15/07/2026 01:59:44 UTC
TCP
1433 · MSSQL
Sonde PostgreSQL
postgres probe · via MSSQL:1433 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
� �&L9����M�|m�4�A��C6���.�L�� �ޕ�%I�9��@��"$���9�:B�;\&��� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �&L9����M�|m�4�A��C6���.�L�� �ޕ�%I�9��@��"$���9�:B�;\&��� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �&L9����M�|m�4�A��C6���.�L�� �ޕ�%I�9��@��"$���9�:B�;\&��� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��7��9w�Yg�GE��?JϿ�k��Cp���\�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 243,
"payload_entropy": 5.834601335516908,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "mssql",
"app_proto": "mssql",
"asn": 16509,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3e132be9d015561314263556e5fb71c3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0006L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\u0004\ufffd4\u0012\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\u001b\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\u0012\ufffd\ufffd\u0006\"\u0010$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0006L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\u0004\ufffd4\u0012\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\u001b\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\u0012\ufffd\ufffd\u0006\"\u0010$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd7\ufffd\ufffd9w\ufffdYg\ufffdGE\ufffd\ufffd?J\u03ff\ufffdk\ufffd\ufffdCp\ufffd\ufffd\ufffd\\\ufffd\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0006L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\u0004\ufffd4\u0012\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\u001b\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\u0012\ufffd\ufffd\u0006\"\u0010$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "066287d823fe923985b00b7b3305a7b18bdfd910",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0006L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\u0004\ufffd4\u0012\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\u001b\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\u0012\ufffd\ufffd\u0006\"\u0010$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\ufffd\ufffd&L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\ufffd4\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\ufffd\ufffd\"$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003&\u0006L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\u0004\ufffd4\u0012\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\u001b\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\u0012\ufffd\ufffd\u0006\"\u0010$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd&L9\ufffd\ufffd\ufffd\ufffdM\ufffd|m\ufffd4\ufffdA\ufffd\ufffdC6\ufffd\ufffd\ufffd.\ufffdL\ufffd\ufffd \ufffd\u0795\ufffd%I\ufffd9\ufffd\ufffd@\ufffd\ufffd\"$\ufffd\ufffd\ufffd9\ufffd:B\ufffd;\\&\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:59:40 UTC
TCP
1433 · MSSQL
Protocole TDS MSSQL
mssql tds · via MSSQL:1433 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
mssql_probe
mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
/ ! " & �
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Faible
· 35
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0519
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
MSSQL TDS prelogin
Mumble ping
STUN binding
Minecraft varint handshake
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
/ ! " & �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 47,
"payload_entropy": 2.407956137576773,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "mssql",
"app_proto": "mssql",
"asn": 16509,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10
},
"risk_score": 35,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "584dc8ab43572550a5af46f03637ac724e8c86c3",
"event_fingerprint": "24635733bde8ab881cad2aa5e51b4b5bf5e45e9f",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0519",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0519",
"INT-upstream"
],
"matched_patterns": [
"pat-0519",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"matched_pattern_names": [
"MSSQL TDS prelogin",
"Mumble ping",
"STUN binding",
"Minecraft varint handshake",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0519",
"pat-0768",
"pat-0771",
"pat-0554",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d4de02e442f4f701f78f2c23d15b264",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 35
},
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bddf573a42c5574e83a88d93f5b865f30206c11",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\/ !\"&\ufffd",
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 10,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0519",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0519",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\/ !\"&\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"mssql_probe",
"mssql_tds",
"net_mssql_tds"
],
"asn_dc_heuristic": true
}
15/07/2026 01:58:16 UTC
TCP
1433 · MSSQL
Sonde PostgreSQL
postgres probe · via MSSQL:1433 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
mssql_emulated
mssql_payload
net_mssql_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
����Qu�h���C?����%�V(kn��3L։v Z�q5B�Mc誘/�IJ߿m�%ޤ>�����5 &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
����Qu�h���C?����%�V(kn��3L։v Z�q5B�Mc誘/�IJ߿m�%ޤ>�����5 &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
����Qu�h���C?����%�V(kn��3L։v Z�q5B�Mc誘/�IJ߿m�%ޤ>�����5 &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ ����š+U![����ki�����A ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 261,
"payload_entropy": 5.886189946758882,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "mssql",
"app_proto": "mssql",
"asn": 16509,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "37051d253c792a703ef86a951fdecd81bbfe50e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9c51707331e0ac68d8652d9ebc1f21c9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdQ\u0003u\ufffdh\u001a\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\u0012\ufffdV(kn\ufffd\ufffd3L\u0589v \u0014Z\ufffd\u0019q5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\u0013\ufffd\ufffd\ufffd\ufffd5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdQ\u0003u\ufffdh\u001a\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\u0012\ufffdV(kn\ufffd\ufffd3L\u0589v \u0014Z\ufffd\u0019q5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\u0013\ufffd\ufffd\ufffd\ufffd5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\u000f\ufffd\u0161+U![\ufffd\ufffd\ufffd\ufffd\u000eki\ufffd\ufffd\ufffd\ufffd\ufffdA\n\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdQ\u0003u\ufffdh\u001a\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\u0012\ufffdV(kn\ufffd\ufffd3L\u0589v \u0014Z\ufffd\u0019q5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\u0013\ufffd\ufffd\ufffd\ufffd5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5cdf4fc60cd5148f320fcac57b4a8b984b53976e",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdQ\u0003u\ufffdh\u001a\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\u0012\ufffdV(kn\ufffd\ufffd3L\u0589v \u0014Z\ufffd\u0019q5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\u0013\ufffd\ufffd\ufffd\ufffd5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdQu\ufffdh\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\ufffdV(kn\ufffd\ufffd3L\u0589v Z\ufffdq5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\ufffd\ufffd\ufffd\ufffd5&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdQ\u0003u\ufffdh\u001a\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\u0012\ufffdV(kn\ufffd\ufffd3L\u0589v \u0014Z\ufffd\u0019q5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\u0013\ufffd\ufffd\ufffd\ufffd5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "postgres probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdQu\ufffdh\ufffd\ufffd\ufffdC?\ufffd\ufffd\ufffd\ufffd%\ufffdV(kn\ufffd\ufffd3L\u0589v Z\ufffdq5B\ufffdMc\u8a98\/\ufffdIJ\u07ffm\ufffd%\u07a4>\ufffd\ufffd\ufffd\ufffd\ufffd5&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_emulated",
"mssql_payload",
"net_mssql_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:57:19 UTC
TCP
1433 · MSSQL
mssql probe
mssql probe · via MSSQL:1433 · (sonde / probe)
Élevée
Faible · 36
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
mssql_emulated
mssql_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « mssql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1433
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 191,
"payload_entropy": 5.272123906004049,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "mssql",
"app_proto": "mssql",
"asn": 16509,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25
},
"risk_score": 36,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f93adaca9f40880298f96a6f0f3e4baf34caa9e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "46c1800dd34e749f25d846934f1d9fd0",
"path_pattern_hash": "6d4ca317e1154f7afb07772c79279a04"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe27afa46ec09b3f470fc35524753709c2a29c61",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 36\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"mssql_emulated",
"mssql_payload",
"net_mssql_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:55:50 UTC
