Détails IP 103.191.187.53

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « socks5_probe » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Comparaison ASN / FAI

ASN 138754 · 103.191.186.0/23 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 18 événements sur la période pour cette IP.

103.169.214.91 mssql probe 28/07/2026 09:55 UTC
103.99.204.11 Sonde SMB 17/07/2026 06:12 UTC
103.176.185.124 Sonde port 25/04/2026 18:23 UTC
103.169.214.218 smb attack 10/04/2026 20:45 UTC
103.99.205.179 Bruteforce SSH 02/03/2026 16:30 UTC
103.139.64.224 smb attack 02/02/2026 09:13 UTC
103.160.233.77 smb attack 30/01/2026 07:47 UTC
43.229.90.243 tcp 17/01/2026 13:15 UTC

IPs apparentées

Même FAI Kerala Vision Broad Band Private Limited — corrélation indicative.

103.169.214.91 mssql probe
103.99.204.11 Sonde SMB
103.176.185.124 Sonde port
103.169.214.218 smb attack
103.99.205.179 Bruteforce SSH

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SOCKS5 TCP 14 HTTP TCP 2 HTTP ALT 81 TCP 1 SSH TCP 1

SOCKS5

14

HTTP

2

HTTP ALT 81

1

SSH

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

18 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
30/07/2026 17:39:27 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
30/07/2026 15:55:42 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
30/07/2026 15:01:52 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
30/07/2026 14:55:56 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
29/07/2026 22:38:10 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
29/07/2026 21:44:55 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
29/07/2026 21:19:08 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
29/07/2026 18:49:18 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
29/07/2026 16:01:50 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ], "behavior_alert_count": 1, "behavior_priority": 84 }
28/07/2026 20:46:18 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
28/07/2026 18:17:09 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
26/07/2026 21:16:33 UTC	TCP	7070 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:7070 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-RawPasswordConnectOnly_1.0 � ��H��{=B��6recd… Émulateur SSH WAF — Recommandation Surveiller Tags ssh_banner ssh_kex_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7070 Chemin / cible — Service SSH Bannière SSH SSH-2.0-RawPasswordConnectOnly_1.0 � ��H��{=B��6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,di… Payload SSH-2.0-RawPasswordConnectOnly_1.0 � ��H��{=B��6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he Pourquoi cette classification : Bannière client SSH reçue · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Signaux pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-RawPasswordConnectOnly_1.0 � ��H��{=B��6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he Requête brute (extrait) SSH-2.0-RawPasswordConnectOnly_1.0 � ��H��{=B��6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1]ecdsa-sha2-nistp256,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp384,ecdsa-sha2 Meta JSON brut { "bytes_in": 532, "payload_entropy": 4.913087199065612, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "ssh", "app_proto": "ssh", "asn": 138754, "country": "IN", "dst_port": 7070, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 36, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15 }, "risk_score": 48, "tag_count": 2, "anomaly_count": 0, "campaign_key": "eec5fe247583f3b82c17d4fcf7d7951dbc01279e", "event_fingerprint": "8f34fbd8ebf96bd8b06da9b448afb4bfb921994f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 83, "precision_signals": [ "pat-0391", "INT-upstream" ], "kb_rule_ids": [ "pat-0391", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15, "risk_score": 48 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f6b72503e749f88d926c0acfed45540d", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 7070, "service": "ssh", "service_name": "ssh", "risk_score": 48 }, "payload_preview": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "request_sample": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1\u0000\u0000\u0000]ecdsa-sha2-nistp256,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp384,ecdsa-sha2", "payload_snippet": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "evidence": { "request_sample": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1\u0000\u0000\u0000]ecdsa-sha2-nistp256,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp384,ecdsa-sha2", "payload_snippet": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc45c64d134fc47989d6a369a39fc3a804a4baf8", "protocol_details": { "ssh_banner": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "payload_preview": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "port": 7070, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\ufffd\n\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd{=B\ufffd\ufffd6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "attack_vector": "Sonde SSH \u00b7 via SSH:7070 \u00b7 (sonde \/ probe)", "target_port_label": "7070 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 36, "novelty": 15, "risk_score": 48 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 7070, "protocol_emulated": null, "tags_summary": [ "pat-0391", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0391", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "payload_preview": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001\ufffd\n\u0014\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0011\ufffd{=B\ufffd\ufffd6\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "port": 7070, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:7070 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-RawPasswordConnectOnly_1.0\r\n\ufffd\n\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd{=B\ufffd\ufffd6recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-he", "target_port_label": "7070 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "7070" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "ssh_banner", "ssh_kex_probe" ] }
