Détails IP 104.248.228.78

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 18/05/2026 18:45 UTC

Dernière observation 31/07/2026 03:43 UTC

Événements (période) 102

MITRE ATT&CK principal TA0007 21 occurrences

Activité suspecte · risque 35/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_3342_tcp » (signaux protocolaires) · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 14061 · 104.248.224.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 102 événements sur la période pour cette IP.

143.198.238.87 Sonde port 01/08/2026 19:33 UTC
159.89.139.75 vnc bruteforce 01/08/2026 19:33 UTC
64.225.74.178 Sonde TLS 01/08/2026 19:32 UTC
147.182.247.10 Cross-site scripting 01/08/2026 19:32 UTC
159.223.216.48 vnc bruteforce 01/08/2026 19:32 UTC
139.59.170.85 Sonde port 01/08/2026 19:32 UTC
143.198.225.197 Protocole TDS MSSQL 01/08/2026 19:30 UTC
188.166.69.53 Sonde port 23/TCP 01/08/2026 19:30 UTC

Événements (filtres)

102

Première observation

18/05/2026 18:45 UTC

Dernière observation

31/07/2026 03:43 UTC

Dernière activité (filtres)

31/07/2026 03:43 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Faible

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

MONGODB TCP 33 HTTP TCP 12 TLS TCP 5

MONGODB

HTTP

TLS

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

DigitalOcean, LLC 81 Port 3342 port_3342_tcp

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

port 3342 tcp · port 3342 · (sonde / probe)