TCP
1433 · MSSQL
mssql probe
mssql probe · via MSSQL:1433 · (sonde / probe)
Élevée
Faible · 36
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MSSQL
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
mssql_emulated
mssql_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1433
Chemin / cible
—
Service
MSSQL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « mssql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1433
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1433 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "001f00001a00060000000000000000000000000000000000000000000000000000",
"emulator_response_len": 33,
"bytes_in": 191,
"payload_entropy": 5.272123906004049,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "mssql",
"app_proto": "mssql",
"asn": 16509,
"country": "US",
"dst_port": 1433,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25
},
"risk_score": 36,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f93adaca9f40880298f96a6f0f3e4baf34caa9e9",
"event_fingerprint": "6e104f6072c052d0dd22893d2f1fa140642f7c7c",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "mssql",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "46c1800dd34e749f25d846934f1d9fd0",
"path_pattern_hash": "6d4ca317e1154f7afb07772c79279a04"
},
"target_context": {
"dst_port": 1433,
"service": "mssql",
"service_name": "mssql",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe27afa46ec09b3f470fc35524753709c2a29c61",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mssql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 36\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 25,
"risk_score": 36,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "mssql",
"service_label_fr": "MSSQL",
"dst_port": 1433,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mssql",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"mssql_tds_fr": "Connexion TDS Microsoft SQL Server",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 1433,
"service": "mssql",
"service_label_fr": "MSSQL"
},
"attack_vector": "mssql probe \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1433\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "1433 \u00b7 MSSQL",
"emulator_service": "mssql",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mssql",
"service_banner": "honeypot-mssql",
"service_os": "linux",
"dst_port": "1433"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http-alt-8087",
"mssql"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"mssql_emulated",
"mssql_payload",
"net_mssql_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:51:12 UTC
TCP
8087 · HTTP ALT 8087
Sonde PostgreSQL
postgres probe · via HTTP ALT 8087:8087 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
� ��a�7.Ea�\��6tE�u�� �����#I� 5 ��E�I0�ԋ���4Ѱ\�B�s�K�v�*�� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��a�7.Ea�\��6tE�u�� �����#I�
5 ��E�I0�ԋ���4Ѱ\�B�s�K�v�*�� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��a�7.Ea�\��6tE�u�� �����#I� 5 ��E�I0�ԋ���4Ѱ\�B�s�K�v�*�� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �I�`�Z�+����J�]����(} ��0�$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 243,
"payload_entropy": 5.805739055419147,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 16509,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "423bc3e2f68058b0b09cf95bcc2351b8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\ufffd7.Ea\ufffd\u0007\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\u0011\u001e\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u0019\u050b\ufffd\ufffd\u0006\ufffd4\u0010\u0004\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\ufffd7.Ea\ufffd\u0007\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\u0011\u001e\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u0019\u050b\ufffd\ufffd\u0006\ufffd4\u0010\u0004\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdI\u000f\ufffd`\ufffdZ\ufffd\u0003+\u0019\ufffd\ufffd\ufffd\ufffdJ\ufffd]\ufffd\ufffd\u001b\ufffd\ufffd(}\f\ufffd\ufffd\b0\ufffd$",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\ufffd7.Ea\ufffd\u0007\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\u0011\u001e\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u0019\u050b\ufffd\ufffd\u0006\ufffd4\u0010\u0004\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1135329862fd4b8d23b8ca2e9e645684cb87fd4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\ufffd7.Ea\ufffd\u0007\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\u0011\u001e\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u0019\u050b\ufffd\ufffd\u0006\ufffd4\u0010\u0004\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "\ufffd\ufffd\ufffda\ufffd7.Ea\ufffd\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u050b\ufffd\ufffd\ufffd4\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\ufffd7.Ea\ufffd\u0007\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\u0011\u001e\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u0019\u050b\ufffd\ufffd\u0006\ufffd4\u0010\u0004\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffda\ufffd7.Ea\ufffd\\\ufffd\ufffd6tE\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd#I\ufffd\r5 \ufffd\ufffdE\ufffdI0\ufffd\u050b\ufffd\ufffd\ufffd4\u0470\\\ufffdB\ufffds\ufffdK\ufffdv\ufffd*\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:51:03 UTC
TCP
31337 · ELITE
Sonde PostgreSQL
postgres probe · via ELITE:31337 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
ELITE
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
31337
Chemin / cible
—
Service
ELITE
Payload
� ��-rcW��Bh����2I���yOߡa=��P A�� �l� H虽a��UT +���/�_A��f��+� �� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��-rcW��Bh����2I���yOߡa=��P A�� �l� H虽a��UT +���/�_A��f��+� �� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��-rcW��Bh����2I���yOߡa=��P A�� �l� H虽a��UT +���/�_A��f��+� �� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ��J��,��˶��}���% p��8P�:�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
"emulator_response_len": 37,
"bytes_in": 243,
"payload_entropy": 5.843450823878081,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "elite",
"app_proto": "elite",
"asn": 16509,
"country": "US",
"dst_port": 31337,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1156c7378241b4822d39ec38bf8d9c9211c21a28",
"event_fingerprint": "7476baba50c40221e6be25a2178d5866bd6087e1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elite",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ba3dc913a7153304af251f88c9b20f7b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 31337,
"service": "elite",
"service_name": "elite",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\u0001\ufffdP A\ufffd\ufffd \ufffdl\ufffd\u0000H\u867da\ufffd\ufffdUT\u001d+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\u001f\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\u0001\ufffdP A\ufffd\ufffd \ufffdl\ufffd\u0000H\u867da\ufffd\ufffdUT\u001d+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\u001f\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0004\ufffd\ufffdJ\ufffd\ufffd\u0010,\ufffd\ufffd\u0004\u02f6\ufffd\ufffd}\ufffd\ufffd\ufffd% p\ufffd\ufffd8P\ufffd:\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\u0001\ufffdP A\ufffd\ufffd \ufffdl\ufffd\u0000H\u867da\ufffd\ufffdUT\u001d+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\u001f\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99fa881f71e58f4b7a0db573c0408d76adfc4914",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\u0001\ufffdP A\ufffd\ufffd \ufffdl\ufffd\u0000H\u867da\ufffd\ufffdUT\u001d+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\u001f\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\ufffdP A\ufffd\ufffd \ufffdl\ufffdH\u867da\ufffd\ufffdUT+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "elite",
"service_label_fr": "ELITE",
"dst_port": 31337,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-elite",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\u0001\ufffdP A\ufffd\ufffd \ufffdl\ufffd\u0000H\u867da\ufffd\ufffdUT\u001d+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\u001f\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd-rcW\ufffd\ufffdBh\ufffd\ufffd\ufffd\ufffd2I\ufffd\ufffd\ufffdyO\u07e1a=\ufffd\ufffdP A\ufffd\ufffd \ufffdl\ufffdH\u867da\ufffd\ufffdUT+\ufffd\ufffd\ufffd\/\ufffd_A\ufffd\ufffdf\ufffd\ufffd+\ufffd\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elite",
"service_banner": "honeypot-elite",
"service_os": "linux",
"dst_port": "31337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:49:58 UTC
TCP
31337 · ELITE
Sonde PostgreSQL
postgres probe · via ELITE:31337 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ELITE
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
31337
Chemin / cible
—
Service
ELITE
Payload
���(�x��:'��h�'$���Y��O7�p6���] ;�C��� C̓ʼn��]�،�l| �=��P�``�� &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���(�x��:'��h�'$���Y��O7�p6���] ;�C���
C̓ʼn��]�،�l| �=��P�``�� &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
���(�x��:'��h�'$���Y��O7�p6���] ;�C��� C̓ʼn��]�،�l| �=��P�``�� &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ ."b��ֲ3ժĵW���eF�=]"Y畢
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
"emulator_response_len": 37,
"bytes_in": 261,