23/07/2026 00:36:08 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
23/07/2026 00:26:17 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
22/07/2026 22:10:36 UTC	TCP	1080 · SOCKS5	socks5	socks5 probe socks5 probe · via SOCKS5:1080 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SOCKS5 WAF — Recommandation Surveiller Tags net_socks5_probe socks5_emulated socks5_handshake Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1080 Chemin / cible — Service SOCKS5 Payload Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "0500", "emulator_response_len": 2, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "socks5", "app_proto": "socks5", "asn": 138754, "country": "IN", "dst_port": 1080, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010", "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "socks5", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9" }, "target_context": { "dst_port": 1080, "service": "socks5", "service_name": "socks5", "risk_score": 45 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "socks5", "service_label_fr": "SOCKS5", "dst_port": 1080, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-socks5", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 1080, "service": "socks5", "service_label_fr": "SOCKS5" }, "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "1080 \u00b7 SOCKS5", "emulator_service": "socks5", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "socks5", "service_banner": "honeypot-socks5", "service_os": "linux", "dst_port": "1080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_socks5_probe", "socks5_emulated", "socks5_handshake" ] }
22/07/2026 12:37:24 UTC	TCP	9220 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9220 · (tentative d'exploit) · → /wsman	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /wsman UA Microsoft WinRM Client Émulateur HTTP WAF 0 Recommandation Investiguer Tags http_auth_header_token Cible HTTP POST /wsman TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9220 Chemin / cible /wsman Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL WinRM WS-Man Ligne de requête `POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1` User-Agent Microsoft WinRM Client Règles WAF — Payload (extrait) POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1 Authorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw== U Requête brute (extrait) POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1 Authorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw== User-Agent: Microsoft WinRM Client Host: 62.3.50.33:9220 Content-Length: 0 Meta JSON brut { "http_header_count": 4, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "125775626b7b187668b14586c04b933d70be6a90", "http_host_hash": "9d2639aa0306f08c2f8b39c3dbcc7b03e98bb8cc", "http_target_hash": "b94f598db01f702a7be909a821eaf3f78af4c71f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 207, "payload_entropy": 5.09813549220299, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "http", "app_proto": "http", "asn": 138754, "country": "IN", "dst_port": 9220, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 52, "tag_count": 1, "anomaly_count": 0, "campaign_key": "abbacec6313e4aa54f3e321c6007c4ce0410301b", "event_fingerprint": "fec82c18e3f60613c276e00a759b95aee5582bf9", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0526" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "WinRM WS-Man" ], "pattern_ids": [ "pat-0842", "pat-0526" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "94253c0900ff71928a87e751009aa94d", "payload_hash": "1136ddf95acb876d1b3110562490d231", "path_pattern_hash": "141dc9496f83dbb3344f2513e97141b1" }, "target_context": { "dst_port": 9220, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "method": "POST", "path": "\/wsman", "query_string": "PSVersion=5.1.19041.1", "user_agent": "Microsoft WinRM Client", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "request_sample": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nUser-Agent: Microsoft WinRM Client\r\nHost: 62.3.50.33:9220\r\nContent-Length: 0\r\n\r\n", "payload_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "evidence": { "method": "POST", "path": "\/wsman", "query_string": "PSVersion=5.1.19041.1", "user_agent": "Microsoft WinRM Client", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "request_sample": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nUser-Agent: Microsoft WinRM Client\r\nHost: 62.3.50.33:9220\r\nContent-Length: 0\r\n\r\n", "payload_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d23602720b3f148d7a104551cd71550d4e996036", "protocol_details": { "http_method": "POST", "http_path": "\/wsman", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "http_user_agent": "Microsoft WinRM Client", "port": 9220, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "attack_vector": "http smuggling probe \u00b7 via HTTP:9220 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wsman", "target_port_label": "9220 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9220, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/wsman", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "http_user_agent": "Microsoft WinRM Client", "port": 9220, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9220 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wsman", "evidence_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "target_port_label": "9220 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9220" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "http_auth_header_token" ] }