Détails protocole

Aperçu payload

�

Port / service

3342

Raison confiance

Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0348

Confiance

49% Confiance modérée — signal unique

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

102 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

102 événement(s) — page 1/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
31/07/2026 03:43:12 UTC	TCP	3342	—	Sonde port 3342/TCP port 3342 tcp · port 3342 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3342 Chemin / cible — Preuve honeypot — Sonde port 3342/TCP Connexion détectée sur le port 3342 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « port_3342_tcp » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "bytes_in": 19, "payload_entropy": 1.8784775129881182, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 3342, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8f26884424d5a87fb25686d1ed4fdec306098076", "event_fingerprint": "bc41f4ac9b49458042a103d10b1a7145b28dbef9", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "070be4642e6db6eccccc3527d55ded29", "path_pattern_hash": "eb1b2bc04537d4829c1bbb0c72975f11" }, "target_context": { "dst_port": 3342, "risk_score": 35 }, "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21549ef19583bda0922bbd7d487036697ae6042b", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "port": 3342 }, "evidence_snippet": "\ufffd", "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "target_port_label": "3342", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 3342, "protocol_emulated": null, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000", "port": 3342 }, "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "3342", "emulator_service": null, "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3342" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
31/07/2026 03:43:12 UTC	TCP	3342	—	Sonde port 3342/TCP port 3342 tcp · port 3342 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3342 Chemin / cible — Preuve honeypot — Sonde port 3342/TCP Connexion détectée sur le port 3342 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « port_3342_tcp » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "bytes_in": 19, "payload_entropy": 1.716047706294417, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 3342, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8f26884424d5a87fb25686d1ed4fdec306098076", "event_fingerprint": "bc41f4ac9b49458042a103d10b1a7145b28dbef9", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "61c292c5cfbb0e792ee40ace240e20e2", "path_pattern_hash": "eb1b2bc04537d4829c1bbb0c72975f11" }, "target_context": { "dst_port": 3342, "risk_score": 35 }, "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "393d605f1ad03c0ca0cd5facbe0a9d903f0fe586", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "port": 3342 }, "evidence_snippet": "\ufffd", "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "target_port_label": "3342", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 3342, "protocol_emulated": null, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "port": 3342 }, "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "3342", "emulator_service": null, "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3342" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
31/07/2026 03:43:11 UTC	TCP	3342	—	Sonde port 3342/TCP port 3342 tcp · port 3342 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3342 Chemin / cible — Preuve honeypot — Sonde port 3342/TCP Connexion détectée sur le port 3342 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « port_3342_tcp » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "bytes_in": 19, "payload_entropy": 1.983740670882855, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 3342, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8f26884424d5a87fb25686d1ed4fdec306098076", "event_fingerprint": "bc41f4ac9b49458042a103d10b1a7145b28dbef9", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7f100771350354534406eb0380a31d58", "path_pattern_hash": "eb1b2bc04537d4829c1bbb0c72975f11" }, "target_context": { "dst_port": 3342, "risk_score": 35 }, "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a98e785cefe7b893722ffd38f26e2c74869e29fb", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "port": 3342 }, "evidence_snippet": "\ufffd", "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "target_port_label": "3342", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_3342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 3342, "protocol_emulated": null, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0002\u0000\u0000\u0000", "port": 3342 }, "attack_vector": "port 3342 tcp \u00b7 port 3342 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "3342", "emulator_service": null, "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3342" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
16/07/2026 17:14:29 UTC	TCP	3394	—	Sonde port Sonde port · port 3394 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3394 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 4, "payload_entropy": 1, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 3394, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b3052d938d207e962fbe3afca229ec31f555a219", "event_fingerprint": "b92479d3218f7701dd2d59180e93e611150a2afe", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 3394, "risk_score": 44 }, "payload_preview": "\r\n\r\n", "request_sample": "\r\n\r\n", "evidence": { "request_sample": "\r\n\r\n", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "230543bb73cd7669ecd9f0cc5c650585927ab43e", "protocol_details": { "port": 3394 }, "attack_vector": "Sonde port \u00b7 port 3394 \u00b7 (sonde \/ probe)", "target_port_label": "3394", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 3394, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 3394 }, "attack_vector": "Sonde port \u00b7 port 3394 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "3394", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3394" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
