f5e395f7320ec4541d6dc9306e5392ac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "88a625034a414557979dedcaff1c3149",
"path_pattern_hash": "ef27af85895104a0756863c7e7be0e44"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"method": "POST",
"path": "\/\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded"
],
"request_line": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: clos",
"payload_snippet": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"evidence": {
"method": "POST",
"path": "\/\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded"
],
"request_line": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: clos",
"payload_snippet": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c18d2b57e645d33a6d878c43ee1179fc8aeae848",
"protocol_details": {
"http_method": "POST",
"http_path": "\/\/wp-json\/batch\/v1",
"request_line": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/\/wp-json\/batch\/v1",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/\/wp-json\/batch\/v1",
"request_line": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/\/wp-json\/batch\/v1",
"evidence_snippet": "POST \/\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 2.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_loopback"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:38 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance)
Élevée
Moyen · 64
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
POST /?rest_route=/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection:
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "d10c584923055253f318683752ac5b9304fe3039",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 647,
"payload_entropy": 5.439181954028721,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 64,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "b0138166cc0631f9311ea730f4dae0139f1b2f19",
"event_fingerprint": "6ab8a259229c2003b03c42775a46886bb8a04e9a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "091d8022be9b03f949e3d125cd5e60c3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: ",
"payload_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: ",
"payload_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3aa0be976003025e56ccb8019926595bb869a712",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_loopback"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:38 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance) · → /wp-json/batch/v1
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
TA0043
Protocole
POST /wp-json/batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/wp-json/batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/wp-json/batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /wp-json/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /wp-json/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64
Requête brute (extrait)
POST /wp-json/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: close
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "838256a3c9f05cbed1f5a9c1a533311fafc3527b",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 642,
"payload_entropy": 5.429425253732482,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 59,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "34e0284302c7a13d41743dddab761daecf263972",
"event_fingerprint": "ad2af9a29da189676590e09d2f06be1715aec6f5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "af7a3ca84a47f7c443e3068886a1136f",
"path_pattern_hash": "016beb137830bc56d82e7885000dd62f"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"method": "POST",
"path": "\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close",
"payload_snippet": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"evidence": {
"method": "POST",
"path": "\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close",
"payload_snippet": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bab95ead6b7382e5620922cf58cd03ed7dfc3d17",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/batch\/v1",
"request_line": "POST \/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/batch\/v1",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/batch\/v1",
"request_line": "POST \/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/batch\/v1",
"evidence_snippet": "POST \/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_probe_wp_json",
"http_wp_scan",
"http_xff_loopback"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:37 UTC
TCP
16993 · HTTP
Scan de ports
port scan syn · via HTTP:16993 · (reconnaissance)
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950469:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
16993
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:16993
User-Agent: Mozilla/5.0 (X11; Linux x86_64) Ap
Requête brute (extrait)
POST /?rest_route=/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:16993 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept-Language: en-GB,en;q=0.9 Accept-Encoding: gzip, def
Meta JSON brut
{
"http_header_count": 17,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d82905d40b5a90427ca8ec1e23e6d56f2e112b3d",
"http_host_hash": "72527336106ae1a15384684942ea87a431e21082",
"http_target_hash": "d10c584923055253f318683752ac5b9304fe3039",
"http_referer_hash": "8089a66b073652627faa9b05d438313fbeb20a47",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 657,
"payload_entropy": 5.547875413736916,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 63,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b591fc30b9c720322b1df57e65c8f7c981699387",
"event_fingerprint": "adde63f923e80f061387db2b609e7c8c4e54a89e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "84ee3de483813401be789de5668c38f8",
"payload_hash": "b55f5cdfbe91f367970d86c41b730e5c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 16993,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Ap",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip, def",
