|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.021897248761132,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "4987ac02e0a723a4862a04dcab736db1b388231d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b097c0f1b4ea1f85be6b0ad44b78c90c",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97437dd1a64da9a694182c66d8727617d9505ae0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.199719989483394,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "4987ac02e0a723a4862a04dcab736db1b388231d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a0ed796c2cffb8c147d18faa658161a9",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36c281d621f5f73219165c3f4521712ca8bbe7c0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic bXlzcWw6YWFhYWFh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.113995169690861,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "4987ac02e0a723a4862a04dcab736db1b388231d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "05e97abd6c6e4a32095e8c63759ed564",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c044cc9138413b4e286aaf719888a2c740a1b917",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bXlzcWw6YWFhYWFh",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.01448467041556,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "4987ac02e0a723a4862a04dcab736db1b388231d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da9112e64b40bebff8baa2e577b88939",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5beef36b5bf64be64c63c840c8e629ef4084dff3",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.242923030030446,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "4987ac02e0a723a4862a04dcab736db1b388231d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "15f6c9ac9e5999096ee668854776ebb6",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2df71bc02926fa6753a090d343be436a2f023f60",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpqZW5uaWZlcg==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDp6eno=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.0916297433607935,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f9438aeccc99aefdcf647c56e59ebbc9",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e42c4c175554db24e0d92aded0d82519be9b9f53",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDp6eno=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�6)��!-Lf����V� hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�6)��!-Lf����V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l�6)��!-Lf����V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�6)��!-Lf����V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�6)��!-Lf����V� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.827738922598375,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a396baea141fc8367db9694bed87aa8",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ee2af7875d129b57e59d36e65fcdfef1a4379d5",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd6)\ufffd\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd6)\ufffd\u0004\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd6)\ufffd\ufffd!-Lf\ufffd\ufffd\ufffd\ufffdV\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�灻���U�� ?�"uF hcurve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�灻���U�� ?�"uF hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh…
Payload
SSH-2.0-libssh_0.11.4 l�灻���U�� ?�"uF hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�灻���U�� ?�"uF hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�灻���U�� ?�"uF hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.840236457804102,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "407fab0ae13f5a09f121d4b99a473394",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5902941534095d11aa6baf1546bce501965211f1",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd?\ufffd\"uFhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd\f?\ufffd\"uF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\u707b\ufffd\ufffd\ufffdU\ufffd\ufffd?\ufffd\"uFhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�:ƿぐ��O�~� hcurve25519-sha256,…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�:ƿぐ��O�~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha…
Payload
SSH-2.0-libssh_0.11.4 l�:ƿぐ��O�~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�:ƿぐ��O�~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�:ƿぐ��O�~� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.842557386135329,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "24329feb18c1d32605d719ed83b6cdf1",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "288c150c320acfd956cec0d240e517b395d09fa5",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u0015\u0015\u0002:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd:\u01bf\u3050\ufffd\ufffdO\ufffd~\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 lq�������H��F� hcurve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 lq�������H��F� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh…
Payload
SSH-2.0-libssh_0.11.4 lq�������H��F� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
lq�������H��F� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 lq�������H��F� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 1159,
"payload_entropy": 4.84255738613533,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f5d9e8f94ecaa13ecb7148c0cc2352f7",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a697f12cc7b98a4ed1b8c6fb0eda90e313b16233",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlq\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014q\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlq\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdF\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�gk��ee$��ߤo�^� hcurve25519-sha25…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�gk��ee$��ߤo�^� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-s…
Payload
SSH-2.0-libssh_0.11.4 l�gk��ee$��ߤo�^� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�gk��ee$��ߤo�^� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�gk��ee$��ߤo�^� hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1159,
"payload_entropy": 4.819592849285712,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "197d5e64dd775c4cce911c41d6032374",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "948405fa692556b60d7e6db1a6fbf3608134e71b",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdgk\ufffd\ufffdee$\ufffd\ufffd\u07e4o\ufffd^\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l!3$>��qhf������ hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l!3$>��qhf������ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l!3$>��qhf������ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l!3$>��qhf������ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l!3$>��qhf������ hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.831151484711283,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "522a90c8bf2628dad4660247ad9017cb",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a49260f9b1cdad0fa0fdcd629d4de9fcc806d671",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl!3$>\ufffd\ufffdqhf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014!3$>\ufffd\ufffdqhf\u0018\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl!3$>\ufffd\ufffdqhf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 l�a� "%Y��� V�F hcurve25519-sha2…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 l�a� "%Y��� V�F hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-…
Payload
SSH-2.0-libssh_0.11.4 l�a� "%Y��� V�F hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