16/07/2026 17:14:29 UTC	TCP	3394 · HTTP	http	http http · via HTTP:3394 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3394 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61% Confiance classification 69% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 3394, "risk_waf": 20, "risk_classification": 8, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "6d0cd41c5d57e23008d7c35aa398017c600a82dc", "event_fingerprint": "44758c21bed9fd01466d1b4ba7f64bae147b6757", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 3394, "service": "http", "service_name": "http", "risk_score": 35 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%" }, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.69, "classification_confidence": 0.69, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4372df1ab1d60a7bd2778449872a8842227c90c3", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 3394, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "http \u00b7 via HTTP:3394 \u00b7 (sonde \/ probe)", "target_port_label": "3394 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 69, "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3394, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 3394, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:3394 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "3394 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3394" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3394" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua" ], "asn_dc_heuristic": true }
16/07/2026 17:14:27 UTC	TCP	3394	—	Sonde port Sonde port · port 3394 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3394 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 3394, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "b3052d938d207e962fbe3afca229ec31f555a219", "event_fingerprint": "b92479d3218f7701dd2d59180e93e611150a2afe", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 3394, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83f65695aecc27c78ecdec2bfd55727f7e7b6bef", "protocol_details": { "port": 3394 }, "attack_vector": "Sonde port \u00b7 port 3394 \u00b7 (sonde \/ probe)", "target_port_label": "3394", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 3394, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 3394 }, "attack_vector": "Sonde port \u00b7 port 3394 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "3394", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3394" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:57 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload batman Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) batman Meta JSON brut { "bytes_in": 6, "payload_entropy": 2.2516291673878226, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1532e76dbe9d43d0dea98c331ca5ae8a", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "batman", "request_sample": "batman", "payload_snippet": "batman", "evidence": { "request_sample": "batman", "payload_snippet": "batman", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4a95fb22097794bc53e5281bf243bc8cb4560e0", "protocol_details": { "payload_preview": "batman", "port": 10134 }, "evidence_snippet": "batman", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "batman", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "batman", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:57 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload �,�:��H��Pq��S��:�3o)S}��bζ ��7>�v��E�D��A�� )k�c]V�V�_T t� ��w�M=[1��g^��K��>�k��H��D�`k��e��{_LP Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0577 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �,�:��H��Pq��S��:�3o)S}��bζ��7>�v��E�D��A�� )k�c]V�V�_Tt��w�M=[1��g^��K��>�k��H��D�`k��e��{_LP Requête brute (extrait) �,�:��H��Pq��S��:�3o)S}��bζ ��7>�v��E�D��A�� )k�c]V�V�_T t� ��w�M=[1��g^��K��>�k��H��D�`k��e��{_LP��J Meta JSON brut { "bytes_in": 136, "payload_entropy": 6.556105028702606, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0577" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c06fc23d2f224f4eb425bd383053b222", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP", "request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ", "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP", "evidence": { "request_sample": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP\u0015\ufffd\u001e\u000e\ufffd\ufffd\ufffdJ", "payload_snippet": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce8b16130eb35d5e59993be419a9ac6bc0e0db9e", "protocol_details": { "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP", "port": 10134 }, "evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0577" ], "tags_summary_labels_fr": [ "pat-0577" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0001\ufffd\u0000\u0000\u0000\u0001,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\u0017\ufffd3\u0014o)S}\ufffd\ufffd\ufffdb\u03b6\u000b\ufffd\ufffd7>\u0001\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc\u0018]V\ufffdV\ufffd_\u0005T\u000bt\ufffd\u000b\ufffd\ufffdw\ufffdM=[1\ufffd\u0006\ufffd\ufffd\ufffdg^\ufffd\u0001\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\u001c\ufffd\ufffd{_LP", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd,\ufffd:\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdPq\ufffd\ufffd\ufffdS\ufffd\ufffd:\ufffd3o)S}\ufffd\ufffd\ufffdb\u03b6\ufffd\ufffd7>\ufffdv\ufffd\ufffdE\ufffdD\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd)k\ufffdc]V\ufffdV\ufffd_Tt\ufffd\ufffd\ufffdw\ufffdM=[1\ufffd\ufffd\ufffd\ufffdg^\ufffd\ufffdK\ufffd\ufffd>\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdD\ufffd`k\ufffd\ufffde\ufffd\ufffd{_LP", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:57 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload ��E��0��&��!