"payload_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Ap",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip, def",
"payload_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Ap",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0cf48c4651dfe445353017e35fe678ebcc23f66e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Ap",
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Ap",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.42,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:37 UTC
TCP
8143 · HTTP
Scan de ports
port scan syn · via HTTP:8143 · (reconnaissance)
Élevée
Élevé · 66
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950469:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8143
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8143 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection
Meta JSON brut
{
"http_header_count": 11,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "4533845a46c90ea23265311352052ab71392890e",
"http_target_hash": "c9c4f3eb57ad2667f354b6f9488055cd78d248e7",
"http_referer_hash": "dda84360875d00ab4ce210db3cce073a88911374",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 432,
"payload_entropy": 5.445058596323702,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8143,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "277eb88f3cbb14e1bf4f59d2b51d0fe1d51930ad",
"event_fingerprint": "cc4f9adb40f0b5c37b2025f8cfe4943f6c362b8f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "eddbe9b3d77fdbfb870329a4ae7ea7e1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8143,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcdadee87647a82ddb8e43e34a74c54da8a3114c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.49,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:37 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance)
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "c9c4f3eb57ad2667f354b6f9488055cd78d248e7",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 649,
"payload_entropy": 5.449573947984118,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "8e3d991eb236a11e9e590dd4f3f7c2527bb41c88",
"event_fingerprint": "fe4d603adcc7c9e3675c665430a64d2ac8a3fcdf",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "4e3ed15d53bd7b44185e4053fcbb4978",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "95b61943191fb6b1652331a868fbbe64468bec22",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.47,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
16993 · HTTP
Scan de ports
port scan syn · via HTTP:16993 · (reconnaissance) · → /index.php
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /index.php UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/index.php
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
16993
Chemin / cible
/index.php
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /index.php?rest_route=/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
Payload (extrait)
POST /index.php?rest_route=/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:16993
User-Agent: Mozilla/5.0 (X11; Linux x
Requête brute (extrait)
POST /index.php?rest_route=/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:16993 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept-Language: en-GB,en;q=0.9 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 22,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "d82905d40b5a90427ca8ec1e23e6d56f2e112b3d",
"http_host_hash": "72527336106ae1a15384684942ea87a431e21082",
"http_target_hash": "e2e65188255c63c3ebdb68b82f899d9afbdc793f",
"http_referer_hash": "8089a66b073652627faa9b05d438313fbeb20a47",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 832,
"payload_entropy": 5.533355862142236,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "493d9307b2822233a31cfd6a62f101cb4dfb2022",
"event_fingerprint": "6e0d426cc8ef9060db2cb06a40f2575c45861244",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "84ee3de483813401be789de5668c38f8",
"payload_hash": "f6bd8d4c0ba68653f3bd65611d2bd795",
"path_pattern_hash": "201b6d8e6a3d9fbcc3cf8466de84b9b4"
},
"target_context": {
"dst_port": 16993,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x",
"method": "POST",
"path": "\/index.php",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded"
],
"request_line": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: ",
"payload_snippet": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x",
"evidence": {
"method": "POST",
"path": "\/index.php",
"query_string": "rest_route=\/batch\/v1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded"
],
"request_line": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: ",
"payload_snippet": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bcc15b3798ddb17bba75e2b70f467b064344770",
"protocol_details": {
"http_method": "POST",
"http_path": "\/index.php",
"request_line": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x",
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.php",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/index.php",
"request_line": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.php",
"evidence_snippet": "POST \/index.php?rest_route=\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.5,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
8143 · HTTP
Scan de ports
port scan syn · via HTTP:8143 · (reconnaissance)
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8143
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8143
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8143 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connecti
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "4533845a46c90ea23265311352052ab71392890e",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "dda84360875d00ab4ce210db3cce073a88911374",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 600,
