|
|
TCP |
8089 · SPLUNK
|
splunk
|
Scan de ports
port scan syn · via SPLUNK:8089 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "splunk",
"app_proto": "splunk",
"asn": 63737,
"country": "VN",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "d915aac24b4c7187019701bf04b0f00c4b9a9a75",
"event_fingerprint": "00e61faeb05bf25fb6c40c4257543ce914eaf37e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "splunk",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63ce03e990f405f320037580dbce0d16688cbb56",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPLUNK \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.18,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8008
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "a28ee42f678c3e5508e2164d464b5b84c4873293",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.208101766386929,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8008,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abf21a6da8d8f21c105120f38068a4a96497640b",
"event_fingerprint": "b5330203b8548c9ac315f8154fa8017925b2fd3a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a57a6d5df48a9589649beb516d8b47d9",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=JMNHspbPwZI7lAxNyD3bDLO9",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=JMNHspbPwZI7lAxNyD3bDLO9",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c867a5aecf0a3a93a0f287252a032fe950f78937",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
"target_port_label": "8008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8008,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=JMNHspbPwZI7lAxNyD3bDLO9 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.07,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8088 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8088 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8088
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "d0f14760c4f49c354defee19b0066453e9a46171",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.160810791587439,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8088,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "668e3cacf6ff2ec0b961df244c0806491cb52634",
"event_fingerprint": "1feaa25b5ab6a94218d6a707c078cf1d3c23926f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "421d9690c7eea5b4081eaa65406905dc",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8088,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=yYKSMr2nD3cWlG0QCVZjQTrQ",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=yYKSMr2nD3cWlG0QCVZjQTrQ",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf1e878fb307eef4c5afb2b8d14970a43971fcf5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8088,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8088 \u00b7 (reconnaissance)",
"target_port_label": "8088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8088,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8088,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8088 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=yYKSMr2nD3cWlG0QCVZjQTrQ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.04,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
8084 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8084 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8084
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "30876b064d05d46402e987239ac1c18bd101c4fb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.05152061133058,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8084,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0c9d30297120f8bfc5c6edaf25ad6c427360aff7",
"event_fingerprint": "bf98298e14c3005132d07802f5af53db81ed25c5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a8ad9121002a16d3cc35c4fadb9dae27",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8084,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=Zl8q4TdziE-_v4ZPZYT-_8ew",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=Zl8q4TdziE-_v4ZPZYT-_8ew",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e56d81a97529b0f01fb783112abdb29135c1344",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8084,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8084 \u00b7 (reconnaissance)",
"target_port_label": "8084 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8084,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8084,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8084 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Zl8q4TdziE-_v4ZPZYT-_8ew HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8084 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.03,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8082 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8082 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8082
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "11e5b27ad869ef84cc57e689417796b3982e38e5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.127927956772048,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8082,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "efe035383e5aa756d4dc0a781e38210e229b14a9",
"event_fingerprint": "7d4cada32adef2b80d91669d56f36203e67e2a81",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b58b970d928507ae3972e75642c914e3",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8082,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=A6RCb88RN5fFkcHkUrtGy0aS",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=A6RCb88RN5fFkcHkUrtGy0aS",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c4f6ea2b9f9db5a6f848ca344cd30aa70fc7fc2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)",
"target_port_label": "8082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8082,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=A6RCb88RN5fFkcHkUrtGy0aS HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "4e0dd87c2f24c8c8d51cadaa72d5c62398d13d8c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.159873991023183,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 7001,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "041ffcd401d4a76867e0f4781887d37cca75db81",
"event_fingerprint": "4ef3cd7f658d27c4ddf21c1a1b2ac2dced957d75",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "e08d110b3d37ff298e51da6fd73e21eb",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=FUVO9qGmA3oPBug3ovk-74bL",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=FUVO9qGmA3oPBug3ovk-74bL",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a45f26833593ae39268f4db1c1066ed8a0daee0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=FUVO9qGmA3oPBug3ovk-74bL HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "9af24176c5a6313d7dd0d64fa9b6ef1ef1b11cd4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.163246616198616,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8089,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "05ebfb38cdaa85708f87f0204c5984d2b066a6a1",
"event_fingerprint": "ec90fddbcc6df038440fc1d9f6747a7a0cdee0cf",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c8d61d8b2b6888acf3c3df39106d1088",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=SfYemu01yZjT_MnCAQdfNtVb",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=SfYemu01yZjT_MnCAQdfNtVb",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6b57130d1a9035b9c8ef70f3ab3d014e4eea321",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=SfYemu01yZjT_MnCAQdfNtVb HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
7001 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:7001 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7001
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "07b432673fc1e274d1e6b19fa38150288b10f111",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.138136959016004,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 7001,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "041ffcd401d4a76867e0f4781887d37cca75db81",
"event_fingerprint": "5336c588a093ba3e216f608160b80595593fba66",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a45edcd3b7555ca53a6e6717c8ffd572",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 7001,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=vFyFuVP6F0iUQvc8MYtOfX-l",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=vFyFuVP6F0iUQvc8MYtOfX-l",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64eb30bf7a1035124ebf7c3511fea2d8c91415ba",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 7001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:7001 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vFyFuVP6F0iUQvc8MYtOfX-l HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "7001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.45,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "c9f837237e34157f3d8edda406d98f778dfdfb74",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.136126608259815,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8089,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "05ebfb38cdaa85708f87f0204c5984d2b066a6a1",