��&� �� +�� #�� Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��E��0��&��!��&�� +�� #�� Requête brute (extrait) ��E��0��&��!��&� �� +�� #�� Meta JSON brut { "bytes_in": 144, "payload_entropy": 3.7524121173816725, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c08b667ad2290ced22cda22075fd99b", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "payload_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "180b85554ff42859a26b05da44e445e58dda9351", "protocol_details": { "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "port": 10134 }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\u0012\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\u0001\ufffd\u000f\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\u0002\ufffd&\ufffd\f\ufffd\u0001\ufffd\ufffd\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\u0012\ufffd\u0002\ufffd\ufffd\ufffd\u0003\ufffd\u0002\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd#\ufffd\ufffd\ufffd", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:57 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload AfH�d~��g�� T��Z��?��t0\��X��J��ȜlМ��ˏ��J�<��` Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) AfH�d~��g�� T��Z��?��t0\��X��J��ȜlМ��ˏ��J�<��` Meta JSON brut { "bytes_in": 69, "payload_entropy": 5.767803079903862, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c12d37882087cf9ca03116d828e11245", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "evidence": { "request_sample": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "payload_snippet": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d9621c4135da3d5eb45ae9a545860553a80d5ff", "protocol_details": { "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "port": 10134 }, "evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "A\u0000\u0000\u0000\u0003fH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u02cf\ufffd\ufffd\u0016\ufffdJ\ufffd<\ufffd\ufffd`", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "AfH\ufffdd~\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdT\ufffd\ufffdZ\ufffd\ufffd?\ufffd\ufffd\ufffdt0\\\ufffd\ufffd\ufffdX\ufffd\ufffdJ\ufffd\ufffd\u021cl\u041c\ufffd\ufffd\ufffd\ufffd\ufffd\u02cf\ufffd\ufffd\ufffdJ\ufffd<\ufffd\ufffd`", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:57 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload ;Bo3�D��si=��:�ɮ�<0�8��N��޷<oN��/���C �4]��PVf��ȣ+b�� Pourquoi cette classification :* Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ;Bo3�D��si=��:�ɮ�<0�8��N��޷<oN��/���C�4]��PVf��ȣ+b�� Meta JSON brut { "bytes_in": 78, "payload_entropy": 5.952068885528922, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "07542c6becaecdcdca50a371ce717331", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "evidence": { "request_sample": "\t\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "payload_snippet": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "539a0a06aec3d4e568a83d2601c732f779b116f9", "protocol_details": { "payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "port": 10134 }, "evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0012;Bo3\ufffdD\ufffd\u0001\ufffdsi=\ufffd\u0012\ufffd\ufffd\u0019\ufffd\u001a:\ufffd\u0011\u026e\ufffd<0\ufffd8\ufffd\ufffd\u0000\u000f\ufffdN\ufffd\u0005\ufffd\u07b7<oN\u0001\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\u001f\u000e\ufffdC\f\ufffd4]\ufffd\ufffdPVf\u001a\u0011\ufffd\ufffd\u0223\u0016+b\ufffd\ufffd", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": ";Bo3\ufffdD\ufffd\ufffdsi=\ufffd\ufffd\ufffd\ufffd:\ufffd\u026e\ufffd<0\ufffd8\ufffd\ufffd\ufffdN\ufffd\ufffd\u07b7<oN\ufffd\ufffd\ufffd\ufffd\/\ufffd\ufffd\ufffdC\ufffd4]\ufffd\ufffdPVf\ufffd\ufffd\u0223+b\ufffd\ufffd", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:56 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof] Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof] Meta JSON brut { "bytes_in": 117, "payload_entropy": 4.175258830258507, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2d2685956f7f410604536189c003f5c", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "request_sample": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "payload_snippet": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "evidence": { "request_sample": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "payload_snippet": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d608d7dc893007802dd7b26dc18eca78ba34c825", "protocol_details": { "payload_preview": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "port": 10134 }, "evidence_snippet": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "lv\|'\|'\|VHJvamFuX0M0NkY2RTk=\|'\|'\|MARK\|'\|'\|user\|'\|'\|2013-11-22\|'\|'\|\|'\|'\|Win XP\|'\|'\|No\|'\|'\|0.6.4\|'\|'\|..\|'\|'\|\|'\|'\|[endof]", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:56 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload �հ]�ē�0�X�ڱ׬�n�3��'��k�� G�W�zOe��aFCysA��C�p���b�vG�/��&o�@Jz��3iBQ�Q�۔�b2M"�� Z�&e� � Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0514 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �հ]�ē�0�X�ڱ׬�n�3��'��k�� G�W�zOe��aFCysA��C�p���b�vG�/��&o�@Jz��3iBQ�Q�۔�b2M"�� Z�&e�� Requête brute (extrait) �հ]�ē�0�X�ڱ׬�n�3��'��k�� G�W�zOe��aFCysA��C�p���b�vG�/��&o�@Jz��3iBQ�Q�۔