"payload_entropy": 5.427915364961545,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8143,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "bb9fae31134fa5033913fe5599d99d7a83fa3ecf",
"event_fingerprint": "2391d211bd886be6d716ebe8a4f7df2a38b96096",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "5aa6f53ad5c0599f829e8f639d2a3936",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8143,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "973cc94d1bf95691afa9a1ef3fe7b23550b8cb1a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
8142 · HTTP
Scan de ports
port scan syn · via HTTP:8142 · (reconnaissance)
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8142
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8142
User-Agent: Mozilla/5.0 (Macintosh; Intel M
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8142 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 Accept-Language: en-US,en;q=0.9 Accept-
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "051398cb6a93c68cec88ac5c0721c18ca7e20d77",
"http_host_hash": "7ba1527130ab470e4de6d7f8e26df7bd078f94b2",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "a0dcf3588f13880e4498a658046aa80c8d4090a0",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 637,
"payload_entropy": 5.473505317203679,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8142,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "2c8d607705a37db768dd33fe1ac31c316effc39e",
"event_fingerprint": "2dc5760edeab0e1424cb3bae325e707a32da9aee",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "755ea36ac9ec17f395090852fa4ffe17",
"payload_hash": "8314d5a6192f0f87786f8e57a2149c7d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8142,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5482576982d6cbe723853726bd8ff544b9dc33be",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8142,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8142"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
2068 · HTTP
Scan de ports
port scan syn · via HTTP:2068 · (reconnaissance) · → /blog/wp-json/batch/v1
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /blog/wp-json/batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/blog/wp-json/batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2068
Chemin / cible
/blog/wp-json/batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /blog/wp-json/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /blog/wp-json/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:2068
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
POST /blog/wp-json/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:2068 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection:
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e892378195df50512cd6f344fdcf040308a67711",
"http_target_hash": "854443d48ba9da042f2dc4fca51a3a3b2300d8ff",
"http_referer_hash": "d76822d9dc1b6df7ef2c905112d98fa8c8328e17",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 596,
"payload_entropy": 5.397198394731586,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 2068,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "d8cf006ef20173395607181cf17084e3da7b3776",
"event_fingerprint": "7233ed598c9d40466eed8c40b445d3b7585d04b2",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "63c7aceeacb8a3a6441dbea0e4b0f9d9",
"path_pattern_hash": "c62d68d119c3b98853befa2ad409445c"
},
"target_context": {
"dst_port": 2068,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"method": "POST",
"path": "\/blog\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: ",
"payload_snippet": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "POST",
"path": "\/blog\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: ",
"payload_snippet": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ed1991ea1b82613f70de5377f32ee6f2360ec68",
"protocol_details": {
"http_method": "POST",
"http_path": "\/blog\/wp-json\/batch\/v1",
"request_line": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance) \u00b7 \u2192 \/blog\/wp-json\/batch\/v1",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/blog\/wp-json\/batch\/v1",
"request_line": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance) \u00b7 \u2192 \/blog\/wp-json\/batch\/v1",
"evidence_snippet": "POST \/blog\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_wp_scan",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance)
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connecti
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 561,
"payload_entropy": 5.472673872380926,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "af3b8b3959d2d7d0eeb01f85bb8e74ecf7711a84",
"event_fingerprint": "f46387d3b4056129a4b696d8aa1a13dcc7918d26",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "0eab1a7bf261dc7449baafaa17ac3ef8",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3ac791e6bf02851319969765bb94d10ad512a66",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_header_x-remote-ip",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
16993 · HTTP
Scan de ports
port scan syn · via HTTP:16993 · (reconnaissance)
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
16993
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:16993
User-Agent: Mozilla/5.0 (X11; Linux x86_64
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:16993 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept-Language: en-GB,en;q=0.9 Accept-Encoding: gzip,
Meta JSON brut
{
"http_header_count": 22,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d82905d40b5a90427ca8ec1e23e6d56f2e112b3d",
"http_host_hash": "72527336106ae1a15384684942ea87a431e21082",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "8089a66b073652627faa9b05d438313fbeb20a47",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 827,
"payload_entropy": 5.550905260377316,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "2512902f89d0e4cf9f6e572775297e304a2421f4",