"event_fingerprint": "b74d364f19bee043acb2ee32092d6ef5cc169e85",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "5882d8f4852cbca17b83e44b2534b28d",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=dst_imvFZbf3BWTU5JWeBHYZ",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=dst_imvFZbf3BWTU5JWeBHYZ",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c16ed0bd90ea53e9edd225dc3142023f4490e6c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=dst_imvFZbf3BWTU5JWeBHYZ HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
GET http://oracle.vanhoang.id.vn:18451/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent:
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 218,
"payload_entropy": 5.1042924464297394,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9245f32461d6e15a9f68e2f73d7642221c48010f",
"event_fingerprint": "66de93e93356302b7cdade60cabf69b7305865e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0600"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0103",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d6085712f48367d17489484744697cf",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df6bc28b79254ec8b7b1e946e984e0e37d9ab5cf",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=-GfK_AjyKLnmPp3PGIIipg6C HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 2.02,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"websphere_probe"
]
}
|
|
|
TCP |
8008 · HTTP ALT 8008
|
http-alt-8008
|
Scan de ports
port scan syn · via HTTP ALT 8008:8008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8008
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8008
Chemin / cible
—
Service
HTTP ALT 8008
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8008",
"app_proto": "http-alt-8008",
"asn": 63737,
"country": "VN",
"dst_port": 8008,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "8fa9ad29be14ca77c9253944e1dd2808809cf2a5",
"event_fingerprint": "1b07f7b55628f9da9889c4eaa80386e1f3d7e234",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8008",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8008,
"service": "http-alt-8008",
"service_name": "http-alt-8008",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bb0f34f3ddf8eb3d939403308c0dcf6600b0053",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8008,
"service": "http-alt-8008",
"service_label_fr": "HTTP ALT 8008"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8008:8008 \u00b7 (reconnaissance)",
"target_port_label": "8008 \u00b7 HTTP ALT 8008",
"emulator_service": "http-alt-8008",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8008 \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8008",
"service_label_fr": "HTTP ALT 8008",
"dst_port": 8008,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8008",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8008,
"service": "http-alt-8008",
"service_label_fr": "HTTP ALT 8008"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8008:8008 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8008 \u00b7 HTTP ALT 8008",
"emulator_service": "http-alt-8008",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8008",
"service_banner": "honeypot-http-alt-8008",
"service_os": "linux",
"dst_port": "8008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
GET http://oracle.vanhoang.id.vn:18451/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent:
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 218,
"payload_entropy": 5.117811840315773,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9acc5b3bdfe39add3f9ff589870febf3438dd603",
"event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9d685a4892ac3db3a3bfbe821596bde",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef7d7207e3fecdca49c1058fe74e7a2e53c577f5",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=loLxPuJjjrUGHuFeVSRAAYxj HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.24,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "a0b960e821f5594f25beb2c2942fd8ed872c88aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.175217926655962,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 9002,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1427e85f780482d770f59d496ec00c56b3ac5680",
"event_fingerprint": "eea1ca2f84f740473a5a46db4de6ef687837426b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a1205a8344332f934332e9ee86d08300",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=R-2RmFXoBLViJ6yT-ZMofd2u",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=R-2RmFXoBLViJ6yT-ZMofd2u",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14083ce7fa41993b8978c47c8c945fc234a3bdec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=R-2RmFXoBLViJ6yT-ZMofd2u HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8889 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8889
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "d9175590418d706152aba74856c4f76cbfb30d6b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.139801377476299,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8889,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "2a2da08eaa95abdd509cac9f26c112b3871cea20",
"event_fingerprint": "fcd0d6d4ea0d743fdf72c56101b00cbac9503301",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "fd19683ec2db6978a5dc3ce296aa60c2",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=8KRHc2YtYtwBC8yRr7hL3KM3",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=8KRHc2YtYtwBC8yRr7hL3KM3",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5c034a328576caf58e3656d26dc1fe30fdad37d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8889 \u00b7 (reconnaissance)",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8889 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=8KRHc2YtYtwBC8yRr7hL3KM3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 10,
"scan_velocity_ports_per_s": 2.23,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8088 · HTTP ALT 8088
|
http-alt-8088
|
Scan de ports
port scan syn · via HTTP ALT 8088:8088 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8088
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8088
Chemin / cible
—
Service
HTTP ALT 8088
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8088",
"app_proto": "http-alt-8088",
"asn": 63737,
"country": "VN",
"dst_port": 8088,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4ca10c74a5be7d27a692e0f0751b8541c0a09843",
"event_fingerprint": "d2258c613dacf1d3a6383f9a084716b29d5b7d2f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8088",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8088,
"service": "http-alt-8088",
"service_name": "http-alt-8088",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86c3a3e50f4299b429a21de4ba0e7406fe24629f",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8088,
"service": "http-alt-8088",
"service_label_fr": "HTTP ALT 8088"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8088:8088 \u00b7 (reconnaissance)",
"target_port_label": "8088 \u00b7 HTTP ALT 8088",
"emulator_service": "http-alt-8088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8088 \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8088",
"service_label_fr": "HTTP ALT 8088",
"dst_port": 8088,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8088",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8088,
"service": "http-alt-8088",
"service_label_fr": "HTTP ALT 8088"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8088:8088 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8088 \u00b7 HTTP ALT 8088",
"emulator_service": "http-alt-8088",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8088",
"service_banner": "honeypot-http-alt-8088",
"service_os": "linux",
"dst_port": "8088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 2.45,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8084 · HTTP ALT 8084
|
http-alt-8084
|
Scan de ports
port scan syn · via HTTP ALT 8084:8084 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8084
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8084
Chemin / cible