"payload_entropy": 5.95322768232709,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "elite",
"app_proto": "elite",
"asn": 16509,
"country": "US",
"dst_port": 31337,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1156c7378241b4822d39ec38bf8d9c9211c21a28",
"event_fingerprint": "7476baba50c40221e6be25a2178d5866bd6087e1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elite",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "83e09e141225fb6a9cbfbbe44baefd00",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 31337,
"service": "elite",
"service_name": "elite",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0007\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\u0015\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\f\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0007\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\u0015\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\f\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 .\"b\ufffd\ufffd\u05b23\u056a\u0135W\ufffd\ufffd\ufffdeF\ufffd=]\"Y\u0011\u7562",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0007\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\u0015\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\f\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2e6d07bfaf6a269dab42b8dd972ce3b0adc0f58",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0007\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\u0015\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\f\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "elite",
"service_label_fr": "ELITE",
"dst_port": 31337,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-elite",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0007\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\u0015\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\f\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"attack_vector": "postgres probe \u00b7 via ELITE:31337 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd(\ufffdx\ufffd\ufffd:'\ufffd\ufffdh\ufffd'$\ufffd\ufffd\ufffdY\ufffd\ufffdO7\ufffdp6\ufffd\ufffd\ufffd] ;\ufffdC\ufffd\ufffd\ufffd\nC\u0343\u0149\ufffd\ufffd]\ufffd\u060c\ufffdl|\ufffd=\ufffd\ufffdP\ufffd``\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elite",
"service_banner": "honeypot-elite",
"service_os": "linux",
"dst_port": "31337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:49:47 UTC
TCP
8087 · HTTP ALT 8087
Sonde PostgreSQL
postgres probe · via HTTP ALT 8087:8087 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
���(I��U�x%#WW%h�| ��_�ڵ��n? �f�%s�W�;��g���iH F���آ &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
���(I��U�x%#WW%h�| ��_�ڵ��n? �f�%s�W�;��g���iH F���آ &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
���(I��U�x%#WW%h�| ��_�ڵ��n? �f�%s�W�;��g���iH F���آ &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ �U Lmg�DF�a4��ϖ�+��u���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 261,
"payload_entropy": 5.912269996748954,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 16509,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "10172cab5a7082ab4b8ce224b7e15560",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#\u0015WW\u0018%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn\b? \ufffdf\ufffd%s\ufffdW\ufffd;\u001b\ufffd\ufffdg\ufffd\u0002\ufffd\ufffdiH\u0530\u001e\u0012F\ufffd\ufffd\ufffd\u0622\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#\u0015WW\u0018%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn\b? \ufffdf\ufffd%s\ufffdW\ufffd;\u001b\ufffd\ufffdg\ufffd\u0002\ufffd\ufffdiH\u0530\u001e\u0012F\ufffd\ufffd\ufffd\u0622\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdU\u000bLmg\ufffdDF\ufffda4\ufffd\ufffd\u03d6\ufffd+\ufffd\ufffdu\u0004\ufffd\ufffd\u0014\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#\u0015WW\u0018%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn\b? \ufffdf\ufffd%s\ufffdW\ufffd;\u001b\ufffd\ufffdg\ufffd\u0002\ufffd\ufffdiH\u0530\u001e\u0012F\ufffd\ufffd\ufffd\u0622\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a3f3e9825bae96c26b88743b39ac6de189f73d5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#\u0015WW\u0018%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn\b? \ufffdf\ufffd%s\ufffdW\ufffd;\u001b\ufffd\ufffdg\ufffd\u0002\ufffd\ufffdiH\u0530\u001e\u0012F\ufffd\ufffd\ufffd\u0622\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "\ufffd\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#WW%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn? \ufffdf\ufffd%s\ufffdW\ufffd;\ufffd\ufffdg\ufffd\ufffd\ufffdiH\u0530F\ufffd\ufffd\ufffd\u0622&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#\u0015WW\u0018%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn\b? \ufffdf\ufffd%s\ufffdW\ufffd;\u001b\ufffd\ufffdg\ufffd\u0002\ufffd\ufffdiH\u0530\u001e\u0012F\ufffd\ufffd\ufffd\u0622\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd(I\ufffd\ufffdU\ufffdx%#WW%h\ufffd|\t\ufffd\ufffd_\ufffd\u06b5\ufffd\ufffdn? \ufffdf\ufffd%s\ufffdW\ufffd;\ufffd\ufffdg\ufffd\ufffd\ufffdiH\u0530F\ufffd\ufffd\ufffd\u0622&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:47:45 UTC
TCP
8087 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:8087 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 191,
"payload_entropy": 5.28806831206487,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
"payload_hash": "aef3b314da1c4104a5592c7a04474531",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e92a6203ed319fd7a6449f91aa63fff45c7b601",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "exploit attempt \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:47:41 UTC
TCP
31337 · ELITE
Botnet Mozi
mozi pattern · via ELITE:31337 · (commande & contrôle)
Élevée
Moyen · 44
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0011
TA0011
Protocole
Émulateur
ELITE
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
31337
Chemin / cible
—
Service
ELITE
Payload
GET / HTTP/1.1 Host: 62.3.50.33:31337 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:31337
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:31337 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
"emulator_response_len": 37,
"bytes_in": 192,
"payload_entropy": 5.254667484284625,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "elite",
"app_proto": "elite",
"asn": 16509,
"country": "US",
"dst_port": 31337,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ed27cae3d4203993c3214ee5af924d682b2df261",
"event_fingerprint": "dedfcc0e0ae3c1f1d74242325b1f511e1599f95e",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elite",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88374ff9279fcf89da5771a4b034c5ba",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 31337,
"service": "elite",
"service_name": "elite",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d31ed698f63b9f9bd954278901e2ba521b3d75d7",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"attack_vector": "mozi pattern \u00b7 via ELITE:31337 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via ELITE \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "elite",
"service_label_fr": "ELITE",
"dst_port": 31337,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-elite",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"attack_vector": "mozi pattern \u00b7 via ELITE:31337 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elite",
"service_banner": "honeypot-elite",
"service_os": "linux",
"dst_port": "31337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
],
"asn_dc_heuristic": true
}
15/07/2026 01:46:17 UTC
TCP
8087 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:8087 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 191,
"payload_entropy": 5.28806831206487,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
"payload_hash": "aef3b314da1c4104a5592c7a04474531",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e92a6203ed319fd7a6449f91aa63fff45c7b601",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "exploit attempt \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elite",
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:45:50 UTC
TCP
31337 · ELITE
Botnet Mozi
mozi pattern · via ELITE:31337 · (commande & contrôle)
Élevée
Moyen · 44
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0011
TA0011
Protocole
Émulateur
ELITE
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
31337
Chemin / cible
—
Service
ELITE
Payload
GET / HTTP/1.1 Host: 62.3.50.33:31337 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:31337
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:31337 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420656c69746520726561647920706f72743d33313333370d0a",
"emulator_response_len": 37,
"bytes_in": 192,
"payload_entropy": 5.254667484284625,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "elite",
"app_proto": "elite",
"asn": 16509,
"country": "US",
"dst_port": 31337,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 44,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ed27cae3d4203993c3214ee5af924d682b2df261",
"event_fingerprint": "dedfcc0e0ae3c1f1d74242325b1f511e1599f95e",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elite",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88374ff9279fcf89da5771a4b034c5ba",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 31337,