�b2M"�� Z�&e� � X'��ͤGH/~s;`(&)�K_��Y7�� n��#�L ��szs�W��/��0�~3E]�M�ؑ��Ց��ь��(��"eUY�E:I2_��\�~� c~��rZ�/U��f�fi Meta JSON brut { "bytes_in": 518, "payload_entropy": 7.586688001255927, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0514" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3699d67b1c1d3f5e51e94c25bf3415b4", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\r", "request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi", "payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd", "evidence": { "request_sample": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd\rX'\ufffd\u0005\ufffd\u0364GH\u0000\/~s;`(&)\ufffdK_\u0002\u0002\ufffd\ufffd\u0000\u0010\ufffd\ufffdY7\ufffd\ufffd\ufffd\u000bn\ufffd\ufffd#\ufffdL\r\ufffd\ufffd\ufffd\ufffd\u0007\ufffdsz\u001cs\ufffdW\ufffd\ufffd\b\/\ufffd\ufffd0\ufffd\u0004~3E]\ufffdM\ufffd\u0611\b\ufffd\ufffd\u0551\ufffd\ufffd\u044c\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\"eUY\ufffdE:I2_\ufffd\ufffd\ufffd\u001c\\\ufffd~\ufffd\nc~\ufffd\ufffdrZ\ufffd\/U\ufffd\ufffdf\ufffdfi", "payload_snippet": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60b73e25134c5b94ea5f4b290d52c4badfa7b207", "protocol_details": { "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd", "port": 10134 }, "evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0514" ], "tags_summary_labels_fr": [ "pat-0514" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u001b\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\u001d\ufffd\u001e\u001a3\ufffd\ufffd\u001d'\ufffd\ufffdk\ufffd\ufffd\nG\u0001\ufffd\u0001W\u001c\ufffdz\u001bOe\ufffd\u0005\ufffdaFCy\u0015sA\u0003\u0016\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\u0019\ufffd\ufffd\ufffdb\ufffdv\u0007G\ufffd\/\ufffd\ufffd&o\u0006\u0015\ufffd@J\u0001z\u000e\ufffd\ufffd3iBQ\ufffdQ\u0010\ufffd\u000f\u0007\u001c\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\u0001\u0012\ufffdZ\ufffd&e\ufffd\f\ufffd", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u0570]\ufffd\u0113\ufffd0\ufffdX\ufffd\u06b1\u05ec\ufffdn\ufffd3\ufffd\ufffd'\ufffd\ufffdk\ufffd\ufffd\nG\ufffdW\ufffdzOe\ufffd\ufffdaFCysA\ufffd\ufffd\ufffd\ufffdC\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffdvG\ufffd\/\ufffd\ufffd&o\ufffd@Jz\ufffd\ufffd3iBQ\ufffdQ\ufffd\u06d4\ufffdb2M\"\ufffd\ufffd \ufffd\ufffdZ\ufffd&e\ufffd\ufffd", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:56 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload Gh0st��x�KS``��Č@�Q�� H��e&�$&g+2��00��rc��\`&��K7��n 9�n ;�3��sch�^�4'J��0Ñh]&��ΗS�A4L?2=�Ē� @�` T Pourquoi cette classification :* Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Gh0st��x�KS``��Č@�Q�� H��e&�$&g+2��00��rc��\`&��K7��n9�n;�3��sch�^�4'J��0Ñh]&��ΗS�A4L?2=�Ē�@�`T Requête brute (extrait) Gh0st��x�KS``��Č@�Q�� H��e&�$&g+2��00��rc��\`&��K7��n 9�n ;�3��sch�^�4'J��0Ñh]&��ΗS�A4L?2=�Ē� @�` T��] r #��~�+m�=�tC,C�L<<==\�� T�+\ Meta JSON brut { "bytes_in": 173, "payload_entropy": 6.526774759278568, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac4eb53f5e8dfbbbaca7212ed0125e98", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT", "request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\", "payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT", "evidence": { "request_sample": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT\u001f\ufffd\ufffd]\nr\u000b\u0003#\ufffd\ufffd\u0002~\u0006\ufffd\u0003+\u0018m\ufffd=\ufffdtC,C\ufffdL<<==\\\ufffd\u0019\ufffd\u0000\ufffd \u0002\u0000T\ufffd+\\", "payload_snippet": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e943669c63320b63d34487e4c8642c243ef298f", "protocol_details": { "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT", "port": 10134 }, "evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "Gh0st\ufffd\u0000\u0000\u0000\ufffd\u0000\u0000\u0000x\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\u0007\ufffd\u0016\ufffde&\ufffd\u0004$&g+\u00182\ufffd\ufffd\ufffd00\ufffd\ufffdrc\u0000\u0001\u0011\ufffd\ufffd\u001f\\`&\ufffd\ufffdK7\ufffd\u0019\ufffdn\f9\ufffdn\f;\ufffd\u000f3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd\u000b@\ufffd`\fT", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "Gh0st\ufffd\ufffdx\ufffdKS``\ufffd\ufffd\ufffd\ufffd\ufffd\u010c@\ufffdQ\ufffd\ufffd\ufffd\tH\ufffd\ufffde&\ufffd*$&g+2\ufffd\ufffd\ufffd00\ufffd\ufffdrc\ufffd\ufffd\\`&\ufffd\ufffdK7\ufffd\ufffdn9\ufffdn;\ufffd3\ufffd\ufffdsch\ufffd^\ufffd4'J\ufffd\ufffd\ufffd\ufffd0\u00d1h]&\ufffd\ufffd\u0397S\ufffdA4L?2=\ufffd\u0112\ufffd@\ufffd`T", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:56 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload 145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d Requête brute (extrait) 145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d\|'\|'\|..\|'\|'\|AA==\|'\|'\|112.inf\|'\|'\|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp Meta JSON brut { "bytes_in": 280, "payload_entropy": 5.4072640905205, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "88230f14a43950fa1f87f2ce9b5783a9", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "payload_preview": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "request_sample": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d\|'\|'\|..\|'\|'\|AA==\|'\|'\|112.inf\|'\|'\|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp", "payload_snippet": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "evidence": { "request_sample": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d\|'\|'\|..\|'\|'\|AA==\|'\|'\|112.inf\|'\|'\|SGFjS2VkDQoxOTIuMTY4LjkyLjIyMjo1NTUyDQpEZXNrdG9wDQpjbGllbnRhLmV4ZQ0KRmFsc2UNCkZhbHNlDQpUcnVlDQp", "payload_snippet": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b95b6bf095534125312900ebd458ca553bc4ab42", "protocol_details": { "payload_preview": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "port": 10134 }, "evidence_snippet": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "145.ll\|'\|'\|SGFjS2VkX0Q0OTkwNjI3\|'\|'\|WIN-JNAPIER0859\|'\|'\|JNapier\|'\|'\|19-02-01\|'\|'\|\|'\|'\|Win 7 Professional SP1 x64\|'\|'\|No\|'\|'\|0.7d", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:56 UTC	TCP	10134	—	Protocole TDS MSSQL mssql tds · port 10134 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload Htj��#D�+��l�׍��Jn��xu[l�E-j��xL�r�u�%�Rtgfv�]%̀ �Ϯ��fȍD� � Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Htj��#D�+��l�׍��Jn��xu[l�E-j��xL�r�u�%�Rtgfv�]%̀�Ϯ��fȍD� � Meta JSON brut { "bytes_in": 76, "payload_entropy": 5.800559092390959, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0356", "pat-0554" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0356", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ce42628f54668ae436e0cba19c9ae85c", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 