—
Service
HTTP ALT 8084
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8084",
"app_proto": "http-alt-8084",
"asn": 63737,
"country": "VN",
"dst_port": 8084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "98db86e15578a232bb2feb512faa62508ebb1e55",
"event_fingerprint": "9fc541ca5c19c906c01af9a9e3daaa9d695a1916",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8084",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8084,
"service": "http-alt-8084",
"service_name": "http-alt-8084",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e0f794a57a903fd1545c64ae749a9f69a4f290e",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8084,
"service": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)",
"target_port_label": "8084 \u00b7 HTTP ALT 8084",
"emulator_service": "http-alt-8084",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8084 \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084",
"dst_port": 8084,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8084",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8084,
"service": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8084 \u00b7 HTTP ALT 8084",
"emulator_service": "http-alt-8084",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8084",
"service_banner": "honeypot-http-alt-8084",
"service_os": "linux",
"dst_port": "8084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.67,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
3128 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3128 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3128
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "05bd26cba9c77ca9f42794f0204bb259dc272448",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.112674748614693,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 3128,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "77786e0da768d61ec50e978084977d88d8ea0979",
"event_fingerprint": "77375b0e0da737f734f36101c250025b0154a2d1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "439e912fe0f9220041185a9d02de7eef",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=NN3zvEsI1XiUBiq_gRp1RBSf",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=NN3zvEsI1XiUBiq_gRp1RBSf",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5b10a767489b96d0497c5941532deafde98b8dc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NN3zvEsI1XiUBiq_gRp1RBSf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 2.63,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8082 · HTTP ALT 8082
|
http-alt-8082
|
Scan de ports
port scan syn · via HTTP ALT 8082:8082 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8082
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8082
Chemin / cible
—
Service
HTTP ALT 8082
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8082",
"app_proto": "http-alt-8082",
"asn": 63737,
"country": "VN",
"dst_port": 8082,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "532a8490dea2570c14b63185626afd070b2ef0f6",
"event_fingerprint": "754fe1c1fd27dff7b9653c1ba3c9f4252e86ae83",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8082",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8082,
"service": "http-alt-8082",
"service_name": "http-alt-8082",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c528439493f6c153448a77e49fe6e015485f733a",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8082,
"service": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)",
"target_port_label": "8082 \u00b7 HTTP ALT 8082",
"emulator_service": "http-alt-8082",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8082 \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082",
"dst_port": 8082,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8082",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8082,
"service": "http-alt-8082",
"service_label_fr": "HTTP ALT 8082"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8082:8082 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8082 \u00b7 HTTP ALT 8082",
"emulator_service": "http-alt-8082",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8082",
"service_banner": "honeypot-http-alt-8082",
"service_os": "linux",
"dst_port": "8082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.84,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8008 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8008 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8008
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "3a8dfc8420468e986883d894cdc2f56140a70ac4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.111568934882158,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8008,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "abf21a6da8d8f21c105120f38068a4a96497640b",
"event_fingerprint": "87ae704fe0bb8ffd5120709c3ebb401f3fe8ae61",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "44651dca4187a18d1cab53836a93e42c",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8008,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=HKHNSlwzHJmeByStlmYfUc5h",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=HKHNSlwzHJmeByStlmYfUc5h",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d3fb1139ddbd586992859cd0f5c038b80183a84f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
"target_port_label": "8008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8008,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=HKHNSlwzHJmeByStlmYfUc5h HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.65,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
GET http://oracle.vanhoang.id.vn:18451/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent:
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 218,
"payload_entropy": 5.125460830716721,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "9245f32461d6e15a9f68e2f73d7642221c48010f",
"event_fingerprint": "66de93e93356302b7cdade60cabf69b7305865e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103",
"pat-0600"
],
"matched_pattern_names": [
"LFI Double-dot bypass",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0103",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "42acf96684e81c56cd8946539db32267",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cbb4edcaedc4f44db646c0435d9a092d2c06fab",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NdnQ816zJcSquxylZqoexDb4 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.65,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"websphere_probe"
]
}
|
|
|
TCP |
9002 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "4c134464b49e1c38f90aa98f8d2ab8edac594476",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.189295044046977,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 9002,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "1427e85f780482d770f59d496ec00c56b3ac5680",
"event_fingerprint": "891b288d2b1eeaa78980b451200b1748b715cb7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b8ccf5a65e4b67a74b005f807f868e36",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=NENqKXWPxpAF0SDOOq0ZTN-6",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=NENqKXWPxpAF0SDOOq0ZTN-6",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "213114f3eb50def98fbd808f62e4f7cc359c7e05",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9002 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=NENqKXWPxpAF0SDOOq0ZTN-6 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.64,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8889 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8889
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "4aebdd7fc41fc1c52fcc20f28dd0a8ea7a1cba43",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.026297943846544,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8889,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "2a2da08eaa95abdd509cac9f26c112b3871cea20",
"event_fingerprint": "f62ab9f04dc6b24615d54992221c37fe17d32f02",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "4b5cc483bcc4dc48beaf50397415d992",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=TZqnP1LVzjUnppc3PW8iglVp",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=TZqnP1LVzjUnppc3PW8iglVp",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56d945d2578d8603e0adbb9d84cd1dd2114cd6fb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8889 \u00b7 (reconnaissance)",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8889 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=TZqnP1LVzjUnppc3PW8iglVp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.64,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