"service": "elite",
"service_name": "elite",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d31ed698f63b9f9bd954278901e2ba521b3d75d7",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"attack_vector": "mozi pattern \u00b7 via ELITE:31337 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via ELITE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "elite",
"service_label_fr": "ELITE",
"dst_port": 31337,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-elite",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"port": 31337,
"service": "elite",
"service_label_fr": "ELITE"
},
"attack_vector": "mozi pattern \u00b7 via ELITE:31337 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:31337\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome",
"target_port_label": "31337 \u00b7 ELITE",
"emulator_service": "elite",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elite",
"service_banner": "honeypot-elite",
"service_os": "linux",
"dst_port": "31337"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"elite",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
],
"asn_dc_heuristic": true
}
15/07/2026 01:45:06 UTC
TCP
8087 · HTTP ALT 8087
http-alt-8087
http-alt-8087 · via HTTP ALT 8087:8087 · (sonde / probe)
Faible
Faible · 2
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8087
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8087 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 2
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 16509,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 2,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6c638932416ef1b7c2d7f913329ae6daae9f0e0d",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab http-alt-8087 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 2
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "c7006f331efb41899f55976e30d06f91"
},
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 2
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab http-alt-8087 \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9848a7ed4429287e05a950d4ed12935de1cf7904",
"protocol_details": {
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "http-alt-8087 \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8087 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8087 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 2
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 2,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "http-alt-8087 \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
15/07/2026 01:21:39 UTC
TCP
502 · MODBUS
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
� �fa [ݪaJ�Q�<W�����SQvpP./<~�ҋ �]� 6��a� a}{<~{���-�.u� ��|jw &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �fa [ݪaJ�Q�<W�����SQvpP./<~�ҋ �]� 6��a� a}{<~{���-�.u� ��|jw &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� �fa [ݪaJ�Q�<W�����SQvpP./<~�ҋ �]� 6��a� a}{<~{���-�.u� ��|jw &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ ح��J�� w��W�agF'>�c�S�_� �r
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000020000",
"emulator_response_len": 5,
"bytes_in": 243,
"payload_entropy": 5.742236368271508,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "modbus",
"app_proto": "modbus",
"asn": 16509,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71872130bb5b9bc70e08e1195915be62e8b7489c",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3394afd0aeeb67f3da9c023d38eb048f",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003fa\u0000[\u076a\baJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\u000f\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd\u001e6\ufffd\ufffda\ufffd\u0000a}{<~{\ufffd\ufffd\u001b\ufffd-\ufffd\u0012.u\ufffd\u001f\ufffd\ufffd|jw\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003fa\u0000[\u076a\baJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\u000f\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd\u001e6\ufffd\ufffda\ufffd\u0000a}{<~{\ufffd\ufffd\u001b\ufffd-\ufffd\u0012.u\ufffd\u001f\ufffd\ufffd|jw\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010\u062d\ufffd\ufffd\bJ\ufffd\ufffd\u000bw\ufffd\ufffdW\ufffdagF'>\u0003\ufffdc\ufffdS\ufffd_\ufffd\n\ufffdr\u0006",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003fa\u0000[\u076a\baJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\u000f\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd\u001e6\ufffd\ufffda\ufffd\u0000a}{<~{\ufffd\ufffd\u001b\ufffd-\ufffd\u0012.u\ufffd\u001f\ufffd\ufffd|jw\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b13ea55c494d7a1d104ca116dbf15b88ebd7abe7",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003fa\u0000[\u076a\baJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\u000f\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd\u001e6\ufffd\ufffda\ufffd\u0000a}{<~{\ufffd\ufffd\u001b\ufffd-\ufffd\u0012.u\ufffd\u001f\ufffd\ufffd|jw\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "\ufffd\ufffdfa[\u076aaJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd6\ufffd\ufffda\ufffda}{<~{\ufffd\ufffd\ufffd-\ufffd.u\ufffd\ufffd\ufffd|jw&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003fa\u0000[\u076a\baJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\u000f\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd\u001e6\ufffd\ufffda\ufffd\u0000a}{<~{\ufffd\ufffd\u001b\ufffd-\ufffd\u0012.u\ufffd\u001f\ufffd\ufffd|jw\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdfa[\u076aaJ\ufffdQ\ufffd<W\ufffd\ufffd\ufffd\ufffd\ufffdSQvpP.\/<~\ufffd\u048b \ufffd]\ufffd6\ufffd\ufffda\ufffda}{<~{\ufffd\ufffd\ufffd-\ufffd.u\ufffd\ufffd\ufffd|jw&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:20:51 UTC
TCP
502 · MODBUS
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
ZG +
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 11,
"payload_entropy": 2.4040097573248604,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "modbus",
"app_proto": "modbus",
"asn": 16509,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1df3a12ec0dbfaa23bb48ea99bf5912c8211349a",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50a8707b6614ee00fe982271b4b17fce",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"request_sample": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"payload_snippet": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"evidence": {
"request_sample": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"payload_snippet": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "811516863b42c80c2f061991ac3cd779c3ed9335",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "ZG+",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "ZG+",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:20:18 UTC
TCP
502 · MODBUS
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
Élevée
Faible · 38
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T0836
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
modbus_emulated
net_modbus_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
����T�;b�r��3A���>���4+�N* x b �;7n@��������֧HX�[ ��JD��=GP� &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Faible
· 38
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
Ot Modbus Write
Ot Modbus Write Fc
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
����T�;b�r��3A���>���4+�N* x b �;7n@��������֧HX�[ ��JD��=GP� &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
����T�;b�r��3A���>���4+�N* x b �;7n@��������֧HX�[ ��JD��=GP� &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ C��?^ ��^V��a����r�R�/�k
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000020000",
"emulator_response_len": 5,
"bytes_in": 261,
"payload_entropy": 5.901416645805003,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "modbus",
"app_proto": "modbus",
"asn": 16509,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71872130bb5b9bc70e08e1195915be62e8b7489c",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 161,
"precision_signals": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"kb_rule_ids": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "361f3ac077f82b7be2f963206bfee8c9",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 38
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3\u0010\u0005A\ufffd\ufffd\ufffd>\ufffd\u0019\ufffd\ufffd\u00174+\ufffdN*\u001ex b\u001d\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\u001c\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3\u0010\u0005A\ufffd\ufffd\ufffd>\ufffd\u0019\ufffd\ufffd\u00174+\ufffdN*\u001ex b\u001d\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\u001c\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 C\u001b\ufffd\u0003\ufffd?^\u001d\ufffd\ufffd^V\ufffd\ufffda\ufffd\ufffd\ufffd\ufffdr\ufffd\u0017R\ufffd\/\ufffdk",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3\u0010\u0005A\ufffd\ufffd\ufffd>\ufffd\u0019\ufffd\ufffd\u00174+\ufffdN*\u001ex b\u001d\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\u001c\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T0836"
],
"mitre": "T0836",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1176da2e3861a9f8c79f8a6bf86c266e3b5a0d4",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3\u0010\u0005A\ufffd\ufffd\ufffd>\ufffd\u0019\ufffd\ufffd\u00174+\ufffdN*\u001ex b\u001d\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\u001c\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3A\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd4+\ufffdN*x b\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": [