10134, "risk_score": 32 }, "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "evidence": { "request_sample": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "payload_snippet": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "585b311c357e070d3729aa4a0439564ccf09395a", "protocol_details": { "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "port": 10134 }, "evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "attack_vector": "mssql tds \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 15, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "H\u0000\u0000\u0000tj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u0019\u05cd\ufffd\u0018\ufffdJ\u001en\ufffd\ufffdxu[l\ufffdE\u001d-j\ufffd\ufffdxL\ufffdr\ufffd\u0015\u0010u\ufffd%\ufffdRtg\u0005fv\ufffd]%\u0300\f\ufffd\u03ee\u0000\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "port": 10134 }, "attack_vector": "mssql tds \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "Htj\ufffd\ufffd#D\ufffd+\ufffd\ufffdl\ufffd\u05cd\ufffd\ufffdJn\ufffd\ufffdxu[l\ufffdE-j\ufffd\ufffdxL\ufffdr\ufffdu\ufffd%\ufffdRtgfv\ufffd]%\u0300\ufffd\u03ee\ufffd\ufffdf\u020dD\ufffd\t\ufffd", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:55 UTC	TCP	10134 · TLS	tls	Sonde TLS tls probe · via TLS:10134 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 cbcd1d81f242de31 SNI ABC-U6U673WEF Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ABC-U6U673WEF Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Service TLS SNI TLS ABC-U6U673WEF Payload tpYF}�3Ӣ'O��1p�F妢� } �O)u��5/� � 82 / ABC-U6U673WEF � Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) tpYF}�3Ӣ'O��1p�F妢�}�O)u��5/� � 82 / ABC-U6U673WEF � Meta JSON brut { "tls_ja3_hash": "cbcd1d81f242de31fd683d5acbc70dca", "tls_sni": "ABC-U6U673WEF", "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 121, "payload_entropy": 4.905270087972374, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "tls", "app_proto": "tls", "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "2dfb2075f946432eaac5f5a0558cb1cb9da91f85", "event_fingerprint": "8603107b7ce8e9de2be0091b978dd9c8ca9ca2e1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "ja3": "cbcd1d81f242de31fd683d5acbc70dca", "payload_hash": "f1259f03732f4007ef7053cbd91b8852", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "ja4": "aa2c14256328734fbc594089fa198c52", "tls_version": "0x0301", "tls_cipher_count": 12, "tls_sni": "ABC-U6U673WEF", "ja3_client_category": "nmap_scanner" }, "tls_ja3": "769,49172-49171-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0", "tls_ja4_hash": "aa2c14256328734fbc594089fa198c52", "tls_ja4": "t13d0112_b95786268cb1_d63375ab50e9", "tls_version": "0x0301", "tls_cipher_count": 12, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 10134, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000", "payload_snippet": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24dd0616f51a5d3c056aed35e58a433bd7f0d947", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca", "tls_ja4": "aa2c14256328734fbc594089fa198c52", "tls_sni": "ABC-U6U673WEF", "port": 10134, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd", "attack_vector": "tls probe \u00b7 via TLS:10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000t\u0001\u0000\u0000p\u0003\u0001YF}\ufffd3\u04e2'O\ufffd\ufffd\u00041p\ufffdF\u59a2\u0018\ufffd\u000b}\f\ufffdO)u\ufffd\ufffd\ufffd\u0000\u0000\u0018\ufffd\u0014\ufffd\u0013\u00005\u0000\/\ufffd\n\ufffd\t\u00008\u00002\u0000\n\u0000\u0013\u0000\u0005\u0000\u0004\u0001\u0000\u0000\/\u0000\u0000\u0000\u0012\u0000\u0010\u0000\u0000\rABC-U6U673WEF\u0000\n\u0000\u0006\u0000\u0004\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000", "tls_ja3": "cbcd1d81f242de31fd683d5acbc70dca", "tls_ja4": "aa2c14256328734fbc594089fa198c52", "tls_sni": "ABC-U6U673WEF", "port": 10134, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "tpYF}\ufffd3\u04e2'O\ufffd\ufffd1p\ufffdF\u59a2\ufffd}\ufffdO)u\ufffd\ufffd\ufffd\ufffd\ufffd5\/\ufffd\n\ufffd\t82\n\/\rABC-U6U673WEF\n\ufffd", "target_port_label": "10134 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ], "asn_dc_heuristic": true }
05/07/2026 07:54:55 UTC	TCP	10134 · HTTP	http	http http · via HTTP:10134 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10134 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61% Confiance classification 69% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 20, "risk_classification": 8, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e9584406513399930e58481309767d0a34c67a18", "event_fingerprint": "409a37750ef53e12435fb6f55cc801ced193ee0e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 10134, "service": "http", "service_name": "http", "risk_score": 35 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%" }, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.69, "classification_confidence": 0.69, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5d2437bc37a6a3753d9ba6e3426c3fd6508f288d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 10134, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "http \u00b7 via HTTP:10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 69, "confidence_breakdown": { "waf": 20, "classification": 8, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10134, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 10134, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "10134 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua" ], "asn_dc_heuristic": true }