GET http://oracle.vanhoang.id.vn:18451/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent:
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 218,
"payload_entropy": 5.067464118394779,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9acc5b3bdfe39add3f9ff589870febf3438dd603",
"event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e3c1e9ac2b91d78148a270717578e2b6",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c20485f39efb21cf9bb1e89b868b3e2404a8f47a",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nleH66uGp9lrjOY7dO3O5Tez HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.64,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8088 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8088 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8088
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "d7e270a55f9633515b5f1b5d3dffd2821c905c28",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.196723757773566,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8088,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "668e3cacf6ff2ec0b961df244c0806491cb52634",
"event_fingerprint": "71d70a9a3e5b742952a3a3d713eb09c0238858f6",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "f93f8cc2aa87d26219567c86136b2f46",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8088,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=qoNcWIXRObUbKPFQokDJQ8xF",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=qoNcWIXRObUbKPFQokDJQ8xF",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c7c8d0128d3e51a5bf9e1f16e5f2a15a171078b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8088,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8088 \u00b7 (reconnaissance)",
"target_port_label": "8088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8088,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8088,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8088 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=qoNcWIXRObUbKPFQokDJQ8xF HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8088 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8088"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.62,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8084 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8084 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8084
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "728724d5d799aeb96085f95b400654dfd3672cdb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.098658495757373,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8084,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0c9d30297120f8bfc5c6edaf25ad6c427360aff7",
"event_fingerprint": "9cc31c693cc04721b9ee1c0d728cf9f5695f17de",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "be7d11004ba48d4a3ad1d9ce94305c79",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8084,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=ij3u02AdAqQooVfHAi82HyKr",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=ij3u02AdAqQooVfHAi82HyKr",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd4c4cd50b47d659b385c14ec83162235c2a85e0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8084,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8084 \u00b7 (reconnaissance)",
"target_port_label": "8084 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8084,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8084,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8084 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=ij3u02AdAqQooVfHAi82HyKr HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8084 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
3128 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:3128 · (reconnaissance)
|
Élevée
|
Moyen · 44
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
3128
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 44
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "a0748feb4a990776a72157124a76fbdc02327c31",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.063820402950784,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 3128,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "77786e0da768d61ec50e978084977d88d8ea0979",
"event_fingerprint": "d1ef8d5f0e498b1dff6844c227dd89631bb326ba",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "26be2a3bed14f0ab9b2b1c1ba42a1283",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 3128,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=avP0K1CE5Lv1TonXkbbK9Uij",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=avP0K1CE5Lv1TonXkbbK9Uij",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "974db139132db2c12e57f413c622e5ed8f664783",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 3128,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:3128 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=avP0K1CE5Lv1TonXkbbK9Uij HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "3128 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.6,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8082 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8082 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8082
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "815c6799d88706d9fb8bcd33106f2dd58b72de3e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.158056512164064,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8082,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "efe035383e5aa756d4dc0a781e38210e229b14a9",
"event_fingerprint": "2c945a637db773474f3990684f63a3ebbad13973",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "d6060a21c7c54878d4dd8b6d1f17f83a",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8082,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=OCi46X289sr9XHw3GYhOFBxC",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=OCi46X289sr9XHw3GYhOFBxC",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43b2814a948109e31b208c75548e3929484cd04f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8082,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)",
"target_port_label": "8082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8082,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8082,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8082 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=OCi46X289sr9XHw3GYhOFBxC HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8082 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8082"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 2.61,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
7001 · WEBLOGIC
|
weblogic
|
Scan de ports
port scan syn · via WEBLOGIC:7001 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
WEBLOGIC
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
weblogic_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7001
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
"emulator_response_len": 177,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "weblogic",
"app_proto": "weblogic",
"asn": 63737,
"country": "VN",
"dst_port": 7001,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1a20f7535d93f3cc473706f9e4bb02950cbeee86",
"event_fingerprint": "6f7c2121a7e056fb57bd2523bd43bf2060a47b5e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "weblogic",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 7001,
"service": "weblogic",
"service_name": "weblogic",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e21c96bc9ef638815016d81c2a58599bce392efa",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "port scan syn \u00b7 via WEBLOGIC:7001 \u00b7 (reconnaissance)",
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WEBLOGIC \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "weblogic",
"service_label_fr": "WEBLOGIC",
"dst_port": 7001,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-weblogic",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 7001,
"service": "weblogic",
"service_label_fr": "WEBLOGIC"
},
"attack_vector": "port scan syn \u00b7 via WEBLOGIC:7001 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "7001 \u00b7 WEBLOGIC",
"emulator_service": "weblogic",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "weblogic",
"service_banner": "honeypot-weblogic",
"service_os": "linux",
"dst_port": "7001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 14,
"scan_velocity_ports_per_s": 2.8,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting",
"weblogic_emulated"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