"INT-OT-modbus-write",
"INT-OT-modbus-write-fc",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Ot Modbus Write",
"Ot Modbus Write Fc",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T0836",
"mitre_technique": "T0836",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3\u0010\u0005A\ufffd\ufffd\ufffd>\ufffd\u0019\ufffd\ufffd\u00174+\ufffdN*\u001ex b\u001d\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\u001c\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdT\ufffd;b\ufffdr\ufffd\ufffd3A\ufffd\ufffd\ufffd>\ufffd\ufffd\ufffd4+\ufffdN*x b\ufffd;7n@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u05a7HX\ufffd[\ufffd\ufffdJD\ufffd\ufffd=GP\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"modbus_emulated",
"net_modbus_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:19:13 UTC
TCP
502 · MODBUS
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
modbus_emulated
mozi_pattern
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:502 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/1
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 35
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:502
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/1
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:502 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 190,
"payload_entropy": 5.259974034515823,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "modbus",
"app_proto": "modbus",
"asn": 16509,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a4312436e102d379376cc96aec02d556b0131885",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afa70a818d0308a97c2bc294b034e69c",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b11fdfc182b07df9d8880fc4768d8fe4537ebf2",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"modbus_emulated",
"mozi_pattern",
"net_modbus_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:17:43 UTC
TCP
502 · MODBUS
modbus probe
modbus probe · via MODBUS:502 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MODBUS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
modbus_emulated
mozi_pattern
net_modbus_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
502
Chemin / cible
—
Service
MODBUS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:502 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/1
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:502
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/1
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:502 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "008302",
"emulator_response_len": 3,
"bytes_in": 190,
"payload_entropy": 5.259974034515823,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "modbus",
"app_proto": "modbus",
"asn": 16509,
"country": "US",
"dst_port": 502,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a4312436e102d379376cc96aec02d556b0131885",
"event_fingerprint": "6d0162aa5da47aba819045594f50c8c385e15712",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "modbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "afa70a818d0308a97c2bc294b034e69c",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 502,
"service": "modbus",
"service_name": "modbus",
"risk_score": 35
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b11fdfc182b07df9d8880fc4768d8fe4537ebf2",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 46,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "modbus",
"service_label_fr": "MODBUS",
"dst_port": 502,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Modbus TCP",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"modbus_probe_fr": "Sonde protocole Modbus TCP (port 502)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"port": 502,
"service": "modbus",
"service_label_fr": "MODBUS"
},
"attack_vector": "modbus probe \u00b7 via MODBUS:502 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:502\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/1",
"target_port_label": "502 \u00b7 MODBUS",
"emulator_service": "modbus",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "modbus",
"service_banner": "Modbus TCP",
"service_os": "plc",
"dst_port": "502"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"minio-console",
"modbus"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"modbus_emulated",
"mozi_pattern",
"net_modbus_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:13:35 UTC
TCP
9002 · MINIO CONSOLE
Sonde PostgreSQL
postgres probe · via MINIO CONSOLE:9002 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
MINIO-CONSOLE
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9002
Chemin / cible
—
Service
MINIO CONSOLE
Payload
� ��p[���`I��ɐ��7'P��|�9a۞��D*�c �#*vK�ߦ�W���(� �5� �� qf;� &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��p[���`I��ɐ��7'P��|�9a۞��D*�c �#*vK�ߦ�W���(�
�5� �� qf;� &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��p[���`I��ɐ��7'P��|�9a۞��D*�c �#*vK�ߦ�W���(� �5� �� qf;� &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ 2 �pT�"IM������R���1)�b7F�o
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 243,
"payload_entropy": 5.837344060687282,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "minio-console",
"app_proto": "minio-console",
"asn": 16509,
"country": "US",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e9a58bd6e2307d4ac1ae277602ddaeae0a42d762",
"event_fingerprint": "b6934a8f5faeb2f67f99a7dbc0ecf0db1c31e783",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "minio-console",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0f4190961181659f07839563936cc1bb",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9002,
"service": "minio-console",
"service_name": "minio-console",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdp\u0014[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffd\u0016W\ufffd\ufffd\u0003\ufffd(\ufffd\u001e\u0014\n\ufffd5\ufffd\t\ufffd\ufffd\u0000qf;\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdp\u0014[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffd\u0016W\ufffd\ufffd\u0003\ufffd(\ufffd\u001e\u0014\n\ufffd5\ufffd\t\ufffd\ufffd\u0000qf;\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 2\u001d\ufffdp\u0016T\ufffd\"IM\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffd1)\ufffd\u0015b7F\ufffdo\u0013",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdp\u0014[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffd\u0016W\ufffd\ufffd\u0003\ufffd(\ufffd\u001e\u0014\n\ufffd5\ufffd\t\ufffd\ufffd\u0000qf;\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb5258fa9685a7c3e6b0b126ce782cfbbd922a31",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdp\u0014[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffd\u0016W\ufffd\ufffd\u0003\ufffd(\ufffd\u001e\u0014\n\ufffd5\ufffd\t\ufffd\ufffd\u0000qf;\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"evidence_snippet": "\ufffd\ufffd\ufffdp[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffdW\ufffd\ufffd\ufffd(\ufffd\n\ufffd5\ufffd\t\ufffd\ufffdqf;\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "minio-console",
"service_label_fr": "MINIO CONSOLE",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minio-console",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdp\u0014[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffd\u0016W\ufffd\ufffd\u0003\ufffd(\ufffd\u001e\u0014\n\ufffd5\ufffd\t\ufffd\ufffd\u0000qf;\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "postgres probe \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdp[\ufffd\ufffd\ufffd`I\ufffd\ufffd\u0250\ufffd\ufffd7'P\ufffd\ufffd|\ufffd9a\u06de\ufffd\ufffdD*\ufffdc \ufffd#*vK\ufffd\u07e6\ufffdW\ufffd\ufffd\ufffd(\ufffd\n\ufffd5\ufffd\t\ufffd\ufffdqf;\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minio_console",
"service_banner": "honeypot-minio-console",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:12:23 UTC
TCP
9002 · MINIO CONSOLE
Sonde PostgreSQL
postgres probe · via MINIO CONSOLE:9002 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MINIO-CONSOLE
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9002
Chemin / cible
—
Service
MINIO CONSOLE
Payload
���� L�L�c�{e c� �W�o�7��ޅ�� ��8ȑ�T�Sp���������\���|��!'5 &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
����
L�L�c�{e c� �W�o�7��ޅ�� ��8ȑ�T�Sp���������\���|��!'5 &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
���� L�L�c�{e c� �W�o�7��ޅ�� ��8ȑ�T�Sp���������\���|��!'5 &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ ����� ��xa [RL�Y$ataPn�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 261,
"payload_entropy": 5.906501348451137,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "minio-console",
"app_proto": "minio-console",
"asn": 16509,
"country": "US",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "e9a58bd6e2307d4ac1ae277602ddaeae0a42d762",
"event_fingerprint": "b6934a8f5faeb2f67f99a7dbc0ecf0db1c31e783",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "minio-console",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "19b80004f6c17b1b044a4ad89b040ea7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 9002,
"service": "minio-console",