l�a� "%Y��� V�F hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 l�a� "%Y��� V�F hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
"emulator_response_len": 32,
"bytes_in": 1159,
"payload_entropy": 4.841090541776577,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b1eb298f9bbf09eab20a08f3e8705c28",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea31752a84db43996585edc35e62bea25e4670fa",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffda\ufffd\"%Y\ufffd\ufffd\ufffdV\ufffdFhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\u001aa\ufffd\u0018\f\"%Y\ufffd\ufffd\ufffd\u001cV\ufffdF\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffda\ufffd\"%Y\ufffd\ufffd\ufffdV\ufffdFhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
SSH SSH-2.0-libssh_0.11.4 lLJ�Ia���2�ѡ�W hcurve25519-sha256…
Émulateur
SSH
WAF
—
Recommandation
Investiguer
Tags
net_ssh_probe
ssh_banner
ssh_emulated
ssh_kex_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Bannière SSH
SSH-2.0-libssh_0.11.4 lLJ�Ia���2�ѡ�W hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh…
Payload
SSH-2.0-libssh_0.11.4 lLJ�Ia���2�ѡ�W hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Pourquoi cette classification : Bannière client SSH reçue · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Client SSH libssh/paramiko (scanner)
pat-0391
pat-0392
Upstream
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSH-2.0 banner RFC4253
libssh banner
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
SSH-2.0-libssh_0.11.4
lLJ�Ia���2�ѡ�W hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis
Requête brute (extrait)
SSH-2.0-libssh_0.11.4 lLJ�Ia���2�ѡ�W hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
"emulator_response_len": 41,
"bytes_in": 1159,
"payload_entropy": 4.834718502386887,
"port_category": "well_known",
"org": "VPS Dedicated LLC",
"service": "ssh",
"app_proto": "ssh",
"asn": 197769,
"country": "SI",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25
},
"risk_score": 50,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 195,
"precision_signals": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"kb_rule_ids": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"matched_patterns": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"matched_pattern_names": [
"SSH-2.0 banner RFC4253",
"libssh banner",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0391",
"pat-0392",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "ssh",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3bb6b3718705cc0f7df56124cd4959b6",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 50
},
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"evidence": {
"request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
"payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046",
"T1595"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b1c2125cc91bf1aa07a62446c1a0352df82ce96",
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\u01c7\ufffdIa\ufffd\ufffd\ufffd2\ufffd\u0461\ufffdWhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 25,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"INT-ssh-libssh-ua",
"pat-0391",
"pat-0392",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Client SSH libssh\/paramiko (scanner)",
"pat-0391",
"pat-0392",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\u01c7\u0005\ufffdIa\ufffd\ufffd\ufffd2\ufffd\b\u0461\ufffdW\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\u01c7\ufffdIa\ufffd\ufffd\ufffd2\ufffd\u0461\ufffdWhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_ssh_probe",
"ssh_banner",
"ssh_emulated",
"ssh_kex_probe",
"ssh_libssh"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2525 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:2525 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
2525
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 116,
"payload_entropy": 5.216992125656525,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 2525,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6c54bd910ca0fbd9d349af327b8027c451b2c8d8",
"event_fingerprint": "330a38f50f33f43db9b515dbe76ea1f5e6cb61e9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9bf2fd90aaff08d7f694aa0408ac37cb",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 2525,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a8143518e35815805828ad6feebb4d6502e72882",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"smtp_auth_fr": "Sonde protocole SMTP",
"port": 2525,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2525 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "2525 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2525,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"smtp_auth_fr": "Sonde protocole SMTP",
"port": 2525,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2525 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoxUUEyV1MzRUQ0UkY=",
"target_port_label": "2525 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2525"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 116,
"payload_entropy": 5.261288133859969,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "a44879d989ce870fa6e895b39e3c56ee6246b9b9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48ec075e2720a54f12fa71512c8979bf",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41ebf60e4a774db277a31477a819a193bceddd9b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZWMyLXVzZXI6UEBzc3cwcmQ=",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.341502518818997,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "a44879d989ce870fa6e895b39e3c56ee6246b9b9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "449ef3448781ce0d7da07f8e595dfde7",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d29334795d42d33831c2bc4cd61b6540a853bce9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.153852956054678,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "a44879d989ce870fa6e895b39e3c56ee6246b9b9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b78abaf5ce70998ec7b29f9a87aa06fb",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea645c3d0b152d60221f3bdcb1b61bd58e983852",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDoyMDI1MjAyNQ==",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic bWF0dGhldzptYXR0aGV3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.152539520598177,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "a44879d989ce870fa6e895b39e3c56ee6246b9b9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "96b969562527001449222a77c7a04fca",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "886865b007d769058eff432759ca24f8cf415e2e",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic bWF0dGhldzptYXR0aGV3",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
9080
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
"emulator_response_len": 147,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.183191280602832,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 9080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
"event_fingerprint": "a44879d989ce870fa6e895b39e3c56ee6246b9b9",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "17c3171d2a9b0eb4a903325db26ee72e",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 9080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f71fec8604f331a9ffa2d8d0ae2c84065bc1ddc2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 9080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDpMeDEyMzQ1Njc4",
"target_port_label": "9080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 132,