socks5_greeting
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "50c615665e68abca1c5008da5c07e228b2cccdba",
"event_fingerprint": "66de93e93356302b7cdade60cabf69b7305865e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0600"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6fac102902e91a7db174e1e3192b9e4c0e2c807d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 5,
"scan_velocity_ports_per_s": 1.14,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"socks5_greeting",
"websphere_probe"
]
}
|
|
|
TCP |
3128 · SQUID
|
squid
|
Scan de ports
port scan syn · via SQUID:3128 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SQUID
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
squid_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3128
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e31203430372050726f78792041757468656e7469636174696f6e2052657175697265640d0a50726f78792d41757468656e7469636174653a204261736963207265616c6d3d227371756964220d0a436f6e74656e742d4c656e6774683a2034360d0a0d0a3c68746d6c3e3c626f64793e53717569642070726f",
"emulator_response_len": 153,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "squid",
"app_proto": "squid",
"asn": 63737,
"country": "VN",
"dst_port": 3128,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "15ca89b633d18727453f90e7a661eb0f63be227c",
"event_fingerprint": "e4052446aafc30e0d58f241bc668d49bd3854faa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "squid",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 3128,
"service": "squid",
"service_name": "squid",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d19692cbc6ec4b6d298a84f8b3cf0cfe7703fecb",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"attack_vector": "port scan syn \u00b7 via SQUID:3128 \u00b7 (reconnaissance)",
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SQUID \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "squid",
"service_label_fr": "SQUID",
"dst_port": 3128,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-squid",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3128,
"service": "squid",
"service_label_fr": "SQUID"
},
"attack_vector": "port scan syn \u00b7 via SQUID:3128 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "3128 \u00b7 SQUID",
"emulator_service": "squid",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "squid",
"service_banner": "honeypot-squid",
"service_os": "linux",
"dst_port": "3128"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 6,
"scan_velocity_ports_per_s": 1.3,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting",
"squid_emulated"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b834661bef8c6b1e12ba72c0636a3e5f81884b1d",
"event_fingerprint": "ebbf50493a5cd01037444d3e811aea60318e67dd",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bdb87666744dc737bcdada9d84ce607337e7fbd",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 7,
"scan_velocity_ports_per_s": 1.52,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
9002 · MINIO CONSOLE
|
minio-console
|
Scan de ports
port scan syn · via MINIO CONSOLE:9002 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
MINIO-CONSOLE
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9002
Chemin / cible
—
Service
MINIO CONSOLE
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "minio-console",
"app_proto": "minio-console",
"asn": 63737,
"country": "VN",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3caf94721042f00e9fe65ef6637ad791a31cf933",
"event_fingerprint": "1ecc4a8cf9348bc993033dc2db3257374f3e4996",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "minio-console",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9002,
"service": "minio-console",
"service_name": "minio-console",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0f0962a9eb1cf1eb9205c243ddb038a6341df65",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "port scan syn \u00b7 via MINIO CONSOLE:9002 \u00b7 (reconnaissance)",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via MINIO CONSOLE \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "minio-console",
"service_label_fr": "MINIO CONSOLE",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minio-console",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "port scan syn \u00b7 via MINIO CONSOLE:9002 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minio_console",
"service_banner": "honeypot-minio-console",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 8,
"scan_velocity_ports_per_s": 1.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8889 · SPLUNK HEC
|
splunk-hec
|
Scan de ports
port scan syn · via SPLUNK HEC:8889 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SPLUNK-HEC
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8889
Chemin / cible
—
Service
SPLUNK HEC
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "splunk-hec",
"app_proto": "splunk-hec",
"asn": 63737,
"country": "VN",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5330dcf0cd36e7cd05aeef91186c226d0f28d2fa",
"event_fingerprint": "d42b7ff477aa60f5c716cd2d708f643826e6162a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "splunk-hec",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8889,
"service": "splunk-hec",
"service_name": "splunk-hec",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3de11437500f7ac308e75f14decf66db736a274b",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8889,
"service": "splunk-hec",
"service_label_fr": "SPLUNK HEC"
},
"attack_vector": "port scan syn \u00b7 via SPLUNK HEC:8889 \u00b7 (reconnaissance)",
"target_port_label": "8889 \u00b7 SPLUNK HEC",
"emulator_service": "splunk-hec",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPLUNK HEC \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "splunk-hec",
"service_label_fr": "SPLUNK HEC",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk-hec",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8889,
"service": "splunk-hec",
"service_label_fr": "SPLUNK HEC"
},
"attack_vector": "port scan syn \u00b7 via SPLUNK HEC:8889 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8889 \u00b7 SPLUNK HEC",
"emulator_service": "splunk-hec",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk_hec",
"service_banner": "honeypot-splunk-hec",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 9,
"scan_velocity_ports_per_s": 1.95,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
5987 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5987 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5987
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "b81ca5e9eece6286e7b90ef27885c9bf18d4635b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.135277602973038,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 5987,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e7f22da91167c0a5ebf29a4d8027168680a67118",
"event_fingerprint": "691f803ad90db521e60ec2893a9fae716ebf38a3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "d762267f0253908b57cb091d1d70f074",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 5987,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=vJ-_5bs9t2LNOJlFw1PGAz8M",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=vJ-_5bs9t2LNOJlFw1PGAz8M",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "013c577169505e94d75d0033ecd81e1a3744f48f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5987,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:5987 \u00b7 (reconnaissance)",
"target_port_label": "5987 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5987,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5987,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5987 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=vJ-_5bs9t2LNOJlFw1PGAz8M HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "5987 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5987"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.3,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
5987 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5987 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5987
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "ae1fe7e379f66588624a91a60c13898f491fe3aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.1153120030839005,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 5987,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "e7f22da91167c0a5ebf29a4d8027168680a67118",