"service_name": "minio-console",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001a\u0010\nL\ufffdL\u0010\ufffdc\ufffd{e c\ufffd\u0000\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\u0017\u0011\ufffd\ufffd!'5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001a\u0010\nL\ufffdL\u0010\ufffdc\ufffd{e c\ufffd\u0000\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\u0017\u0011\ufffd\ufffd!'5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001b\ufffd\ufffd\ufffd\u000f\ufffd\f\ufffd\u001b\ufffdxa [RL\ufffdY\u0014$ataPn\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001a\u0010\nL\ufffdL\u0010\ufffdc\ufffd{e c\ufffd\u0000\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\u0017\u0011\ufffd\ufffd!'5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "670e9f14e023614f58526e2be4fcadb37f06d0d3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001a\u0010\nL\ufffdL\u0010\ufffdc\ufffd{e c\ufffd\u0000\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\u0017\u0011\ufffd\ufffd!'5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\nL\ufffdL\ufffdc\ufffd{e c\ufffd\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\ufffd\ufffd!'5&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "minio-console",
"service_label_fr": "MINIO CONSOLE",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minio-console",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u001a\u0010\nL\ufffdL\u0010\ufffdc\ufffd{e c\ufffd\u0000\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\u0017\u0011\ufffd\ufffd!'5\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "postgres probe \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\nL\ufffdL\ufffdc\ufffd{e c\ufffd\ufffdW\ufffdo\ufffd7\ufffd\ufffd\u0785\ufffd\ufffd \ufffd\ufffd8\u0211\ufffdT\ufffdSp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd|\ufffd\ufffd!'5&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minio_console",
"service_banner": "honeypot-minio-console",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 01:10:31 UTC
TCP
9002 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:9002 · (tentative d'exploit)
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9002
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9002 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
"http_host_hash": "9eb77341d923bf850a12632119cec98177710a79",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 191,
"payload_entropy": 5.275772419155986,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "US",
"dst_port": 9002,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b2138e8bb7e7effc3d47f91d2e62435031fe09fd",
"event_fingerprint": "12927f3bbb81addf7004b551b9c03b92c209bed3",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
"payload_hash": "973757d18b3b577d8861cdb3a87deeff",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cfcb70ead2bd0da185acbd6e820b883c36c64bc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "exploit attempt \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 01:09:14 UTC
TCP
9002 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:9002 · (tentative d'exploit)
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9002
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9002
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:9002 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "6bd3154a88ac556741885ed569cfb89736385db4",
"http_host_hash": "9eb77341d923bf850a12632119cec98177710a79",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 191,
"payload_entropy": 5.275772419155986,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "US",
"dst_port": 9002,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b2138e8bb7e7effc3d47f91d2e62435031fe09fd",
"event_fingerprint": "12927f3bbb81addf7004b551b9c03b92c209bed3",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cb226636f11f4f631f065fb419a8bab8",
"payload_hash": "973757d18b3b577d8861cdb3a87deeff",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9002,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cfcb70ead2bd0da185acbd6e820b883c36c64bc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "exploit attempt \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36",
"port": 9002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:9002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9002\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "9002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"minio-console"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
15/07/2026 01:08:29 UTC
TCP
9002 · MINIO CONSOLE
minio-console
minio-console · via MINIO CONSOLE:9002 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MINIO-CONSOLE
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9002
Chemin / cible
—
Pourquoi cette classification : Type « minio-console » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "minio-console",
"app_proto": "minio-console",
"asn": 16509,
"country": "US",
"dst_port": 9002,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ff2a7fa41323728a8483f1f783f09ae0b1ebada4",
"event_fingerprint": "b6934a8f5faeb2f67f99a7dbc0ecf0db1c31e783",
"classification_reason": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "minio-console",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "d82c16c3b724060c5d17f3cefc97e9df"
},
"target_context": {
"dst_port": 9002,
"service": "minio-console",
"service_name": "minio-console",
"risk_score": 0
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d84662ec289d65c1602f4ab7e8b884ac3bb55f8e",
"protocol_details": {
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "minio-console \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab minio-console \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "minio-console",
"service_label_fr": "MINIO CONSOLE",
"dst_port": 9002,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-minio-console",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 9002,
"service": "minio-console",
"service_label_fr": "MINIO CONSOLE"
},
"attack_vector": "minio-console \u00b7 via MINIO CONSOLE:9002 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9002 \u00b7 MINIO CONSOLE",
"emulator_service": "minio-console",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "minio_console",
"service_banner": "honeypot-minio-console",
"service_os": "linux",
"dst_port": "9002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
15/07/2026 01:00:59 UTC
TCP
5001 · UPNP TCP
Sonde PostgreSQL
postgres probe · via UPNP TCP:5001 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
� ��M����Lb���iUp����5����FtU �7�c��\}�GV|+������֝� G��; &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��M����Lb���iUp����5����FtU �7�c��\}�GV|+������֝�
G��; &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��M����Lb���iUp����5����FtU �7�c��\}�GV|+������֝� G��; &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ dDP�$��2|�C�C8���;���Y���oX�8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 243,
"payload_entropy": 5.793449072142423,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 16509,
"country": "US",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "436278379f11f507398419d513ec805702ed650d",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8d6899f0c1f7a40647cf79464b2cda76",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\u000e\ufffd\ufffd\ufffd\ufffdL\u0013b\ufffd\ufffd\u0006\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdF\u0014tU\u0004 \ufffd7\u0010\u0016\u0002\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\u000e\ufffd\ufffd\ufffd\ufffdL\u0013b\ufffd\ufffd\u0006\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdF\u0014tU\u0004 \ufffd7\u0010\u0016\u0002\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 dDP\ufffd$\ufffd\u0017\ufffd2\u0004|\ufffdC\ufffdC8\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\u000eoX\ufffd8",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\u000e\ufffd\ufffd\ufffd\ufffdL\u0013b\ufffd\ufffd\u0006\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdF\u0014tU\u0004 \ufffd7\u0010\u0016\u0002\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d227f9b2fad751a5b282604e878a796c147210bf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\u000e\ufffd\ufffd\ufffd\ufffdL\u0013b\ufffd\ufffd\u0006\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdF\u0014tU\u0004 \ufffd7\u0010\u0016\u0002\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdLb\ufffd\ufffd\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdFtU \ufffd7\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\u000e\ufffd\ufffd\ufffd\ufffdL\u0013b\ufffd\ufffd\u0006\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdF\u0014tU\u0004 \ufffd7\u0010\u0016\u0002\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdM\ufffd\ufffd\ufffd\ufffdLb\ufffd\ufffd\ufffdiUp\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffdFtU \ufffd7\ufffdc\ufffd\ufffd\\}\ufffdGV|+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u059d\ufffd\rG\ufffd\ufffd;&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 00:59:18 UTC
TCP
5001 · UPNP TCP
Sonde PostgreSQL
postgres probe · via UPNP TCP:5001 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
�@si�eޙ�L��ذX�b���_H�� ���� 68꭪�� �_(���m�t�<h^ )Ӟ� &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�@si�eޙ�L��ذX�b���_H��
���� 68꭪��Â