"event_fingerprint": "c92485d55e85f18afe8f8f19103e84fd04b7dc26",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "84ee3de483813401be789de5668c38f8",
"payload_hash": "b0901e0f8f576bc8e1a83504cf004ddd",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 16993,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip,",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip,",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "230b4d20d3f52b76b04f9eb62bfbb5e7d3a6aea4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.43,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
8142 · HTTP
Scan de ports
port scan syn · via HTTP:8142 · (reconnaissance)
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8142
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8142
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8142 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 Accept-Language: en-US,en;q=0.9 Accept-En
Meta JSON brut
{
"http_header_count": 15,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "051398cb6a93c68cec88ac5c0721c18ca7e20d77",
"http_host_hash": "7ba1527130ab470e4de6d7f8e26df7bd078f94b2",
"http_target_hash": "c9c4f3eb57ad2667f354b6f9488055cd78d248e7",
"http_referer_hash": "a0dcf3588f13880e4498a658046aa80c8d4090a0",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 574,
"payload_entropy": 5.509091677739185,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8142,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "dbda4fb7927049f6674184c6fb2dd50179f07e11",
"event_fingerprint": "7adf120687b1bdb956bc933c7e357a63a2b301e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "755ea36ac9ec17f395090852fa4ffe17",
"payload_hash": "2ad78feadaa8db71409f90ab09be8c19",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8142,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-En",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-En",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6944b8a8d7e5d6096d6390429e9d9af4fa584967",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8142,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8142"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.48,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_header_x-forwarded-for",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
2068 · HTTP
Scan de ports
port scan syn · via HTTP:2068 · (reconnaissance) · → /wordpress/wp-json/batch/v1
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /wordpress/wp-json/batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/wordpress/wp-json/batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2068
Chemin / cible
/wordpress/wp-json/batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /wordpress/wp-json/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /wordpress/wp-json/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:2068
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
POST /wordpress/wp-json/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:2068 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connect
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e892378195df50512cd6f344fdcf040308a67711",
"http_target_hash": "2a0301ea6d4b9a0308fe1e0be9c81f7783e65ca3",
"http_referer_hash": "d76822d9dc1b6df7ef2c905112d98fa8c8328e17",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 601,
"payload_entropy": 5.392669191283591,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 2068,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "d8cf006ef20173395607181cf17084e3da7b3776",
"event_fingerprint": "26aed67cf4eeab450e7ec29d696fae9525795269",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "63df73d592aee4f5893cb16b8f9522b4",
"path_pattern_hash": "a133b3ffe28aa9ba82c94df68bb3cd6e"
},
"target_context": {
"dst_port": 2068,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "POST",
"path": "\/wordpress\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnect",
"payload_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "POST",
"path": "\/wordpress\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnect",
"payload_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c727b57342d40d644956b52f617304c1b9893e4b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wordpress\/wp-json\/batch\/v1",
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance) \u00b7 \u2192 \/wordpress\/wp-json\/batch\/v1",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2068,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wordpress\/wp-json\/batch\/v1",
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 2068,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:2068 \u00b7 (reconnaissance) \u00b7 \u2192 \/wordpress\/wp-json\/batch\/v1",
"evidence_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:2068\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "2068 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2068"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.47,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_wp_scan",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:36 UTC
TCP
16993 · HTTP
Scan de ports
port scan syn · via HTTP:16993 · (reconnaissance)
Élevée
Moyen · 63
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950469:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
16993
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:16993
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Requête brute (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:16993 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept-Language: en-GB,en;q=0.9 Accept-Encoding: gzip, d
Meta JSON brut
{
"http_header_count": 17,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d82905d40b5a90427ca8ec1e23e6d56f2e112b3d",
"http_host_hash": "72527336106ae1a15384684942ea87a431e21082",
"http_target_hash": "c9c4f3eb57ad2667f354b6f9488055cd78d248e7",
"http_referer_hash": "8089a66b073652627faa9b05d438313fbeb20a47",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 659,