05/07/2026 07:54:55 UTC	TCP	10134	—	Sonde OPC-UA opcua probe · port 10134 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Payload HELP Pourquoi cette classification : Type « opcua_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0626 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) OPC UA HEL User-Agent — Règles WAF — Payload (extrait) HELP Meta JSON brut { "bytes_in": 6, "payload_entropy": 2.584962500721156, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0626" ], "kb_rule_ids": [ "pat-0626" ], "matched_patterns": [ "pat-0626" ], "matched_pattern_names": [ "OPC UA HEL" ], "pattern_ids": [ "pat-0626" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fb323af48498fcb3974ce6b1881c8797", "path_pattern_hash": "9665a326f7d8f70f1661dab78807b951" }, "target_context": { "dst_port": 10134, "risk_score": 35 }, "payload_preview": "HELP\r\n", "request_sample": "HELP\r\n", "payload_snippet": "HELP", "evidence": { "request_sample": "HELP\r\n", "payload_snippet": "HELP", "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a70237c0c1aa272c1ddfed878c395a2843b47f2", "protocol_details": { "payload_preview": "HELP", "port": 10134 }, "evidence_snippet": "HELP", "attack_vector": "opcua probe \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "pat-0626" ], "tags_summary_labels_fr": [ "pat-0626" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "HELP", "port": 10134 }, "attack_vector": "opcua probe \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": "HELP", "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10134", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
05/07/2026 07:54:53 UTC	TCP	10134	—	Sonde port Sonde port · port 10134 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10134 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "DigitalOcean, LLC", "service": null, "app_proto": null, "asn": 14061, "country": "US", "dst_port": 10134, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a81c7e9a888e5e1e5dc66e7ee887500ddd014aec", "event_fingerprint": "28c792bc752d80938f425e1c3d97cb729a3a65f2", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10134, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b8ac2702f32a41f87cd3ece74b75a551c413ca3", "protocol_details": { "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "target_port_label": "10134", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10134, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 10134 }, "attack_vector": "Sonde port \u00b7 port 10134 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10134", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10134" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
29/06/2026 15:37:26 UTC	TCP	27017 · MONGODB	mongodb	Protocole wire MongoDB mongodb wire protocol · via MONGODB:27017 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur MONGODB WAF — Recommandation Surveiller Tags mongodb_emulated mongodb_wire_protocol net_mongodb_wire_protocol tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27017 Chemin / cible — Service MONGODB Payload �"-�Y�!�}�U1��B<qn��+��,O'h� �hs��_h��%��)��g "-�Z&��,�0��̨̩̪��]�a�W�S��+�/�� Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 80% Confiance classification 80% Risque capteur Faible · 33 Confiance : Confiance 80 % — 4 signal(aux) capteur Protocole émulé 1 Signaux ET-PROTO-MongoDB-Wire Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �"-�Y�!�}�U1��B<qn��+��,O'h� �hs��_h��%��)��g "-�Z&��,�0��̨̩̪��]�a�W�S��+�/�� Requête brute (extrait) �"-�Y�!�}�U1��B<qn��+��,O'h� �hs��_h��%��)��g "-�Z&��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32ED�4F��Q��P=�<�5�/A� Meta JSON brut { "protocol_emulated": true, "emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00", "emulator_response_len": 62, "bytes_in": 517, "payload_entropy": 5.105589712366124, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "mongodb", "app_proto": "mongodb", "asn": 14061, "country": "US", "dst_port": 27017, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15 }, "risk_score": 33, "tag_count": 4, "anomaly_count": 0, "campaign_key": "280a95715c5eaf3778f9712fc1d744ce21252865", "event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "confidence": 0.8, "classification_confidence": 0.8, "precision_score": 90, "precision_signals": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "kb_rule_ids": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "mongodb", "risk_confidence_factor": 80, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "00d46025c5a943ec55edc3a5568b6314", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 27017, "service": "mongodb", "service_name": "mongodb", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"-\ufffdY\ufffd!\ufffd}\ufffd\u001fU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,\u0017O'h\ufffd \ufffd\u0013hs\ufffd\ufffd_h\ufffd\ufffd\u0018\ufffd\ufffd%\ufffd\ufffd\u0006\ufffd)\ufffd\ufffd\u0011g\u000b\n\"\u0010-\ufffdZ&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"-\ufffdY\ufffd!\ufffd}\ufffd\u001fU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,\u0017O'h\ufffd \ufffd\u0013hs\ufffd\ufffd_h\ufffd\ufffd\u0018\ufffd\ufffd%\ufffd\ufffd\u0006\ufffd)\ufffd\ufffd\u0011g\u000b\n\"\u0010-\ufffdZ&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000E\u0000D\ufffd\u0018\u00004\u0000F\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001\u0005", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"-\ufffdY\ufffd!\ufffd}\ufffd\u001fU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,\u0017O'h\ufffd \ufffd\u0013hs\ufffd\ufffd_h\ufffd\ufffd\u0018\ufffd\ufffd%\ufffd\ufffd\u0006\ufffd)\ufffd\ufffd\u0011g\u000b\n\"\u0010-\ufffdZ&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7049c0a299e9d7db49251fd94e473c592f96792b", "protocol_details": { "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)", "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"-\ufffdY\ufffd!\ufffd}\ufffd\u001fU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,\u0017O'h\ufffd \ufffd\u0013hs\ufffd\ufffd_h\ufffd\ufffd\u0018\ufffd\ufffd%\ufffd\ufffd\u0006\ufffd)\ufffd\ufffd\u0011g\u000b\n\"\u0010-\ufffdZ&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 27017, "service": "mongodb", "service_label_fr": "MONGODB" }, "evidence_snippet": "\ufffd\"-\ufffdY\ufffd!