"event_fingerprint": "da967982f55b22b8edd7d569fea6139654a0783f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0e59fa6e2023fa5259f87cb930dd1d99",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 5987,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=znvzw8LqOL_1mH5yV2lrPzKt",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=znvzw8LqOL_1mH5yV2lrPzKt",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e588f420522aa6c55e49b352c25b56f6b3ac1ab",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5987,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:5987 \u00b7 (reconnaissance)",
"target_port_label": "5987 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5987,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 5987,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5987 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=znvzw8LqOL_1mH5yV2lrPzKt HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "5987 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5987"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 3.92,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8004 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8004 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8004
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "a68f4c157dbbef745d25a4c9e0ae20210adea570",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.145579924591519,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8004,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bd32e73209c387f48e69353f595e54e3363aea17",
"event_fingerprint": "0cc691a0ab21086b9e5a61f7d0521c703cfb8a19",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "8727f043f96c76382da0f38ff5c4013e",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8004,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=0BaclhyKaxXDbtwHQGbIJVcf",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=0BaclhyKaxXDbtwHQGbIJVcf",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "074040638537d27f0fc67a8b82e7c7a526e928a7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8004,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
"target_port_label": "8004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8004,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8004,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=0BaclhyKaxXDbtwHQGbIJVcf HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 5.39,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9999 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9999 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9999
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "bc8fce48e6df49b04b4665fc099b83c3e4f8051f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.141665469020184,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 9999,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a06c1f05cdadb43f98fd4a10df9e1876f0c0633",
"event_fingerprint": "a0d153c6bc5987dc0227affef9fcea7988668e1d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "74cd6a12cc30643559c0bbde8161af65",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=KX-Im7AjZYf8mwTcptyDyKut",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=KX-Im7AjZYf8mwTcptyDyKut",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "10a381709f38fe1bedd1815b9c20ada1d3ff1ea2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=KX-Im7AjZYf8mwTcptyDyKut HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 5.36,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8111 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8111 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8111
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "7a0b7fb7ec6b1c09d7034e966e041b5e2e0faf86",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.107901322558293,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8111,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "41e7b44cba09952114dff96623a61081c6d0baa2",
"event_fingerprint": "7b85be03f1a391e2ab8e1ddef22a7fe0ceac630a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c99e3e8aa6e98f0a70ade65e4efdf3f1",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8111,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=nqxjRfSN7howNb87a7h-UL71",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=nqxjRfSN7howNb87a7h-UL71",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8103ded1a9b929cbf8d583617ad6e3e7c949ae64",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8111 \u00b7 (reconnaissance)",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8111 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=nqxjRfSN7howNb87a7h-UL71 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 5.31,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
5987 · WINRM HTTP
|
winrm-http
|
Scan de ports
port scan syn · via WINRM HTTP:5987 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
WINRM-HTTP
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5987
Chemin / cible
—
Service
WINRM HTTP
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "winrm-http",
"app_proto": "winrm-http",
"asn": 63737,
"country": "VN",
"dst_port": 5987,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "86127e971ff10eb2334a47bfb1b915fa20a9f127",
"event_fingerprint": "80958dd67ffad684356a8da0c38297e7b5b783e5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "winrm-http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 5987,
"service": "winrm-http",
"service_name": "winrm-http",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e1d5095ea1f14060ae062d22a2f2c7b5dd8f082",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5987,
"service": "winrm-http",
"service_label_fr": "WINRM HTTP"
},
"attack_vector": "port scan syn \u00b7 via WINRM HTTP:5987 \u00b7 (reconnaissance)",
"target_port_label": "5987 \u00b7 WINRM HTTP",
"emulator_service": "winrm-http",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via WINRM HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "winrm-http",
"service_label_fr": "WINRM HTTP",
"dst_port": 5987,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-winrm-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 5987,
"service": "winrm-http",
"service_label_fr": "WINRM HTTP"
},
"attack_vector": "port scan syn \u00b7 via WINRM HTTP:5987 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "5987 \u00b7 WINRM HTTP",
"emulator_service": "winrm-http",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "winrm_http",
"service_banner": "honeypot-winrm-http",
"service_os": "linux",
"dst_port": "5987"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 4.44,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
9999 · ADMIN ALT
|
admin-alt
|
Scan de ports
port scan syn · via ADMIN ALT:9999 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ADMIN-ALT
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9999
Chemin / cible
—
Service
ADMIN ALT
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "admin-alt",
"app_proto": "admin-alt",
"asn": 63737,
"country": "VN",
"dst_port": 9999,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "3a9bc78674850dbbea1d8ebbdceec7559985457b",
"event_fingerprint": "2cfee02dc5cd3fc25c2a80133168adbf503e7198",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "admin-alt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9999,
"service": "admin-alt",
"service_name": "admin-alt",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cacd99f150ec4f5e7192cdb8960bdd41f0dae62d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)",
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ADMIN ALT \u2014 multi-protocole (14 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "admin-alt",
"service_label_fr": "ADMIN ALT",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-admin-alt",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "admin_alt",
"service_banner": "honeypot-admin-alt",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 6.49,
"multi_protocol_correlation": true,
"multi_protocol_count": 14,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8111 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8111 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8111
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "665df44559114c0dd788fc4e19d2cc6cc2798d84",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.188744383429629,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8111,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "41e7b44cba09952114dff96623a61081c6d0baa2",