"payload_entropy": 5.560946084517496,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 16993,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 63,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b591fc30b9c720322b1df57e65c8f7c981699387",
"event_fingerprint": "9cab5b8d12d88f7f820e58855b82bfa94d5cb629",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "84ee3de483813401be789de5668c38f8",
"payload_hash": "022141fbc8884e49ca4c75f77d718c1b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 16993,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) ",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip, d",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36\r\nAccept-Language: en-GB,en;q=0.9\r\nAccept-Encoding: gzip, d",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebb319d2c8e930738ba803ab55418179c34b59ff",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16993,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.0.0 Safari\/537.36",
"port": 16993,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:16993 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:16993\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"target_port_label": "16993 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16993"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.42,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
20150 · HTTP
Scan de ports
port scan syn · via HTTP:20150 · (reconnaissance)
Élevée
Moyen · 64
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
20150
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=/batch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:20150
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
POST /?rest_route=/batch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:20150 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connectio
Meta JSON brut
{
"http_header_count": 15,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "a3221944d56e8f8a3322c881561e9063e2401ea9",
"http_target_hash": "c9c4f3eb57ad2667f354b6f9488055cd78d248e7",
"http_referer_hash": "f5c6d35e58c5a9fa0e3e625167039fac4cc5aada",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 540,
"payload_entropy": 5.452713655476092,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 20150,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "9fb0b81d41a882b4192c170f1bb4cbce0df864e9",
"event_fingerprint": "131f13798a34d57ed722596cd65c16bbb8c30b5e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "c0925c9993da2097aead3f16877a086e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 20150,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnectio",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=\/batch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnectio",
"payload_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30c23dfe5683e9efbb47a9dbc38de4c22f3398b2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 20150,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "port scan syn \u00b7 via HTTP:20150 \u00b7 (reconnaissance)",
"target_port_label": "20150 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 20150,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 20150,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:20150 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=\/batch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:20150\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "20150 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "20150"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_header_x-forwarded-for",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
8143 · HTTP
Scan de ports
port scan syn · via HTTP:8143 · (reconnaissance)
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8143
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8143
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8143 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connecti
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "4533845a46c90ea23265311352052ab71392890e",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "dda84360875d00ab4ce210db3cce073a88911374",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 561,
"payload_entropy": 5.460408721578056,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8143,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "a55ad9dcec33a3bf38b53e6e7b6089b10f6e34ff",
"event_fingerprint": "2391d211bd886be6d716ebe8a4f7df2a38b96096",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "5aa6f53ad5c0599f829e8f639d2a3936",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8143,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6715d74b0ee43db56159ceaa5b1981db8255c1d5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8143,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8143,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8143 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8143\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "8143 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8143"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_header_x-remote-ip",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
8467 · HTTP
Scan de ports
port scan syn · via HTTP:8467 · (reconnaissance)
Élevée
Élevé · 65
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100…
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8467
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cache-poison-forwarded
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8467
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8467 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connecti
Meta JSON brut
{
"http_header_count": 18,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "43c17d549002e46b686fc2b19bfd87f310ddc779",
"http_host_hash": "e574145bf0e002bc516af1f223b8a3ea08ae6f47",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "27326c92c6a7d2628d01bc83a35e825fd6a9ed3f",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 651,
