Méthode
—
Port
20000
Chemin / cible
—
Service
DNP3 TCP
Payload
� �ɏ�^i���T���xt=� rC %��Fi���� e�j;��4/�c����9t��H������w�=^� �+�/�,�0̨̩� �� � E �
Pourquoi cette classification : Type « dnp3_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Ot Dnp3 Unauth
Ot Dnp3 Variants
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ɏ�^i���T���xt=� rC %��Fi���� e�j;��4/�c����9t��H������w�=^� �+�/�,�0̨̩� ��
� E �
Requête brute (extrait)
� �ɏ�^i���T���xt=� rC %��Fi���� e�j;��4/�c����9t��H������w�=^� �+�/�,�0̨̩� �� � E � � + 3����&ؽ �P�1�9VZ�v�WL���gI(|s�W�֟�����QR�r����4�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "05000000000000000000",
"emulator_response_len": 10,
"bytes_in": 1457,
"payload_entropy": 7.7124618527989695,
"port_category": "registered",
"org": "CHINA UNICOM China169 Backbone",
"service": "dnp3-tcp",
"app_proto": "dnp3-tcp",
"asn": 4837,
"country": "CN",
"dst_port": 20000,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d5cd645b39d84501cdfd9334416cafc6e574358e",
"event_fingerprint": "14eebf67fd895c508f4342c40cf9531e8f997d62",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 157,
"precision_signals": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "dnp3-tcp",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 4837,
"org": "CHINA UNICOM China169 Backbone",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38d29b3e156824ad5e2706c040d20b88",
"path_pattern_hash": "859b07b9d78548343d57aca7faf5fc6a"
},
"target_context": {
"dst_port": 20000,
"service": "dnp3-tcp",
"service_name": "dnp3-tcp",
"risk_score": 38
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u024f\u0003\ufffd\u001b^i\ufffd\ufffd\ufffdT\ufffd\u0004\ufffd\ufffdxt=\ufffd\u0000rC\u000b%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\b\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005E\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u024f\u0003\ufffd\u001b^i\ufffd\ufffd\ufffdT\ufffd\u0004\ufffd\ufffdxt=\ufffd\u0000rC\u000b%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\b\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005E\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd&\u063d\u0000\ufffdP\ufffd1\ufffd9VZ\ufffdv\ufffdWL\ufffd\ufffd\ufffdgI(|s\ufffdW\ufffd\u059f\u000f\ufffd\ufffd\ufffd\u001a\ufffd\ufffdQ\u0001R\ufffdr\u0013\ufffd\ufffd\ufffd\ufffd4\u0018\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u024f\u0003\ufffd\u001b^i\ufffd\ufffd\ufffdT\ufffd\u0004\ufffd\ufffdxt=\ufffd\u0000rC\u000b%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\b\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005E\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60e74783c7dc9a95d84d9352f60f0c63de15427e",
"protocol_details": {
"dnp3_probe_fr": "Sonde DNP3 (SCADA \u00e9nergie)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u024f\u0003\ufffd\u001b^i\ufffd\ufffd\ufffdT\ufffd\u0004\ufffd\ufffdxt=\ufffd\u0000rC\u000b%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\b\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005E\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 20000,
"service": "dnp3-tcp",
"service_label_fr": "DNP3 TCP"
},
"evidence_snippet": "\ufffd\ufffd\u024f\ufffd^i\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdxt=\ufffdrC%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdE\ufffd",
"attack_vector": "dnp3 probe \u00b7 via DNP3 TCP:20000 \u00b7 (sonde \/ probe)",
"target_port_label": "20000 \u00b7 DNP3 TCP",
"emulator_service": "dnp3-tcp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "dnp3-tcp",
"service_label_fr": "DNP3 TCP",
"dst_port": 20000,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-dnp3-unauth",
"INT-OT-dnp3-variants",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Dnp3 Unauth",
"Ot Dnp3 Variants",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dnp3-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"dnp3_probe_fr": "Sonde DNP3 (SCADA \u00e9nergie)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u024f\u0003\ufffd\u001b^i\ufffd\ufffd\ufffdT\ufffd\u0004\ufffd\ufffdxt=\ufffd\u0000rC\u000b%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\b\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005E\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 20000,
"service": "dnp3-tcp",
"service_label_fr": "DNP3 TCP"
},
"attack_vector": "dnp3 probe \u00b7 via DNP3 TCP:20000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u024f\ufffd^i\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffdxt=\ufffdrC%\ufffd\ufffdFi\ufffd\ufffd\ufffd\ufffd e\ufffdj;\ufffd\ufffd4\/\ufffdc\ufffd\ufffd\ufffd\ufffd9t\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd=^\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdE\ufffd",
"target_port_label": "20000 \u00b7 DNP3 TCP",
"emulator_service": "dnp3-tcp",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dnp3_tcp",
"service_banner": "honeypot-dnp3-tcp",
"service_os": "linux",
"dst_port": "20000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"dnp3_emulated",
"dnp3_probe",
"net_dnp3_probe",
"tls_clienthello"
]
}
|