"event_fingerprint": "79d72864d550ac8066e95f7b3715968115aaef5c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "f830b5e1801df4bfac2e50635c7ce6fc",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8111,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=F41a2DM3bCvx_0v7P_xG6mVK",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=F41a2DM3bCvx_0v7P_xG6mVK",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9043c89afdc4142c07cae36910027f1fcb9ceaa3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8111 \u00b7 (reconnaissance)",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8111 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=F41a2DM3bCvx_0v7P_xG6mVK HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 6.4,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8004 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8004 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8004
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "d950dd2269b1d9f9a17f99236b0abccbcf899fdd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.089027578322552,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 8004,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "bd32e73209c387f48e69353f595e54e3363aea17",
"event_fingerprint": "3883293ebcb9728da7fd9aef59ebb4a34a124b3b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "7c9e3bf4c58e9ef7e5539514b77a4d2d",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 8004,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=6UZsiVZhtnXvur7Mez43c6R3",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=6UZsiVZhtnXvur7Mez43c6R3",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c72c4b4d7877624a3b119a3abd5f09c538a5d809",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8004,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
"target_port_label": "8004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8004,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8004,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=6UZsiVZhtnXvur7Mez43c6R3 HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "8004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 6.38,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
9999 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9999 · (reconnaissance)
|
Élevée
|
Moyen · 43
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
10
Recommandation
Surveiller
Tags
950382:rce-14
950734:sap-sapcontrol-path
http_absolute_uri
http_ua_suspicious
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9999
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 43
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET http://oracle.vanhoang.id.vn:18451/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-14
sap-sapcontrol-path
Payload (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP/1.1
Host: oracle.vanhoang.id.vn:18451
User-Agent:
Requête brute (extrait)
GET http://oracle.vanhoang.id.vn:18451/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP/1.1 Host: oracle.vanhoang.id.vn:18451 User-Agent: Go-http-client/1.1 Accept: application/json Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "213e232d59ba29229143029ab07faf8e6c660db4",
"http_target_hash": "24f4e713bc8e7ee6c2fd8f36a5d04aa97f03c8a8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 218,
"payload_entropy": 5.124313216964603,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http",
"app_proto": "http",
"asn": 63737,
"country": "VN",
"dst_port": 9999,
"risk_waf": 48,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a06c1f05cdadb43f98fd4a10df9e1876f0c0633",
"event_fingerprint": "131980a028ab4dc392aaec42162cb7ba513ecf14",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 348,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "6507fd288c561ff0dc2242e8dbbd53cf",
"path_pattern_hash": "15501b94c2df348c74204a20507714d0"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: ",
"method": "GET",
"path": "\/",
"query_string": "nonce=Dbu-6UenyyF1NGe_u3C948Zp",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "nonce=Dbu-6UenyyF1NGe_u3C948Zp",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950382:rce-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-14",
"sap-sapcontrol-path"
],
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1",
"request_sample": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent: Go-http-client\/1.1\r\nAccept: application\/json\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e4548f2e492b3b0e395ecc78e6afc936399bd17",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (15 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 48,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 43,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)",
"evidence_snippet": "GET http:\/\/oracle.vanhoang.id.vn:18451\/?nonce=Dbu-6UenyyF1NGe_u3C948Zp HTTP\/1.1\r\nHost: oracle.vanhoang.id.vn:18451\r\nUser-Agent:",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 48 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 6.36,
"multi_protocol_correlation": true,
"multi_protocol_count": 15,
"multi_protocol_sample": [
"admin-alt",
"http",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950382:rce-14",
"950734:sap-sapcontrol-path",
"http_absolute_uri",
"http_ua_suspicious",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8004 · HTTP ALT 8004
|
http-alt-8004
|
Scan de ports
port scan syn · via HTTP ALT 8004:8004 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8004
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8004
Chemin / cible
—
Service
HTTP ALT 8004
Payload
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8004",
"app_proto": "http-alt-8004",
"asn": 63737,
"country": "VN",
"dst_port": 8004,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c5db1ca71faf4bdfa4c2b8d7ced5a781443b9239",
"event_fingerprint": "201ea2187fe689fecaf2ad71d733d32cc8c1ab64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8004",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8004,
"service": "http-alt-8004",
"service_name": "http-alt-8004",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ebae9cbd5ebe6f2c7224aecf0ad830f85bf1977",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8004,
"service": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8004:8004 \u00b7 (reconnaissance)",
"target_port_label": "8004 \u00b7 HTTP ALT 8004",
"emulator_service": "http-alt-8004",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8004 \u2014 multi-protocole (14 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004",
"dst_port": 8004,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8004",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8004,
"service": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8004:8004 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8004 \u00b7 HTTP ALT 8004",
"emulator_service": "http-alt-8004",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8004",
"service_banner": "honeypot-http-alt-8004",
"service_os": "linux",
"dst_port": "8004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 8.74,
"multi_protocol_correlation": true,
"multi_protocol_count": 14,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting"
]
}
|
|
|
TCP |
8111 · TEAMCITY
|
teamcity
|
Scan de ports
port scan syn · via TEAMCITY:8111 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
TEAMCITY
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
socks5_greeting
teamcity_emulated
teamcity_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8111
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "teamcity",
"app_proto": "teamcity",
"asn": 63737,
"country": "VN",
"dst_port": 8111,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "43dd6b3a2f6a64079068768cf1be6abf4671d154",
"event_fingerprint": "735691efced4ebba875522e0e7c078fbd0a0e0f5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "teamcity",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8111,
"service": "teamcity",
"service_name": "teamcity",
"risk_score": 42
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2d3c2752f0a22a3518c1bf39450724dfe58c092",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8111,
"service": "teamcity",
"service_label_fr": "TEAMCITY"
},
"attack_vector": "port scan syn \u00b7 via TEAMCITY:8111 \u00b7 (reconnaissance)",
"target_port_label": "8111 \u00b7 TEAMCITY",
"emulator_service": "teamcity",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TEAMCITY \u2014 multi-protocole (14 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "teamcity",
"service_label_fr": "TEAMCITY",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-teamcity",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8111,