�_(���m�t�<h^ )Ӟ� &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
�@si�eޙ�L��ذX�b���_H�� ���� 68꭪�� �_(���m�t�<h^ )Ӟ� &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ OһRğpP���d � ,�@qM�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 261,
"payload_entropy": 5.9178163086290905,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 16509,
"country": "US",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "436278379f11f507398419d513ec805702ed650d",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e919ba01d8b549e6e808e69ee5d5bf4a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\u001b\ufffdb\ufffd\ufffd\ufffd_\u0007H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u0007\u00c2\r\u0012\ufffd_(\ufffd\ufffd\u0014\ufffdm\ufffdt\ufffd\u0001<h^\u001d)\u04de\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\u001b\ufffdb\ufffd\ufffd\ufffd_\u0007H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u0007\u00c2\r\u0012\ufffd_(\ufffd\ufffd\u0014\ufffdm\ufffdt\ufffd\u0001<h^\u001d)\u04de\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 O\u04bbR\u011fp\u001a\u0005P\ufffd\ufffd\ufffd\u0017d\r\ufffd\u001f,\ufffd@q\u0005M\u0018\ufffd ",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\u001b\ufffdb\ufffd\ufffd\ufffd_\u0007H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u0007\u00c2\r\u0012\ufffd_(\ufffd\ufffd\u0014\ufffdm\ufffdt\ufffd\u0001<h^\u001d)\u04de\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40e8bb342fdd749b2d722616390d9fcda0b70119",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\u001b\ufffdb\ufffd\ufffd\ufffd_\u0007H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u0007\u00c2\r\u0012\ufffd_(\ufffd\ufffd\u0014\ufffdm\ufffdt\ufffd\u0001<h^\u001d)\u04de\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "\ufffd@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\ufffdb\ufffd\ufffd\ufffd_H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u00c2\r\ufffd_(\ufffd\ufffd\ufffdm\ufffdt\ufffd<h^)\u04de\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\u001b\ufffdb\ufffd\ufffd\ufffd_\u0007H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u0007\u00c2\r\u0012\ufffd_(\ufffd\ufffd\u0014\ufffdm\ufffdt\ufffd\u0001<h^\u001d)\u04de\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd@si\ufffde\u0799\ufffdL\ufffd\ufffd\u0630X\ufffdb\ufffd\ufffd\ufffd_H\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd 68\uab6a\ufffd\ufffd\u00c2\r\ufffd_(\ufffd\ufffd\ufffdm\ufffdt\ufffd<h^)\u04de\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 00:57:40 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Moyen · 41
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 41
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 191,
"payload_entropy": 5.250877720191779,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 16509,
"country": "US",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b05ee9181de71fbbd5923d34f9b23e1d",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 41
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1de02dd28f010cea2841c221b21f02a3a8cd2af",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
],
"asn_dc_heuristic": true
}
15/07/2026 00:56:02 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Moyen · 41
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Moyen
· 41
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 191,
"payload_entropy": 5.250877720191779,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 16509,
"country": "US",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b05ee9181de71fbbd5923d34f9b23e1d",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 41
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1de02dd28f010cea2841c221b21f02a3a8cd2af",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
],
"asn_dc_heuristic": true
}
15/07/2026 00:55:20 UTC
TCP
5001 · UPNP TCP
upnp-tcp
upnp-tcp · via UPNP TCP:5001 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 16509,
"country": "US",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 0
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4dae4e35fd591f0f1ca8904f2ae294f7d75bae1",
"protocol_details": {
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
15/07/2026 00:03:57 UTC
TCP
2049 · NFS
Sonde PostgreSQL
postgres probe · via NFS:2049 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 35fa0a83e466acbe
Émulateur
NFS
WAF
—
Recommandation
Surveiller
Tags
net_nfs_probe
nfs_emulated
nfs_mount
nfs_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2049
Chemin / cible
—
Service
NFS
Payload
� ��%{ѡ̓�B|�5N�=�L���t���1@n��� xY��5�S�A���ӲN�����g�, (�[�(J &̨̩�/�0�+�,�� �� � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��%{ѡ̓�B|�5N�=�L���t���1@n��� xY��5�S�A���ӲN�����g�, (�[�(J &̨̩�/�0�+�,�� ��
� � / 5�
{
Requête brute (extrait)
� ��%{ѡ̓�B|�5N�=�L���t���1@n��� xY��5�S�A���ӲN�����g�, (�[�(J &̨̩�/�0�+�,�� �� � � / 5� { � + 3 & $ �s1]�v�,i{��x8aڢ�y��)��c ;`
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "960301010000000000000000",
"emulator_response_len": 12,
"bytes_in": 243,
"payload_entropy": 5.862143130630833,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "nfs",
"app_proto": "nfs",
"asn": 16509,
"country": "US",
"dst_port": 2049,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b2520697970f24f6b1565048e52cd6126058c041",
"event_fingerprint": "923118becffb962b98707ace1a35bf197f6f487b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "nfs",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "939a8c71dcc7a18812b598784ebff590",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"ja4": "7b5e3a15097abc10f88e98257ea51010",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja3": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
"tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2049,
"service": "nfs",
"service_name": "nfs",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd%{\u0461\u0313\u0018\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\u0005\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\u001a\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,\u001c(\ufffd[\ufffd(J\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd%{\u0461\u0313\u0018\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\u0005\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\u001a\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,\u001c(\ufffd[\ufffd(J\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffds1]\ufffdv\ufffd,i{\ufffd\ufffdx8a\u06a2\ufffdy\ufffd\u0017\ufffd)\ufffd\ufffd\u0014c\r\u0000;`",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd%{\u0461\u0313\u0018\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\u0005\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\u001a\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,\u001c(\ufffd[\ufffd(J\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f4eed35d8ce555951f79c9c0e5d7582243e8f4c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd%{\u0461\u0313\u0018\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\u0005\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\u001a\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,\u001c(\ufffd[\ufffd(J\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd%{\u0461\u0313\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,(\ufffd[\ufffd(J&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "nfs",
"service_label_fr": "NFS",
"dst_port": 2049,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nfs",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd%{\u0461\u0313\u0018\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\u0005\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\u001a\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,\u001c(\ufffd[\ufffd(J\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "35fa0a83e466acbec1cfbb9016d550ab",
"tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "postgres probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd%{\u0461\u0313\ufffdB|\ufffd5N\ufffd=\ufffdL\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffd1@n\ufffd\ufffd\ufffd xY\ufffd\ufffd5\ufffdS\ufffdA\ufffd\ufffd\ufffd\u04f2N\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd,(\ufffd[\ufffd(J&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nfs",
"service_banner": "honeypot-nfs",
"service_os": "linux",
"dst_port": "2049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_nfs_probe",
"nfs_emulated",
"nfs_mount",
"nfs_payload",
"nfs_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 00:02:35 UTC
TCP
2049 · NFS
Sonde PostgreSQL
postgres probe · via NFS:2049 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
NFS
WAF
—
Recommandation
Surveiller
Tags
net_nfs_probe
nfs_emulated
nfs_mount
nfs_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2049
Chemin / cible
—
Service
NFS
Payload
�%�,$�QJ�M���D��D��Dd������a �_ [b�#/��(���.��e���y�h���� &̨̩�/�0�+�,�� �� � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�%�,$�QJ�M���D��D��Dd������a
�_ [b�#/��(���.��e���y�h���� &̨̩�/�0�+�,�� ��
� � / 5�
�
Requête brute (extrait)
�%�,$�QJ�M���D��D��Dd������a �_ [b�#/��(���.��e���y�h���� &̨̩�/�0�+�,�� �� � � / 5� � � h2http/1.1 + 3 & $ �6�F�J�$^A�៚V�����^{�D
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "960301010000000000000000",
"emulator_response_len": 12,
"bytes_in": 261,