"payload_entropy": 5.456219596705806,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8467,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "8e3d991eb236a11e9e590dd4f3f7c2527bb41c88",
"event_fingerprint": "f46387d3b4056129a4b696d8aa1a13dcc7918d26",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3e3513f21b6ac04b88116697377a3356",
"payload_hash": "0eab1a7bf261dc7449baafaa17ac3ef8",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8467,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-forwarded",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nConnecti",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4298e8372f35687ae3f263dc1626733e985be748",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8467,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko\/20100101 Firefox\/124.0",
"port": 8467,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8467 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8467\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "8467 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8467"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.41,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950586:cache-poison-forwarded",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
1181 · HTTP
Scan de ports
port scan syn · via HTTP:1181 · (reconnaissance) · → /wordpress/wp-json/batch/v1
Élevée
Moyen · 64
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST /wordpress/wp-json/batch/v1 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/wordpress/wp-json/batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
1181
Chemin / cible
/wordpress/wp-json/batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /wordpress/wp-json/batch/v1 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
Payload (extrait)
POST /wordpress/wp-json/batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:1181
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
POST /wordpress/wp-json/batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:1181 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Accept-Language: en-US,en;q=0.9 Accept-Encod
Meta JSON brut
{
"http_header_count": 21,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "323c3d2b24c1d082fca258b6868848bd8e6cb43c",
"http_host_hash": "6ca13b4122eb170756a5ed53a757a137dc3cbe5f",
"http_target_hash": "2a0301ea6d4b9a0308fe1e0be9c81f7783e65ca3",
"http_referer_hash": "b9a4aacb96f0a82dcba055aa26593aa9f2133528",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 776,
"payload_entropy": 5.552544029794906,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 1181,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "8f0af0b0705513ecf60bee98c0bc36df84510e31",
"event_fingerprint": "30ab57ce939a6ae803105c462475f8773bc92478",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4249ae678746308f22ed31a83e768ba7",
"payload_hash": "bf25f7f59c3d0d7a3e37b5548cd7638f",
"path_pattern_hash": "a133b3ffe28aa9ba82c94df68bb3cd6e"
},
"target_context": {
"dst_port": 1181,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "POST",
"path": "\/wordpress\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3"
],
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encod",
"payload_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "POST",
"path": "\/wordpress\/wp-json\/batch\/v1",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3"
],
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encod",
"payload_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fad013809bac28c18673e5fcfc199f3164ab333",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wordpress\/wp-json\/batch\/v1",
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36",
"port": 1181,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "port scan syn \u00b7 via HTTP:1181 \u00b7 (reconnaissance) \u00b7 \u2192 \/wordpress\/wp-json\/batch\/v1",
"target_port_label": "1181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1181,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wordpress\/wp-json\/batch\/v1",
"request_line": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.0.0 Safari\/537.36",
"port": 1181,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:1181 \u00b7 (reconnaissance) \u00b7 \u2192 \/wordpress\/wp-json\/batch\/v1",
"evidence_snippet": "POST \/wordpress\/wp-json\/batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:1181\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "1181 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"http_header_x-forwarded-for",
"http_wp_scan",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
189 · HTTP
Scan de ports
port scan syn · via HTTP:189 · (reconnaissance) · → /wp-json/Batch/v1
Élevée
Moyen · 59
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
MITRE
TA0043
TA0043
Protocole
POST /wp-json/Batch/v1 UA WordPress/6.4.3; https://wordpress.org/
Émulateur
HTTP
WAF
38
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950468:nosqli-3
Cible HTTP
POST
/wp-json/Batch/v1
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
189
Chemin / cible
/wp-json/Batch/v1
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST /wp-json/Batch/v1 HTTP/1.1
User-Agent
WordPress/6.4.3; https://wordpress.org/
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
cms-3
cache-poison-forwarded
Payload (extrait)
POST /wp-json/Batch/v1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:189
User-Agent: WordPress/6.4.3; https://wordpress.org/
Requête brute (extrait)
POST /wp-json/Batch/v1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:189 User-Agent: WordPress/6.4.3; https://wordpress.org/ Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Dnt: 1 Accept: application/json, text/p
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "e67d2ab1472cbbe53366892816cca51c7cb888e1",
"http_host_hash": "ad87aaa3220137ffdbcbc5d689c3883ddd06a36e",