"payload_entropy": 5.249061548587759,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b0ffa994a0d73c9759fedb3eaa60ea11",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a839676df4512dcd928bc4a853af3edbb2bce32",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic dXNlcjpwYXNzd29yZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.1706028026187525,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "645d8d95af4cf8ba48f4fe8d9ceb1e28",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48358be5608b3b893854f6c1de4f87a850d5a825",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dXNlcjpwYXNzd29yZA==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 63,
"payload_entropy": 4.110506408696668,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a04a479667634fb49a6b52d15fb4e928",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d52c32643bd162689f2720be1cdab78395b9b74",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 3.993132557647859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29d9293a145e99912ac7c9c406f057d1",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99d80a5bebf6c1c1589c40fc1a914754c8fa9468",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 122,
"payload_entropy": 5.335651682708004,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "058e10a29c8893791bcf992fc7dd4067",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "749d377a000f7784e0433e739ba63fd3ca3f7ec5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ZGV2ZWxvcGVyOkRldmVsb3BlckAxMjM=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 61,
"payload_entropy": 4.093082314148497,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7f9b672db2705b6a033d986733679343",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afa6919883080c47053f01fb082c574af631d5b7",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.127310369340642,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "705297b20970093444c340140001e1ec",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbab5d70f52bc5aff12f9afc4ba7148bb92e7b37",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic c2hpdmFtOnNoaXZhbQ==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 84
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic MTox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 96,
"payload_entropy": 4.8291151061900335,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48584803c0608c8442f55d1a9ef644a9",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20efd8ad3d0816fc31995bd401cbbc1ef59acc79",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTox",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.20335153276428,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3bab5b0710f7135c0dcf6eabc2192337",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed32ca69232d20ad69667f08ab23b26405370330",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic Z2lhbm5pOmdpYW5uaQ==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 3.993132557647859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29d9293a145e99912ac7c9c406f057d1",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99d80a5bebf6c1c1589c40fc1a914754c8fa9468",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 3.993132557647859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29d9293a145e99912ac7c9c406f057d1",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99d80a5bebf6c1c1589c40fc1a914754c8fa9468",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.107:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 130.12.182.107:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
130.12.182.107:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
130.12.182.107:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 130.12.182.107:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "107:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "f1630649edfb1e279c1bf3399607a7d3eecdb02f",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 36,
"payload_entropy": 3.993132557647859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "77f955e2cd31567a6deefb71167e24424260403d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29d9293a145e99912ac7c9c406f057d1",
"path_pattern_hash": "5dbc345e11b7fb898fd42fe6d4995958"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99d80a5bebf6c1c1589c40fc1a914754c8fa9468",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "130.12.182.107:80",
"request_line": "CONNECT 130.12.182.107:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.107:80",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic MTIzOjQ1Ng==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic MTIzOjQ1Ng==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 104,
"payload_entropy": 5.004319017769869,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b3a949b9a0761a0834568fa5977da191",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6a64cd482f18702cab9250cdd0b6a354995e03f",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 110,
"payload_entropy": 5.022441218856188,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "de4a8cdd50e130c1bd016658cc7d86c8",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7def6f21161166611b2ff316ef8c9b83589e702f",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 112,
"payload_entropy": 5.111182963046845,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ae7765012cb57901b9f677a2c809801b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d05208cbef6a67866017ec5fa0903841ca8b82c",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic dGVzdDp0ZXN0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 102,
"payload_entropy": 5.017042008954022,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4e6f0481e09d88fbde0564bf61d2e228",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c055e4add666edbc12136c8dec9f0547e335888",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 118,
"payload_entropy": 5.272717122165187,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "335684dc65d6948cf85f1de8185141fd",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af049ef6709235afeed60971f0cfef2c6bdaa8d9",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmFsYW5jZXI6YmFsYW5jZXIxMjM=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 110,
"payload_entropy": 5.203497100318859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b58f32578be803f55bc36d2ad8e51f66",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3956e3eb4e4f6a12b2282a9db16798a07c54ba7d",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 36,
"payload_entropy": 3.993132557647859,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29d9293a145e99912ac7c9c406f057d1",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3576a7431b99bd0d9a8bc58a558d22dca3d7361",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic YXZhZDphdmFk
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic YXZhZDphdmFk
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 104,
"payload_entropy": 5.099848521940344,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ed3b1fa8be55c598ef5085d3c4b8cef",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk\r\n\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12af84822b464b7ec968e2e7891599a12a645a7b",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YXZhZDphdmFk",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 120,