"service": "teamcity",
"service_label_fr": "TEAMCITY"
},
"attack_vector": "port scan syn \u00b7 via TEAMCITY:8111 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8111 \u00b7 TEAMCITY",
"emulator_service": "teamcity",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "teamcity",
"service_banner": "honeypot-teamcity",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 8.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 14,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast",
"socks5_greeting",
"teamcity_emulated",
"teamcity_payload"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:8443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e60a26334f537d7ee892a05a34818b25b703890f",
"protocol_details": {
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (11 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 11,
"port_scan_ports_sample": [
3128,
5987,
7001,
8008,
8082,
8088,
8089,
8111,
8443,
8889,
9002
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 11,
"scan_velocity_ports_per_s": 110,
"multi_protocol_correlation": true,
"multi_protocol_count": 11,
"multi_protocol_sample": [
"http-alt-8008",
"http-alt-8082",
"http-alt-8088",
"https",
"minio-console",
"splunk",
"splunk-hec",
"squid"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe"
]
}
|
|
|
TCP |
9999 · ADMIN ALT
|
admin-alt
|
Scan de ports
port scan syn · via ADMIN ALT:9999 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ADMIN-ALT
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9999
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "admin-alt",
"app_proto": "admin-alt",
"asn": 63737,
"country": "VN",
"dst_port": 9999,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0470f9bae4edfa8d863371c8bf7fde08f8b7e9a4",
"event_fingerprint": "2cfee02dc5cd3fc25c2a80133168adbf503e7198",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "admin-alt",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9999,
"service": "admin-alt",
"service_name": "admin-alt",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9225b9aa8effa8b7dfbea3397e6874462231fa23",
"protocol_details": {
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)",
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ADMIN ALT \u2014 multi-protocole (12 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "admin-alt",
"service_label_fr": "ADMIN ALT",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-admin-alt",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "admin_alt",
"service_banner": "honeypot-admin-alt",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 12,
"port_scan_ports_sample": [
3128,
5987,
7001,
8008,
8082,
8088,
8089,
8111,
8443,
8889,
9002,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 12,
"scan_velocity_ports_per_s": 120,
"multi_protocol_correlation": true,
"multi_protocol_count": 12,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8008",
"http-alt-8082",
"http-alt-8088",
"https",
"minio-console",
"splunk",
"splunk-hec"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
8084 · HTTP ALT 8084
|
http-alt-8084
|
Scan de ports
port scan syn · via HTTP ALT 8084:8084 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8084
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8084
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8084",
"app_proto": "http-alt-8084",
"asn": 63737,
"country": "VN",
"dst_port": 8084,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "78e21127a18acb0fc5f9d1dd6879d0545372bd84",
"event_fingerprint": "9fc541ca5c19c906c01af9a9e3daaa9d695a1916",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8084",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8084,
"service": "http-alt-8084",
"service_name": "http-alt-8084",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9cb132754bcd37c4609f0f22eaf27ca82e74c8d",
"protocol_details": {
"port": 8084,
"service": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)",
"target_port_label": "8084 \u00b7 HTTP ALT 8084",
"emulator_service": "http-alt-8084",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8084 \u2014 multi-protocole (13 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084",
"dst_port": 8084,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8084",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 8084,
"service": "http-alt-8084",
"service_label_fr": "HTTP ALT 8084"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8084:8084 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8084 \u00b7 HTTP ALT 8084",
"emulator_service": "http-alt-8084",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8084",
"service_banner": "honeypot-http-alt-8084",
"service_os": "linux",
"dst_port": "8084"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 13,
"port_scan_ports_sample": [
3128,
5987,
7001,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 13,
"scan_velocity_ports_per_s": 130,
"multi_protocol_correlation": true,
"multi_protocol_count": 13,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Scan de ports
port scan syn · via HTTPS:9443 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "https",
"app_proto": "https",
"asn": 63737,
"country": "VN",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5a8749ac119bd3b133ff50b378b99efc2a89b2cc",
"event_fingerprint": "66de93e93356302b7cdade60cabf69b7305865e4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"matched_patterns": [
"pat-0600"
],
"matched_pattern_names": [
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4e7dd42a529c5e6087aefdff6a23c6feecfbfc8",
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (13 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "port scan syn \u00b7 via HTTPS:9443 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 14,
"port_scan_ports_sample": [
3128,
5987,
7001,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 14,
"scan_velocity_ports_per_s": 140,
"multi_protocol_correlation": true,
"multi_protocol_count": 13,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_port_scan_fast"
]
}
|
|
|
TCP |
8004 · HTTP ALT 8004
|
http-alt-8004
|
Scan de ports
port scan syn · via HTTP ALT 8004:8004 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
HTTP-ALT-8004
WAF
—
Recommandation
Surveiller
Tags
net_port_scan_fast
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8004
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 1 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"service": "http-alt-8004",
"app_proto": "http-alt-8004",
"asn": 63737,
"country": "VN",
"dst_port": 8004,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0687ebc2f4ae74b1b3501d0a26958c4db09b07af",
"event_fingerprint": "201ea2187fe689fecaf2ad71d733d32cc8c1ab64",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 318,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8004",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "VN",
"asn": 63737,
"org": "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8004,
"service": "http-alt-8004",
"service_name": "http-alt-8004",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d62238c6652643120c048339d46fcc82f16b64b7",
"protocol_details": {
"port": 8004,
"service": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8004:8004 \u00b7 (reconnaissance)",
"target_port_label": "8004 \u00b7 HTTP ALT 8004",
"emulator_service": "http-alt-8004",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8004 \u2014 multi-protocole (14 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004",
"dst_port": 8004,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8004",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"port": 8004,
"service": "http-alt-8004",
"service_label_fr": "HTTP ALT 8004"
},
"attack_vector": "port scan syn \u00b7 via HTTP ALT 8004:8004 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "8004 \u00b7 HTTP ALT 8004",
"emulator_service": "http-alt-8004",
"confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8004",
"service_banner": "honeypot-http-alt-8004",
"service_os": "linux",
"dst_port": "8004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 15,
"port_scan_ports_sample": [
3128,
5987,
7001,
8004,
8008,
8082,
8084,
8088,
8089,
8111,
8443,
8889,
9002,
9443,
9999
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 15,
"scan_velocity_ports_per_s": 150,
"multi_protocol_correlation": true,
"multi_protocol_count": 14,
"multi_protocol_sample": [
"admin-alt",
"http-alt-8004",
"http-alt-8008",
"http-alt-8082",
"http-alt-8084",
"http-alt-8088",
"https",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_port_scan_fast"
]
}
|