"http_target_hash": "bb7cf68be391311aa9412d0a0057b42d1b90b4e8",
"http_referer_hash": "90c1a14db5f4602f1bcde0d7ba51e78f70991f88",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 547,
"payload_entropy": 5.329902377583808,
"port_category": "well_known",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 189,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "70b8005bb72cf012c5edf9aa484fb32626e3143d",
"event_fingerprint": "f056e92d6aba9a93a6859ad975a09f404fe9a883",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "419988f1780049abf491f9154374852e",
"payload_hash": "283f9384e164530f24ce7aff5f841728",
"path_pattern_hash": "016beb137830bc56d82e7885000dd62f"
},
"target_context": {
"dst_port": 189,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/\r\n",
"method": "POST",
"path": "\/wp-json\/Batch\/v1",
"user_agent": "WordPress\/6.4.3; https:\/\/wordpress.org\/",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close\r\nDnt: 1\r\nAccept: application\/json, text\/p",
"payload_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/",
"evidence": {
"method": "POST",
"path": "\/wp-json\/Batch\/v1",
"user_agent": "WordPress\/6.4.3; https:\/\/wordpress.org\/",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cms-3",
"cache-poison-forwarded"
],
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"request_sample": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br\r\nConnection: close\r\nDnt: 1\r\nAccept: application\/json, text\/p",
"payload_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "060e651137f6114fe85387e5922ee827235ec94d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/Batch\/v1",
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"http_user_agent": "WordPress\/6.4.3; https:\/\/wordpress.org\/",
"port": 189,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/",
"attack_vector": "port scan syn \u00b7 via HTTP:189 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/Batch\/v1",
"target_port_label": "189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 189,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/wp-json\/Batch\/v1",
"request_line": "POST \/wp-json\/Batch\/v1 HTTP\/1.1",
"http_user_agent": "WordPress\/6.4.3; https:\/\/wordpress.org\/",
"port": 189,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:189 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/Batch\/v1",
"evidence_snippet": "POST \/wp-json\/Batch\/v1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:189\r\nUser-Agent: WordPress\/6.4.3; https:\/\/wordpress.org\/",
"target_port_label": "189 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "189"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950505:cms-3",
"950586:cache-poison-forwarded",
"http_cache_poison_header",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_probe_wp_json",
"http_wp_scan",
"http_xff_chain",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}
05/08/2026 23:10:35 UTC
TCP
8142 · HTTP
Scan de ports
port scan syn · via HTTP:8142 · (reconnaissance)
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605…
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950406:ssrf-3
950469:nosqli-3
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8142
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15
Règles WAF
rce-0
ssrf-2
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1
Content-Length: 16
Host: 62.3.50.33:8142
User-Agent: Mozilla/5.0 (Macintosh; Intel M
Requête brute (extrait)
POST /?rest_route=%2Fbatch%2Fv1 HTTP/1.1 Content-Length: 16 Host: 62.3.50.33:8142 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 Accept-Language: en-US,en;q=0.9 Accept-
Meta JSON brut
{
"http_header_count": 16,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "051398cb6a93c68cec88ac5c0721c18ca7e20d77",
"http_host_hash": "7ba1527130ab470e4de6d7f8e26df7bd078f94b2",
"http_target_hash": "92fbcfec8a079c82e8c85a1a882fbdd6472d5790",
"http_referer_hash": "a0dcf3588f13880e4498a658046aa80c8d4090a0",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 598,
"payload_entropy": 5.492919578427149,
"port_category": "registered",
"org": "DIGI VPS",
"service": "http",
"app_proto": "http",
"asn": 142430,
"country": "US",
"dst_port": 8142,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "f996fbfd7b8ee94798037798326e180d53bbc5a2",
"event_fingerprint": "2dc5760edeab0e1424cb3bae325e707a32da9aee",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 142430,
"org": "DIGI VPS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "755ea36ac9ec17f395090852fa4ffe17",
"payload_hash": "8314d5a6192f0f87786f8e57a2149c7d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8142,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"evidence": {
"method": "POST",
"path": "\/",
"query_string": "rest_route=%2Fbatch%2Fv1",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"request_sample": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-",
"payload_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "674f114895f8db623662ddd6ef57725cc2f9f47b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8142,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.4 Safari\/605.1.15",
"port": 8142,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8142 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/?rest_route=%2Fbatch%2Fv1 HTTP\/1.1\r\nContent-Length: 16\r\nHost: 62.3.50.33:8142\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M",
"target_port_label": "8142 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8142"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
189,
1181,
2068,
4104,
8142,
8143,
8467,
12559,
16993,
19222,
20150,
22222
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950406:ssrf-3",
"950469:nosqli-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_cache_poison_header",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-real-ip",
"http_header_x-remote-ip",
"http_xff_loopback",
"net_flood"
],
"asn_dc_heuristic": true
}