"payload_entropy": 5.2333404924295355,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d2bba9175bc5d9f2f8aeb18a598b890",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==\r\n\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==\r\n\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58a5685d07135dd3b9508ecc28f972d33fc1da0d",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MTIzNDVxd2VydA==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 114,
"payload_entropy": 5.158977624853531,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b30e21575788aeed54c4efee8c90ddd3",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7000dfb06171d278fac15b2388b30c81ebcf415",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNA==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 130.12.182.107:80 HTTP/1.0 Host: 130.12.182.107:80 Proxy-Authorization: Basic anl4dToxMjM0NTY=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 130.12.182.107:80 HTTP/1.0
Host: 130.12.182.107:80
Proxy-Authorization: Basic anl4dToxMjM0NTY=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 106,
"payload_entropy": 5.034155776226635,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "https",
"app_proto": "https",
"asn": 197769,
"country": "SI",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fb49a15c57170eddc85b922fbf6b4270",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=\r\n",
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"evidence": {
"request_sample": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ae6c918b041cb61cd8c8e94d63d01ebdf2db768",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 130.12.182.107:80 HTTP\/1.0\r\nHost: 130.12.182.107:80\r\nProxy-Authorization: Basic anl4dToxMjM0NTY=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125
|
—
|
Sonde port
Sonde port · port 3125 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3125
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": null,
"app_proto": null,
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e6b3a285087acff5df22a058340662d8824af75d",
"event_fingerprint": "780517b6527a306bdcedd203e0c3bb67e0e7bd44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3125,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f33ac7492bda70d147d3d238b56a62c9a968730",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"target_port_label": "3125",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3125",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125
|
—
|
proxy probe
proxy probe · port 3125 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3125
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": null,
"app_proto": null,
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22b950ebf044e86fbf230aea001a3d696deea7c8",
"event_fingerprint": "cfc4d004e6ce4d2021f6db251f2ba932bf2575d7",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 3125,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b6964dbc6ce8b4ba964b75fd91b23d95c103cd4",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 3125
},
"evidence_snippet": "\ufffd",
"attack_vector": "proxy probe \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"target_port_label": "3125",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 3125
},
"attack_vector": "proxy probe \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "3125",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:3125 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
3125
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3b98e416956397cc56a2bd3aba1fb3200b9a5191",
"event_fingerprint": "e5396572d4a1b8781dced5dee53187bc3ce62c63",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 3125,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72149969121477d8cc1204f1c12e17cdbb83b7f9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 3125,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "3125 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 3125,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "3125 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3125"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125
|
—
|
Sonde port
Sonde port · port 3125 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3125
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": null,
"app_proto": null,
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e6b3a285087acff5df22a058340662d8824af75d",
"event_fingerprint": "780517b6527a306bdcedd203e0c3bb67e0e7bd44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3125,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75b9c8f1e39d0e5483066c35a6a696b6b86acf5e",
"protocol_details": {
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"target_port_label": "3125",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3125",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125
|
—
|
Sonde port
Sonde port · port 3125 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3125
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": null,
"app_proto": null,
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e6b3a285087acff5df22a058340662d8824af75d",
"event_fingerprint": "780517b6527a306bdcedd203e0c3bb67e0e7bd44",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3125,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8f33ac7492bda70d147d3d238b56a62c9a968730",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"target_port_label": "3125",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 3125
},
"attack_vector": "Sonde port \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3125",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125
|
—
|
proxy probe
proxy probe · port 3125 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3125
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": null,
"app_proto": null,
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22b950ebf044e86fbf230aea001a3d696deea7c8",
"event_fingerprint": "cfc4d004e6ce4d2021f6db251f2ba932bf2575d7",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 3125,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b6964dbc6ce8b4ba964b75fd91b23d95c103cd4",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 3125
},
"evidence_snippet": "\ufffd",
"attack_vector": "proxy probe \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"target_port_label": "3125",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 3125
},
"attack_vector": "proxy probe \u00b7 port 3125 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "3125",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3125 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:3125 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
3125
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "VPS Dedicated LLC",
"service": "http",
"app_proto": "http",
"asn": 197769,
"country": "SI",
"dst_port": 3125,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3b98e416956397cc56a2bd3aba1fb3200b9a5191",
"event_fingerprint": "e5396572d4a1b8781dced5dee53187bc3ce62c63",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SI",
"asn": 197769,
"org": "VPS Dedicated LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 3125,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72149969121477d8cc1204f1c12e17cdbb83b7f9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 3125,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "3125 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3125,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 3125,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:3125 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "3125 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3125"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3125"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"asn_dc_heuristic": true
}
|