\ufffd}\ufffdU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,O'h\ufffd \ufffdhs\ufffd\ufffd_h\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd)\ufffd\ufffdg\n\"-\ufffdZ&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)", "target_port_label": "27017 \u00b7 MONGODB", "emulator_service": "mongodb", "confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 80, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "mongodb", "service_label_fr": "MONGODB", "dst_port": 27017, "protocol_emulated": true, "tags_summary": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "tags_summary_labels_fr": [ "ET-PROTO-MongoDB-Wire", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-mongodb", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)", "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"-\ufffdY\ufffd!\ufffd}\ufffd\u001fU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,\u0017O'h\ufffd \ufffd\u0013hs\ufffd\ufffd_h\ufffd\ufffd\u0018\ufffd\ufffd%\ufffd\ufffd\u0006\ufffd)\ufffd\ufffd\u0011g\u000b\n\"\u0010-\ufffdZ&\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd", "port": 27017, "service": "mongodb", "service_label_fr": "MONGODB" }, "attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\"-\ufffdY\ufffd!\ufffd}\ufffdU1\ufffd\ufffd\ufffd\ufffdB<qn\ufffd\ufffd+\ufffd\ufffd\ufffd,O'h\ufffd \ufffdhs\ufffd\ufffd_h\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd)\ufffd\ufffdg\n\"-\ufffdZ&\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd", "target_port_label": "27017 \u00b7 MONGODB", "emulator_service": "mongodb", "confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "mongodb", "service_banner": "honeypot-mongodb", "service_os": "linux", "dst_port": "27017" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_emulated", "mongodb_wire_protocol", "net_mongodb_wire_protocol", "tls_clienthello" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
01/06/2026 18:48:49 UTC	TCP	3388	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
01/06/2026 18:48:49 UTC	TCP	3388	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
01/06/2026 18:48:49 UTC	TCP	3388	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:38 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:38 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:37 UTC	TCP	3355	—	Sonde port	Faible	Faible · 5
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:37 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:37 UTC	TCP	3355	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:36 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:36 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:35 UTC	TCP	3355	—	Sonde port	Faible	Faible · 5
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:34 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:34 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:33 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:33 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:32 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:31 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:30 UTC	TCP	3355	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie_alt Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:30 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:29 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:28 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:28 UTC	TCP	3355	—	Sonde RDP	Élevée	Moyen · 62
Étape — WAF — Recommandation — Tags rdp_cookie Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:27 UTC	TCP	3355	http	web attack	Élevée	Critique · 100
Étape — WAF 28 Recommandation — Tags 950318:lfi-14 950326:rce-0 950382:rce-14 950470:nosqli-3 Cible HTTP OPTIONS sip:nm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode OPTIONS Port 3355 Chemin / cible sip:nm Ligne de requête `OPTIONS / HTTP/1.1` User-Agent — Règles WAF 950318:lfi-14 950326:rce-0 950382:rce-14 950470:nosqli-3 Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "edfbcd9ebc2dbd247c08b04deff9a93e0b578f9b", "http_referer_hash": null, "http_method": "OPTIONS", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 223, "payload_entropy": 5.197167462839961, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "tag_count": 6, "anomaly_count": 0, "risk_score": 100, "campaign_key": "a42e8f14c7a626740b0703bd594e070d8ead6158", "event_fingerprint": "b46ef03b97d7804e9d80db4174785a8a0d19ebb4", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950382:rce-14", "950470:nosqli-3", "http_no_ua", "net_slowloris" ] }
28/05/2026 15:27:26 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:26 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:25 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:24 UTC	TCP	3355	http	web attack	Élevée	Critique · 100
Étape — WAF 14 Recommandation — Tags 950468:nosqli-3 950521:leak-8 http_backup_path http_no_ua Cible HTTP GET /nice%20ports%2C/Tri%6Eity.txt%2ebak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3355 Chemin / cible /nice%20ports%2C/Tri%6Eity.txt%2ebak Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF 950468:nosqli-3 950521:leak-8 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "txt%2ebak", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d066bf27e875af60909a0d3da6a23b2b7d239bc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 53, "payload_entropy": 4.704058897836964, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "tag_count": 4, "anomaly_count": 0, "risk_score": 100, "campaign_key": "66d1744a977fe789cfd707ce3a4742a516864494", "event_fingerprint": "445bbd11d7e9031144a14eec854d84c1aee2f651", "tags_list": [ "950468:nosqli-3", "950521:leak-8", "http_backup_path", "http_no_ua" ] }
28/05/2026 15:27:23 UTC	TCP	3355	—	Sonde port	Faible	Faible · 0
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1
28/05/2026 15:27:22 UTC	TCP	3355	—	Sonde port	Faible	Faible · 5
Étape — WAF — Recommandation — Tags — Cible HTTP — TLS SNI — Capteur paris-1

104.248.228.78

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence