|
|
TCP |
3389 · RDP
|
rdp
|
Protocole TDS MSSQL
mssql tds · via RDP:3389 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
/ ! " & �
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
/ ! " & �
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 47,
"payload_entropy": 2.407956137576773,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7e4bb88cefbb44397f559d2afbab3f184040871e",
"event_fingerprint": "48b546a475b6280818a5e5400f8227f33bd264af",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d4de02e442f4f701f78f2c23d15b264",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c906e8fc727da79fa4479f84a8ccd1c3730e2ef",
"protocol_details": {
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "\/ !\"&\ufffd",
"attack_vector": "mssql tds \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "mssql tds \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/ !\"&\ufffd",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
� +<M DESKTOP-1H70A2 Microsoft Windows NT
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� +<M DESKTOP-1H70A2 Microsoft Windows NT
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 156,
"payload_entropy": 2.167073778996175,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aa4bea48009056c8c3884e795b29aa79232ecca7",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "rdp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "20ac252f86cf044b98a0c6249fd93b9b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 45
},
"payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000DESKTOP-1H70A2\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Microsoft Windows NT\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000DESKTOP-1H70A2\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Microsoft Windows NT\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000DESKTOP-1H70A2\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Microsoft Windows NT\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63d47e75d2dccdfde13de251f76daa698a35bf1e",
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000DESKTOP-1H70A2\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Microsoft Windows NT\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "\ufffd+<MDESKTOP-1H70A2Microsoft Windows NT",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000DESKTOP-1H70A2\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Microsoft Windows NT\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd+<MDESKTOP-1H70A2Microsoft Windows NT",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde port 3388/TCP
port 3388 tcp · via RDP:3388 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Preuve honeypot — Sonde port 3388/TCP
Connexion détectée sur le port 3388 (TCP) du capteur simulé.
Service
RDP
Payload
*1 $4 INFO
Pourquoi cette classification : Type « port_3388_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
65%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Redis INFO
User-Agent
—
Règles WAF
—
Payload (extrait)
*1
$4
INFO
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 14,
"payload_entropy": 3.128085278891395,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0411"
],
"matched_pattern_names": [
"Redis INFO"
],
"pattern_ids": [
"pat-0411"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "rdp",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f97ce549efeee853d655f0c9276962a8",
"path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 42
},
"payload_preview": "*1\r\n$4\r\nINFO\r\n",
"request_sample": "*1\r\n$4\r\nINFO\r\n",
"payload_snippet": "*1\r\n$4\r\nINFO",
"evidence": {
"request_sample": "*1\r\n$4\r\nINFO\r\n",
"payload_snippet": "*1\r\n$4\r\nINFO",
"classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f88e12276a8a2787c9c33d8486a4e2d30f6e2c5f",
"protocol_details": {
"payload_preview": "*1\r\n$4\r\nINFO",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "*1\r\n$4\r\nINFO",
"attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "*1\r\n$4\r\nINFO",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*1\r\n$4\r\nINFO",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 13,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde port 3388/TCP
port 3388 tcp · via RDP:3388 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Preuve honeypot — Sonde port 3388/TCP
Connexion détectée sur le port 3388 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3388_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
65%
Corrélation +10
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.65,
"classification_confidence": 0.65,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "rdp_probe",
"service_name": "rdp",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c05b03c2e51a8f59a7f00affb6f25dc3db835577",
"protocol_details": {
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 65,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3388 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 10,
"payload_entropy": 2.0464393446710156,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2d009dc0affca07cded0c7a5982ebc3c34c44e3d",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "rdp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e78176d7679ebfecfd6a90ad2167f273",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 45
},
"payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"request_sample": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd6ffde13b9950c12c3ac36c3402dde88e8e5d65",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "P",
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"evidence_snippet": "P",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated",
"socks4_greeting"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3388 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "549bfa21fd731668868b1616e117f47956918b35",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_confidence": 0.6,
"confidence": 0.6,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"service_name": "rdp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5de1dd9d9bc018c7a797b7e9640204317a40caa4",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated",
"socks5_greeting"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet
telnet probe · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Service
Telnet
Payload
8#9�CXw-
Pourquoi cette classification : Type « telnet_probe » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
8#9�CXw-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"bytes_in": 16,
"payload_entropy": 3.0306390622295662,
"port_category": "well_known",
"org": "Rethem Hosting LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 14987,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_confidence": 0.68,
"confidence": 0.68,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 18
},
"service_name": "telnet",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8e65243748b47577405e64a8da4bd2c8",
"path_pattern_hash": "2c237ea9456e7ca12ad74a6740f8c26b"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 45
},
"payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92724468a893298a223e9339c153fb2a451fe57a",
"protocol_details": {
"payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"evidence_snippet": "8#9\ufffdCXw-",
"attack_vector": "telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": "8#9\ufffdCXw-",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"rdp",
"telnet"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3388 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Service
RDP
Payload
d� 6Ld� ގd� ��d� wFd� �d� �Rd� �Xd� \�d� �d� �{d� �qd� X�d�
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0348
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma DNP3 link
RDP TPKT header
ET H.323 setup
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
d� 6Ld� ގd� ��d� wFd� �d� �Rd� �Xd� \�d� �d� �{d�
�qd� X�d�
Requête brute (extrait)
d� 6Ld� ގd� ��d� wFd� �d� �Rd� �Xd� \�d� �d� �{d� �qd� X�d� 2ed� ڧd� ��d� sod� �d� �)d� �#d� P�d� :7d� ��d� ��d� {=d� > d�
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 1000,
"payload_entropy": 4.347938795863165,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 83,
"precision_signals": [
"pat-0348",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0348",
"INT-upstream"
],
"matched_patterns": [
"pat-0794",
"pat-0348",
"pat-0868",
"pat-0554"
],
"matched_pattern_names": [
"Sigma DNP3 link",
"RDP TPKT header",
"ET H.323 setup",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0794",
"pat-0348",
"pat-0868",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7d3587032b33d30b8978ddc3a10bd429",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 48
},
"payload_snippet": "\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u00002e\u0005d\u0005\ufffd\r\u0000\u0000\u0000\u06a7\u0005d\u0005\ufffd\u000e\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u000f\u0000\u0000\u0000so\u0005d\u0005\ufffd\u0010\u0000\u0000\u0000\u0011\ufffd\u0005d\u0005\ufffd\u0011\u0000\u0000\u0000\ufffd)\u0005d\u0005\ufffd\u0012\u0000\u0000\u0000\ufffd#\u0005d\u0005\ufffd\u0013\u0000\u0000\u0000P\ufffd\u0005d\u0005\ufffd\u0014\u0000\u0000\u0000:7\u0005d\u0005\ufffd\u0015\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0016\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0017\u0000\u0000\u0000{=\u0005d\u0005\ufffd\u0018\u0000\u0000\u0000>\u001e\u0005d\u0005\ufffd\u0019\u0000",
"payload_snippet": "\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u0000",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33fa47be0ab0d5aaececf91d9be98e9e2c1d2034",
"protocol_details": {
"payload_preview": "\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": [
"pat-0348",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0348",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "\u0005d\u0005\ufffd\u0000\u0000\u0000\u00006L\u0005d\u0005\ufffd\u0001\u0000\u0000\u0000\u078e\u0005d\u0005\ufffd\u0002\u0000\u0000\u0000\ufffd\ufffd\u0005d\u0005\ufffd\u0003\u0000\u0000\u0000wF\u0005d\u0005\ufffd\u0004\u0000\u0000\u0000\u001d\ufffd\u0005d\u0005\ufffd\u0005\u0000\u0000\u0000\ufffdR\u0005d\u0005\ufffd\u0006\u0000\u0000\u0000\ufffdX\u0005d\u0005\ufffd\u0007\u0000\u0000\u0000\\\ufffd\u0005d\u0005\ufffd\b\u0000\u0000\u0000\u0019\ufffd\u0005d\u0005\ufffd\t\u0000\u0000\u0000\ufffd{\u0005d\u0005\ufffd\n\u0000\u0000\u0000\ufffdq\u0005d\u0005\ufffd\u000b\u0000\u0000\u0000X\ufffd\u0005d\u0005\ufffd\f\u0000\u0000\u0000",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
"evidence_snippet": "d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\ufffdd\ufffd\ufffdd\ufffd\t\ufffd{d\ufffd\n\ufffdqd\ufffdX\ufffdd\ufffd",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"rdp",
"telnet"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 15,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3388 · RDP
|
rdp
|
Sonde HTTP smuggling
http smuggling probe · via RDP:3388 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RDP
WAF
—
Recommandation
Investiguer
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3388
Chemin / cible
—
Service
RDP
Payload
POST /wsman HTTP/1.1 Connection: close User-Agent: Microsoft WinRM Client Content-Length: 8 Host: 62.3.50.33:3388 70B8A43
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
WinRM WS-Man
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /wsman HTTP/1.1
Connection: close
User-Agent: Microsoft WinRM Client
Content-Length: 8
Host: 62.3.50.33:3388
70B8A43
Requête brute (extrait)
POST /wsman HTTP/1.1 Connection: close User-Agent: Microsoft WinRM Client Content-Length: 8 Host: 62.3.50.33:3388 70B8A438
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 133,
"payload_entropy": 5.01674402353271,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3388,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
"event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0526"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"WinRM WS-Man"
],
"pattern_ids": [
"pat-0842",
"pat-0526"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "17096d47e23867adca5763e00551a6e6",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3388,
"service": "rdp",
"service_name": "rdp",
"risk_score": 52
},
"payload_preview": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"request_sample": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A438\r\n\r\n",
"payload_snippet": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"evidence": {
"request_sample": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A438\r\n\r\n",
"payload_snippet": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "11e3b581cba0e569a5fa9b037c3a173098594cfc",
"protocol_details": {
"payload_preview": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"attack_vector": "http smuggling probe \u00b7 via RDP:3388 \u00b7 (tentative d'exploit)",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via RDP \u2014 campagne \/24 (104.152.52.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3388,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"port": 3388,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "http smuggling probe \u00b7 via RDP:3388 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/wsman HTTP\/1.1\r\nConnection: close\r\nUser-Agent: Microsoft WinRM Client\r\nContent-Length: 8\r\nHost: 62.3.50.33:3388\r\n\r\n70B8A43",
"target_port_label": "3388 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3388"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 14,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3390 · RDP
|
rdp
|
amqp probe
amqp probe · via RDP:3390 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Investiguer
Tags
amqp_handshake
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3390
Chemin / cible
—
Pourquoi cette classification : Type « amqp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Proto Amqp Auth
pat-0371
pat-0537
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
AMQP protocol
AMQP protocol header
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 8,
"payload_entropy": 2.75,
"port_category": "registered",
"org": "Rethem Hosting LLC",
"service": "rdp",
"app_proto": "rdp",
"asn": 14987,
"country": "US",
"dst_port": 3390,
"risk_waf": 8,
"risk_classification": 43,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 50,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5cc05f4d4359fef3aba8dea1dbe00d7f2db3cf0b",
"event_fingerprint": "700e745442e0a767acc5398300bd052d20e6e907",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 174,
"precision_signals": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537"
],
"kb_rule_ids": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537"
],
"matched_patterns": [
"pat-0371",
"pat-0537"
],
"matched_pattern_names": [
"AMQP protocol",
"AMQP protocol header"
],
"pattern_ids": [
"pat-0371",
"pat-0537"
],
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "rdp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14987,
"org": "Rethem Hosting LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc2f502576523902588d3c36f36ea5a1",
"path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
},
"target_context": {
"dst_port": 3390,
"service": "rdp",
"service_name": "rdp",
"risk_score": 50
},
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"request_sample": "AMQP\u0000\u0000\t\u0001",
"payload_snippet": "AMQP\u0000\u0000\t\u0001",
"evidence": {
"request_sample": "AMQP\u0000\u0000\t\u0001",
"payload_snippet": "AMQP\u0000\u0000\t\u0001",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52d44fb2cabb35f50ab2f474150fb5925a053abd",
"protocol_details": {
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"port": 3390,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "AMQP",
"attack_vector": "amqp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
"target_port_label": "3390 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RDP \u2014 campagne \/24 (104.152.52.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 50,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3390,
"protocol_emulated": true,
"tags_summary": [
"INT-PROTO-amqp-auth",
"pat-0371",
"pat-0537"
],
"tags_summary_labels_fr": [
"Proto Amqp Auth",
"pat-0371",
"pat-0537"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rdp",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"payload_preview": "AMQP\u0000\u0000\t\u0001",
"port": 3390,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "amqp probe \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
"evidence_snippet": "AMQP",
"target_port_label": "3390 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "honeypot-rdp",
"service_os": "linux",
"dst_port": "3390"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "104.152.52.0\/24",
"coordinated_ip_count": 12,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"amqp_handshake",
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|