"payload_entropy": 5.806945652046412,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "nfs",
"app_proto": "nfs",
"asn": 16509,
"country": "US",
"dst_port": 2049,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 35,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b2520697970f24f6b1565048e52cd6126058c041",
"event_fingerprint": "923118becffb962b98707ace1a35bf197f6f487b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "nfs",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "735c7940f89fe66437ef97295dddeb7b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2049,
"service": "nfs",
"service_name": "nfs",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd,\u0007$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\u0013Dd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ \b\u000e[b\ufffd#\/\u0012\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\u001b\u0001\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd,\u0007$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\u0013Dd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ \b\u000e[b\ufffd#\/\u0012\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\u001b\u0001\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd6\ufffd\u0014F\ufffdJ\ufffd$^\u0001A\ufffd\u17daV\ufffd\ufffd\ufffd\ufffd\ufffd^\u0017{\ufffdD",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd,\u0007$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\u0013Dd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ \b\u000e[b\ufffd#\/\u0012\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\u001b\u0001\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36921e0630ec0f3a7f846d49d92d66e92494279e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd,\u0007$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\u0013Dd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ \b\u000e[b\ufffd#\/\u0012\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\u001b\u0001\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"evidence_snippet": "\ufffd%\ufffd,$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffdDd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ [b\ufffd#\/\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "nfs",
"service_label_fr": "NFS",
"dst_port": 2049,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nfs",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0000\u0001\u0000\u0000\ufffd\u0003\u0003%\ufffd,\u0007$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffd\u0013Dd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ \b\u000e[b\ufffd#\/\u0012\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\u001b\u0001\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "postgres probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd%\ufffd,$\ufffdQJ\ufffdM\ufffd\ufffd\ufffdD\ufffd\ufffdD\ufffd\ufffdDd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda\n\ufffd_ [b\ufffd#\/\ufffd\ufffd(\ufffd\ufffd\ufffd.\ufffd\ufffde\ufffd\ufffd\ufffdy\ufffdh\ufffd\ufffd\u0378\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nfs",
"service_banner": "honeypot-nfs",
"service_os": "linux",
"dst_port": "2049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_nfs_probe",
"nfs_emulated",
"nfs_mount",
"nfs_payload",
"nfs_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
15/07/2026 00:00:55 UTC
TCP
2049 · NFS
Sonde NFS
nfs probe · via NFS:2049 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
NFS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_nfs_probe
nfs_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2049
Chemin / cible
—
Service
NFS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2049 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « nfs_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 7 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2049
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2049 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "c74554210000000000000000",
"emulator_response_len": 12,
"bytes_in": 191,
"payload_entropy": 5.298539516253351,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "nfs",
"app_proto": "nfs",
"asn": 16509,
"country": "US",
"dst_port": 2049,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6be726669fdb6e7fc51a2ca8ba81cf376cfe2895",
"event_fingerprint": "923118becffb962b98707ace1a35bf197f6f487b",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "nfs",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9715a2e897bece301e5e326e8b9d085f",
"path_pattern_hash": "b4c17c2e08034efe3107b042afcaf38e"
},
"target_context": {
"dst_port": 2049,
"service": "nfs",
"service_name": "nfs",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1479af350d36333752f0a208d5758cef4c616cd6",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "nfs",
"service_label_fr": "NFS",
"dst_port": 2049,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nfs",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nfs",
"service_banner": "honeypot-nfs",
"service_os": "linux",
"dst_port": "2049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_nfs_probe",
"nfs_emulated",
"nfs_mount",
"nfs_payload",
"nfs_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 00:00:12 UTC
TCP
2049 · NFS
Sonde NFS
nfs probe · via NFS:2049 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
NFS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_nfs_probe
nfs_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2049
Chemin / cible
—
Service
NFS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2049 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Pourquoi cette classification : Type « nfs_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 7 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2049
User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2049 User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "c74554210000000000000000",
"emulator_response_len": 12,
"bytes_in": 191,
"payload_entropy": 5.298539516253351,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "nfs",
"app_proto": "nfs",
"asn": 16509,
"country": "US",
"dst_port": 2049,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "6be726669fdb6e7fc51a2ca8ba81cf376cfe2895",
"event_fingerprint": "923118becffb962b98707ace1a35bf197f6f487b",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "nfs",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9715a2e897bece301e5e326e8b9d085f",
"path_pattern_hash": "b4c17c2e08034efe3107b042afcaf38e"
},
"target_context": {
"dst_port": 2049,
"service": "nfs",
"service_name": "nfs",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/126.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1479af350d36333752f0a208d5758cef4c616cd6",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "nfs",
"service_label_fr": "NFS",
"dst_port": 2049,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nfs",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2049\r\nUser-Agent: visionheight.com\/scan Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome\/",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 7 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nfs",
"service_banner": "honeypot-nfs",
"service_os": "linux",
"dst_port": "2049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_nfs_probe",
"nfs_emulated",
"nfs_mount",
"nfs_payload",
"nfs_probe"
],
"asn_dc_heuristic": true
}
15/07/2026 00:00:01 UTC
TCP
2049 · NFS
Sonde NFS
nfs probe · via NFS:2049 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
NFS
WAF
—
Recommandation
Surveiller
Tags
net_nfs_probe
nfs_emulated
nfs_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2049
Chemin / cible
—
Pourquoi cette classification : Type « nfs_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "800000010000000000000000",
"emulator_response_len": 12,
"bytes_in": 1,
"payload_entropy": 0,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "nfs",
"app_proto": "nfs",
"asn": 16509,
"country": "US",
"dst_port": 2049,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6a2d57277ae1d225ad0f913a3e0ccf0796c04e7e",
"event_fingerprint": "923118becffb962b98707ace1a35bf197f6f487b",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "nfs",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01ba4719c80b6fe911b091a7c05124b6",
"path_pattern_hash": "b4c17c2e08034efe3107b042afcaf38e"
},
"target_context": {
"dst_port": 2049,
"service": "nfs",
"service_name": "nfs",
"risk_score": 34
},
"payload_preview": "\n",
"request_sample": "\n",
"evidence": {
"request_sample": "\n",
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "348157c41837a8331b37026f34084e9c63e7b37a",
"protocol_details": {
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab nfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "nfs",
"service_label_fr": "NFS",
"dst_port": 2049,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-nfs",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 2049,
"service": "nfs",
"service_label_fr": "NFS"
},
"attack_vector": "nfs probe \u00b7 via NFS:2049 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2049 \u00b7 NFS",
"emulator_service": "nfs",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "nfs",
"service_banner": "honeypot-nfs",
"service_os": "linux",
"dst_port": "2049"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_nfs_probe",
"nfs_emulated",
"nfs_payload"
],
"asn_dc_heuristic": true
}