22/07/2026 12:08:18 UTC	TCP	8080 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8080 · (tentative d'exploit) · → /wsman	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /wsman UA Microsoft WinRM Client Émulateur HTTP WAF 0 Recommandation Investiguer Tags http_auth_header_token net_web_probe Cible HTTP POST /wsman TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8080 Chemin / cible /wsman Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL WinRM WS-Man Ligne de requête `POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1` User-Agent Microsoft WinRM Client Règles WAF — Payload (extrait) POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1 Authorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw== U Requête brute (extrait) POST /wsman?PSVersion=5.1.19041.1 HTTP/1.1 Authorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw== User-Agent: Microsoft WinRM Client Host: 62.3.50.33:8080 Content-Length: 0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 4, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "125775626b7b187668b14586c04b933d70be6a90", "http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d", "http_target_hash": "b94f598db01f702a7be909a821eaf3f78af4c71f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 207, "payload_entropy": 5.103668086539833, "port_category": "registered", "org": "Kerala Vision Broad Band Private Limited", "service": "http", "app_proto": "http", "asn": 138754, "country": "IN", "dst_port": 8080, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 52, "tag_count": 2, "anomaly_count": 0, "campaign_key": "7e737bc0be336ed305bac2bd53f3f66ddac58391", "event_fingerprint": "e6e4c76786b7e103de43dbb161db95a9ef400b73", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0526" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "WinRM WS-Man" ], "pattern_ids": [ "pat-0842", "pat-0526" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "94253c0900ff71928a87e751009aa94d", "payload_hash": "627da747278d6d2a8315a5f54b7fbcc0", "path_pattern_hash": "141dc9496f83dbb3344f2513e97141b1" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "method": "POST", "path": "\/wsman", "query_string": "PSVersion=5.1.19041.1", "user_agent": "Microsoft WinRM Client", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "request_sample": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nUser-Agent: Microsoft WinRM Client\r\nHost: 62.3.50.33:8080\r\nContent-Length: 0\r\n\r\n", "payload_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "evidence": { "method": "POST", "path": "\/wsman", "query_string": "PSVersion=5.1.19041.1", "user_agent": "Microsoft WinRM Client", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "request_sample": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nUser-Agent: Microsoft WinRM Client\r\nHost: 62.3.50.33:8080\r\nContent-Length: 0\r\n\r\n", "payload_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b6f9c4bc826a32e8a98306cc4fa9de2748185b0e", "protocol_details": { "http_method": "POST", "http_path": "\/wsman", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "http_user_agent": "Microsoft WinRM Client", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "attack_vector": "http smuggling probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wsman", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/wsman", "request_line": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1", "http_user_agent": "Microsoft WinRM Client", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wsman", "evidence_snippet": "POST \/wsman?PSVersion=5.1.19041.1 HTTP\/1.1\r\nAuthorization: Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\r\nU", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "http_auth_header_token", "net_web_probe" ] }
22/07/2026 09:46:56 UTC	TCP	81 · HTTP ALT 81	http-alt-81	http-alt-81 http-alt-81 · via HTTP ALT 81:81 · (sonde / probe)	Faible	Faible · 7
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-81 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 81 Chemin / cible — Service HTTP ALT 81 Payload Pourquoi cette classification : Type « http-alt-81 » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 7 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 4, "payload_entropy": 1.5, "port_category": "well_known", "org": "Kerala Vision Broad Band Private Limited", "service": "http-alt-81", "app_proto": "http-alt-81", "asn": 138754, "country": "IN", "dst_port": 81, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 7, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3f22551d39a092b08990354bd45c12679c434288", "event_fingerprint": "da8b22a909c287a6570bb2c7dce20fa4de2070cb", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 7 }, "service_name": "http-alt-81", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "IN", "asn": 138754, "org": "Kerala Vision Broad Band Private Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "96b5770472eb71fcb1b2ba3134979c11" }, "target_context": { "dst_port": 81, "service": "http-alt-81", "service_name": "http-alt-81", "risk_score": 7 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "48f19ae5c9d1902419f4b34448c73c5258116fbf", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 81, "service": "http-alt-81", "service_label_fr": "HTTP ALT 81" }, "attack_vector": "http-alt-81 \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)", "target_port_label": "81 \u00b7 HTTP ALT 81", "emulator_service": "http-alt-81", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 7 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 7, "risk_label": "Faible", "service_name": "http-alt-81", "service_label_fr": "HTTP ALT 81", "dst_port": 81, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-81", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 81, "service": "http-alt-81", "service_label_fr": "HTTP ALT 81" }, "attack_vector": "http-alt-81 \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "81 \u00b7 HTTP ALT 81", "emulator_service": "http-alt-81", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_81", "service_banner": "honeypot-http-alt-81", "service_os": "linux", "dst_port": "81" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }

103.191.187.53

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence