|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /public/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /public/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 103,
"payload_entropy": 5.021729843933261,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "20cb4ce1d3566b7d1223a09a66e31828",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "78791171c9188f3844ae6d67e4555ecf44f5553a",
"protocol_details": {
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /wordpress/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /wordpress/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 106,
"payload_entropy": 4.950620370827833,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "71549ee4b98f642bc78f96aa3be255ea",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a6023e63a9e588b6cd5d944af2a986b18b30018",
"protocol_details": {
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /api/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4767a78b221d6279033aff2dec1374da",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a899afe0aaa5e37eef0bf8371d8e11998520ac91",
"protocol_details": {
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b261b049064f0ff5
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� �{r�b�n?���r�����;��o�k�� mAh�8 y1idi �BCkRip�" '��w �,�+̩�0�/̨ � � # 3 & $
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �{r�b�n?���r�����;��o�k�� mAh�8 y1idi �BCkRip�" '��w �,�+̩�0�/̨ � �
# 3 & $
Requête brute (extrait)
� �{r�b�n?���r�����;��o�k�� mAh�8 y1idi �BCkRip�" '��w �,�+̩�0�/̨ � � # 3 & $ ����ܠ�s 5#k��*��O�mG!%�0�I u http/1.1 - +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.884647384944645,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4693aa93c4d66836cf0222e7b653d6a6",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "b261b049064f0ff57944f1dbeef39d05",
"ja4": "80ec0669a159aa408ededc762ee2bbe2",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "b261b049064f0ff57944f1dbeef39d05",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-35-51-16-11-45-13-43-23-5,29-23-24,0",
"tls_ja4_hash": "80ec0669a159aa408ededc762ee2bbe2",
"tls_ja4": "t13d0110_c5149822a2dc_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{r\ufffd\u0004b\ufffd\u000fn\u0007?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\u0013\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8\u0015\u000by1idi\u0019\u001e\ufffdBCkRip\u0014\ufffd\u008d\u000f\" '\ufffd\ufffdw\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{r\ufffd\u0004b\ufffd\u000fn\u0007?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\u0013\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8\u0015\u000by1idi\u0019\u001e\ufffdBCkRip\u0014\ufffd\u008d\u000f\" '\ufffd\ufffdw\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001c\ufffd\ufffd\ufffd\ufffd\u0720\ufffds\u001e5#k\u0015\ufffd\ufffd*\ufffd\ufffdO\ufffdmG!%\ufffd0\ufffdI\u000bu\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{r\ufffd\u0004b\ufffd\u000fn\u0007?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\u0013\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8\u0015\u000by1idi\u0019\u001e\ufffdBCkRip\u0014\ufffd\u008d\u000f\" '\ufffd\ufffdw\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7bfee03cccc5c12d452fde43dc0cedcc1902bbc9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{r\ufffd\u0004b\ufffd\u000fn\u0007?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\u0013\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8\u0015\u000by1idi\u0019\u001e\ufffdBCkRip\u0014\ufffd\u008d\u000f\" '\ufffd\ufffdw\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000",
"tls_ja3": "b261b049064f0ff57944f1dbeef39d05",
"tls_ja4": "80ec0669a159aa408ededc762ee2bbe2",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd{r\ufffdb\ufffdn?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8y1idi\ufffdBCkRip\ufffd\u008d\" '\ufffd\ufffdw\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#3&$",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{r\ufffd\u0004b\ufffd\u000fn\u0007?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\u0013\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8\u0015\u000by1idi\u0019\u001e\ufffdBCkRip\u0014\ufffd\u008d\u000f\" '\ufffd\ufffdw\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000",
"tls_ja3": "b261b049064f0ff57944f1dbeef39d05",
"tls_ja4": "80ec0669a159aa408ededc762ee2bbe2",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd{r\ufffdb\ufffdn?\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd;\ufffd\ue645\ufffdo\ufffdk\ufffd\ufffd mAh\ufffd8y1idi\ufffdBCkRip\ufffd\u008d\" '\ufffd\ufffdw\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#3&$",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 0b36f59d39468493
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��˥����c���x�Að� � �t��,�� ��I�6� �p��T=�ImM �82�'38� �,�+̩�0�/̨ � � + h
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��˥����c���x�Að� � �t��,�� ��I�6� �p��T=�ImM
�82�'38� �,�+̩�0�/̨ � � + h
Requête brute (extrait)
� ��˥����c���x�Að� � �t��,�� ��I�6� �p��T=�ImM �82�'38� �,�+̩�0�/̨ � � + http/1.1 - 3 & $ 2��9��np.� o �$�z���౪�J #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.8240061289471825,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e9e621eddb6d50c2f4dbc0395ed0f441",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "0b36f59d3946849399766854b1dd53d4",
"ja4": "ea0211238e10f7bb08eb11198c0b775b",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "0b36f59d3946849399766854b1dd53d4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-43-16-23-11-10-13-45-51-35,29-23-24,0",
"tls_ja4_hash": "ea0211238e10f7bb08eb11198c0b775b",
"tls_ja4": "t13d0110_ea7e70c4cd00_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02e5\ufffd\u0012\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\u001c\u0004\ufffd\u001f\ufffd\u001at\ufffd\ufffd,\ufffd\ufffd \ufffd\u0011\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT\u0014=\ufffdI\bmM\u0014\r\ufffd\u001882\ufffd'38\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bh",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02e5\ufffd\u0012\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\u001c\u0004\ufffd\u001f\ufffd\u001at\ufffd\ufffd,\ufffd\ufffd \ufffd\u0011\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT\u0014=\ufffdI\bmM\u0014\r\ufffd\u001882\ufffd'38\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 2\ufffd\ufffd9\ufffd\u0016\u0003\ufffdn\u001bp.\udbf4\udc77\ufffd\no\r\ufffd$\ufffdz\ufffd\ufffd\ufffd\u0c6a\ufffdJ\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02e5\ufffd\u0012\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\u001c\u0004\ufffd\u001f\ufffd\u001at\ufffd\ufffd,\ufffd\ufffd \ufffd\u0011\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT\u0014=\ufffdI\bmM\u0014\r\ufffd\u001882\ufffd'38\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bh",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d40b3826b16d0e419b169a88448d3e8ec34f4c71",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02e5\ufffd\u0012\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\u001c\u0004\ufffd\u001f\ufffd\u001at\ufffd\ufffd,\ufffd\ufffd \ufffd\u0011\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT\u0014=\ufffdI\bmM\u0014\r\ufffd\u001882\ufffd'38\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bh",
"tls_ja3": "0b36f59d3946849399766854b1dd53d4",
"tls_ja4": "ea0211238e10f7bb08eb11198c0b775b",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u02e5\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\ufffd\ufffdt\ufffd\ufffd,\ufffd\ufffd \ufffd\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT=\ufffdImM\r\ufffd82\ufffd'38\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\th",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02e5\ufffd\u0012\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\u001c\u0004\ufffd\u001f\ufffd\u001at\ufffd\ufffd,\ufffd\ufffd \ufffd\u0011\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT\u0014=\ufffdI\bmM\u0014\r\ufffd\u001882\ufffd'38\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bh",
"tls_ja3": "0b36f59d3946849399766854b1dd53d4",
"tls_ja4": "ea0211238e10f7bb08eb11198c0b775b",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u02e5\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdx\ufffdA\u00f0\ufffd\ufffd\ufffdt\ufffd\ufffd,\ufffd\ufffd \ufffd\ufffdI\ufffd6\ufffd\t\ufffdp\ufffd\ufffdT=\ufffdImM\r\ufffd82\ufffd'38\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\th",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 0cea7619da8457a6
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� �^D�|�G?E� �F�o��e��* O�Zp�+� -��x95Ϳ{� �W�p��O.��+B~� 09� �,�+̩�0�/̨ � � htt
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �^D�|�G?E� �F�o��e��* O�Zp�+�
-��x95Ϳ{� �W�p��O.��+B~�
09� �,�+̩�0�/̨ � �
htt
Requête brute (extrait)
� �^D�|�G?E� �F�o��e��* O�Zp�+� -��x95Ϳ{� �W�p��O.��+B~� 09� �,�+̩�0�/̨ � � http/1.1 + 3 & $ �*�1� �k e\&1TX� �k�~�N�j��O - #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.828283032556783,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d7c4f1887587a99b801693e322c26470",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "0cea7619da8457a66dbd6b4bace605c0",
"ja4": "afa8ecfabeacb06ea3c1d369ae5bdd60",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "0cea7619da8457a66dbd6b4bace605c0",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-23-16-43-51-45-11-5-35-13,29-23-24,0",
"tls_ja4_hash": "afa8ecfabeacb06ea3c1d369ae5bdd60",
"tls_ja4": "t13d0110_c0f15bce1ece_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019^D\ufffd|\ufffdG?E\ufffd\u001f\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n\u0001 \u0001-\ufffd\ufffdx95\u037f{\ufffd\u001c\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\u0012\ufffd+B~\ufffd\r09\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhtt",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019^D\ufffd|\ufffdG?E\ufffd\u001f\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n\u0001 \u0001-\ufffd\ufffdx95\u037f{\ufffd\u001c\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\u0012\ufffd+B~\ufffd\r09\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd*\ufffd1\ufffd\u001e\ufffdk\u0002\u001d e\\&1\u0010TX\ufffd\n\ufffdk\ufffd~\ufffdN\ufffdj\ufffd\u0001\ufffdO\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019^D\ufffd|\ufffdG?E\ufffd\u001f\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n\u0001 \u0001-\ufffd\ufffdx95\u037f{\ufffd\u001c\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\u0012\ufffd+B~\ufffd\r09\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhtt",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbbc970d97b0dcc026eda371511bcc1ab7141764",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019^D\ufffd|\ufffdG?E\ufffd\u001f\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n\u0001 \u0001-\ufffd\ufffdx95\u037f{\ufffd\u001c\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\u0012\ufffd+B~\ufffd\r09\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhtt",
"tls_ja3": "0cea7619da8457a66dbd6b4bace605c0",
"tls_ja4": "afa8ecfabeacb06ea3c1d369ae5bdd60",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd^D\ufffd|\ufffdG?E\ufffd\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n -\ufffd\ufffdx95\u037f{\ufffd\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\ufffd+B~\ufffd\r09\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n\thtt",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019^D\ufffd|\ufffdG?E\ufffd\u001f\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n\u0001 \u0001-\ufffd\ufffdx95\u037f{\ufffd\u001c\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\u0012\ufffd+B~\ufffd\r09\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhtt",
"tls_ja3": "0cea7619da8457a66dbd6b4bace605c0",
"tls_ja4": "afa8ecfabeacb06ea3c1d369ae5bdd60",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd^D\ufffd|\ufffdG?E\ufffd\ufffdF\ufffdo\ufffd\ufffde\ufffd\ufffd* O\ufffdZp\ufffd+\ufffd\n -\ufffd\ufffdx95\u037f{\ufffd\ufffdW\ufffdp\ufffd\ufffdO.\ufffd\ufffd+B~\ufffd\r09\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n\thtt",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b8b833fe1921bf9a
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��� �(q� t��-}Ҭ9ͭ�ca��Ǐ�]D�� ���7OةD�B ���t�^��\ <[!� �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��� �(q� t��-}Ҭ9ͭ�ca��Ǐ�]D�� ���7OةD�B ���t�^��\ <[!� �,�+̩�0�/̨ � �
#
Requête brute (extrait)
� ��� �(q� t��-}Ҭ9ͭ�ca��Ǐ�]D�� ���7OةD�B ���t�^��\ <[!� �,�+̩�0�/̨ � � # http/1.1 + 3 & $ Xkd,S�{�Ł�8_ I����, d�Q}�n�I6 -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.8411755007207535,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9ced4dbc08b30282631ee4ffadc3726",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "b8b833fe1921bf9adc40dc9e5c64b5e4",
"ja4": "99cad3e5ca77314ca2ae3b3efe61bc41",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "b8b833fe1921bf9adc40dc9e5c64b5e4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-10-35-11-16-5-43-51-13-45,29-23-24,0",
"tls_ja4_hash": "99cad3e5ca77314ca2ae3b3efe61bc41",
"tls_ja4": "t13d0110_1446ff280f88_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\ufffd\u0013(q\ufffd\u001dt\ufffd\u0007\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd\u00127O\u0629D\ufffd\u0001B\u0000\ufffd\ufffd\ufffd\u0011t\ufffd\u0005^\ufffd\u0012\ufffd\\\u001d<[!\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\ufffd\u0013(q\ufffd\u001dt\ufffd\u0007\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd\u00127O\u0629D\ufffd\u0001B\u0000\ufffd\ufffd\ufffd\u0011t\ufffd\u0005^\ufffd\u0012\ufffd\\\u001d<[!\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 X\u0013kd,S\ufffd{\ufffd\u0141\ufffd8_\u0000I\ufffd\ufffd\ufffd\ufffd, d\ufffd\u0018Q}\ufffdn\ufffdI6\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\ufffd\u0013(q\ufffd\u001dt\ufffd\u0007\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd\u00127O\u0629D\ufffd\u0001B\u0000\ufffd\ufffd\ufffd\u0011t\ufffd\u0005^\ufffd\u0012\ufffd\\\u001d<[!\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cbaa122c288eee44ded60a24b518696bfa5f186d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\ufffd\u0013(q\ufffd\u001dt\ufffd\u0007\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd\u00127O\u0629D\ufffd\u0001B\u0000\ufffd\ufffd\ufffd\u0011t\ufffd\u0005^\ufffd\u0012\ufffd\\\u001d<[!\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"tls_ja3": "b8b833fe1921bf9adc40dc9e5c64b5e4",
"tls_ja4": "99cad3e5ca77314ca2ae3b3efe61bc41",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd(q\ufffdt\ufffd\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd7O\u0629D\ufffdB\ufffd\ufffd\ufffdt\ufffd^\ufffd\ufffd\\<[!\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\f\ufffd\u0013(q\ufffd\u001dt\ufffd\u0007\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd\u00127O\u0629D\ufffd\u0001B\u0000\ufffd\ufffd\ufffd\u0011t\ufffd\u0005^\ufffd\u0012\ufffd\\\u001d<[!\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"tls_ja3": "b8b833fe1921bf9adc40dc9e5c64b5e4",
"tls_ja4": "99cad3e5ca77314ca2ae3b3efe61bc41",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd(q\ufffdt\ufffd\ufffd-}\u04ac9\u036d\ufffdca\ufffd\ufffd\u01cf\ufffd]D\ufffd\ufffd \ufffd\ufffd\ufffd7O\u0629D\ufffdB\ufffd\ufffd\ufffdt\ufffd^\ufffd\ufffd\\<[!\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n#",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 651d3a8cfb45d326
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� �9B P�i���o�́ �1���rdz RՇԫ�� R��`�y���NV�l�cC��'w~V����W �,�+̩�0�/̨ � � 3 & $ �]�+ ,S]m��L5���
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9B P�i���o�́ �1���rdz RՇԫ�� R��`�y���NV�l�cC��'w~V����W �,�+̩�0�/̨ � � 3 & $ �]�+ ,S]m��L5���
Requête brute (extrait)
� �9B P�i���o�́ �1���rdz RՇԫ�� R��`�y���NV�l�cC��'w~V����W �,�+̩�0�/̨ � � 3 & $ �]�+ ,S]m��L5���J5�_�<��;�h�!� + http/1.1 # -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.965948746120716,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88b6eb9991f292302a73d8f49fef36ce",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "651d3a8cfb45d32654fe39a44c808b6f",
"ja4": "9789b0494d92ffede53f67cc773cd9ab",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "651d3a8cfb45d32654fe39a44c808b6f",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-10-43-16-35-45-11-23-5-13,29-23-24,0",
"tls_ja4_hash": "9789b0494d92ffede53f67cc773cd9ab",
"tls_ja4": "t13d0110_f610d13f1bab_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\f\ufffd1\ufffd\ufffd\ufffdr\u0016dz\u001eR\u0547\u052b\ufffd\u0014\ufffd R\ufffd\ufffd\u0007`\ufffd\u0002y\ufffd\u0004\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~\u001bV\ufffd\ufffd\ufffd\u0014\ufffdW\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd]\ufffd+\u000b,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\f\ufffd1\ufffd\ufffd\ufffdr\u0016dz\u001eR\u0547\u052b\ufffd\u0014\ufffd R\ufffd\ufffd\u0007`\ufffd\u0002y\ufffd\u0004\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~\u001bV\ufffd\ufffd\ufffd\u0014\ufffdW\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd]\ufffd+\u000b,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffdJ5\ufffd_\ufffd<\ufffd\ufffd;\ufffdh\ufffd\u0002!\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\f\ufffd1\ufffd\ufffd\ufffdr\u0016dz\u001eR\u0547\u052b\ufffd\u0014\ufffd R\ufffd\ufffd\u0007`\ufffd\u0002y\ufffd\u0004\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~\u001bV\ufffd\ufffd\ufffd\u0014\ufffdW\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd]\ufffd+\u000b,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e7d7eb32f6f11901d60d3302b6d2da49942ceaf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\f\ufffd1\ufffd\ufffd\ufffdr\u0016dz\u001eR\u0547\u052b\ufffd\u0014\ufffd R\ufffd\ufffd\u0007`\ufffd\u0002y\ufffd\u0004\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~\u001bV\ufffd\ufffd\ufffd\u0014\ufffdW\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd]\ufffd+\u000b,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"tls_ja3": "651d3a8cfb45d32654fe39a44c808b6f",
"tls_ja4": "9789b0494d92ffede53f67cc773cd9ab",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd9B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\ufffd1\ufffd\ufffd\ufffdrdzR\u0547\u052b\ufffd\ufffd R\ufffd\ufffd`\ufffdy\ufffd\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~V\ufffd\ufffd\ufffd\ufffdW\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd]\ufffd+,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\f\ufffd1\ufffd\ufffd\ufffdr\u0016dz\u001eR\u0547\u052b\ufffd\u0014\ufffd R\ufffd\ufffd\u0007`\ufffd\u0002y\ufffd\u0004\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~\u001bV\ufffd\ufffd\ufffd\u0014\ufffdW\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd]\ufffd+\u000b,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"tls_ja3": "651d3a8cfb45d32654fe39a44c808b6f",
"tls_ja4": "9789b0494d92ffede53f67cc773cd9ab",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9B\tP\ufffdi\ufffd\ufffd\ufffdo\ufffd\u0341\ufffd1\ufffd\ufffd\ufffdrdzR\u0547\u052b\ufffd\ufffd R\ufffd\ufffd`\ufffdy\ufffd\ufffd\ufffdNV\ufffdl\ufffdcC\ufffd\ufffd'w~V\ufffd\ufffd\ufffd\ufffdW\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd]\ufffd+,S]m\ufffd\ufffdL5\ufffd\ufffd\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 40349c7dc157d4bb
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��C-r�IW[;my/��~�- <�?�\��:|]�o� �W ) /�ʎ�ذ�Vcv��v�b���O� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��C-r�IW[;my/��~�-
<�?�\��:|]�o� �W )
/�ʎ�ذ�Vcv��v�b���O� �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��C-r�IW[;my/��~�- <�?�\��:|]�o� �W ) /�ʎ�ذ�Vcv��v�b���O� �,�+̩�0�/̨ � � http/1.1 3 & $ U<������'?��� ��B��,)-?wu�m{ - + #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.880524071833896,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d450aebb41d26deaa65138cd145cda24",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "40349c7dc157d4bb9afd9b371036db67",
"ja4": "a77012016568026f45c808b23304c814",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "40349c7dc157d4bb9afd9b371036db67",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-16-23-51-45-11-43-10-35,29-23-24,0",
"tls_ja4_hash": "a77012016568026f45c808b23304c814",
"tls_ja4": "t13d0110_18f2a6976a45_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdC-\u0015r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\u0017\u0007\/\u0010\u0015\ufffd\u028e\ufffd\u0630\u0015\ufffdVcv\ufffd\u0015\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdC-\u0015r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\u0017\u0007\/\u0010\u0015\ufffd\u028e\ufffd\u0630\u0015\ufffdVcv\ufffd\u0015\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 U<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\b?\ufffd\ufffd\ufffd\u001d\ufffd\ufffdB\ufffd\ufffd,)-?wu\ufffdm{\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdC-\u0015r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\u0017\u0007\/\u0010\u0015\ufffd\u028e\ufffd\u0630\u0015\ufffdVcv\ufffd\u0015\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e1832e0dd96376b8d67b76c6ecd4fe4c133cad3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdC-\u0015r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\u0017\u0007\/\u0010\u0015\ufffd\u028e\ufffd\u0630\u0015\ufffdVcv\ufffd\u0015\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "40349c7dc157d4bb9afd9b371036db67",
"tls_ja4": "a77012016568026f45c808b23304c814",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdC-r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\/\ufffd\u028e\ufffd\u0630\ufffdVcv\ufffd\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdC-\u0015r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\u0017\u0007\/\u0010\u0015\ufffd\u028e\ufffd\u0630\u0015\ufffdVcv\ufffd\u0015\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "40349c7dc157d4bb9afd9b371036db67",
"tls_ja4": "a77012016568026f45c808b23304c814",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdC-r\ufffdIW[;my\/\ufffd\ufffd~\ufffd-\r<\ufffd?\ufffd\\\ufffd\ufffd:|]\ufffdo\ufffd \ufffdW\t)\n\/\ufffd\u028e\ufffd\u0630\ufffdVcv\ufffd\ufffdv\ufffdb\ufffd\ufffd\ufffdO\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1cba1e0fc1448c6d
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ����Woo���)����v. �U�,D"�B#�[ ��4!�Hb���szU��\:�Ŏ�T�m\( 8l�� �,�+̩�0�/̨ � � http/1.1 -
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����Woo���)����v. �U�,D"�B#�[ ��4!�Hb���szU��\:�Ŏ�T�m\( 8l�� �,�+̩�0�/̨ � � http/1.1 -
Requête brute (extrait)
� ����Woo���)����v. �U�,D"�B#�[ ��4!�Hb���szU��\:�Ŏ�T�m\( 8l�� �,�+̩�0�/̨ � � http/1.1 - + 3 & $ bz�����p��N2�����A�j�)�fKE&�k[n #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.932927351846718,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2c8827493afda2655e05083a51ce2e78",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "1cba1e0fc1448c6d0bf97ce19519afc7",
"ja4": "0deaab516a2fdd1ba681ca6e7c5920ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "1cba1e0fc1448c6d0bf97ce19519afc7",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-16-45-5-13-43-11-10-51-35,29-23-24,0",
"tls_ja4_hash": "0deaab516a2fdd1ba681ca6e7c5920ef",
"tls_ja4": "t13d0110_1b5bf040fddb_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\ufffd\ufffdWoo\ufffd\u000f\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\u000f\ufffd[\u0017 \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(\u001d8l\ufffd\u000f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\ufffd\ufffdWoo\ufffd\u000f\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\u000f\ufffd[\u0017 \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(\u001d8l\ufffd\u000f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u00003\u0000&\u0000$\u0000\u001d\u0000 bz\u0007\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffdN2\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffdj\ufffd)\ufffdfKE&\ufffdk[n\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\ufffd\ufffdWoo\ufffd\u000f\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\u000f\ufffd[\u0017 \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(\u001d8l\ufffd\u000f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "efb1aa2941714dbd03c04347963185ad293c9172",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\ufffd\ufffdWoo\ufffd\u000f\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\u000f\ufffd[\u0017 \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(\u001d8l\ufffd\u000f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000",
"tls_ja3": "1cba1e0fc1448c6d0bf97ce19519afc7",
"tls_ja4": "0deaab516a2fdd1ba681ca6e7c5920ef",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdWoo\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\ufffd[ \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(8l\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u000e\ufffd\ufffdWoo\ufffd\u000f\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\u000f\ufffd[\u0017 \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(\u001d8l\ufffd\u000f\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000",
"tls_ja3": "1cba1e0fc1448c6d0bf97ce19519afc7",
"tls_ja4": "0deaab516a2fdd1ba681ca6e7c5920ef",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdWoo\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffd\ufffdv. \ufffdU\ufffd,D\"\ufffdB#\ufffd[ \ufffd\ufffd4!\ufffdHb\ufffd\ufffd\ufffdszU\ufffd\ufffd\\:\ufffd\u014e\ufffdT\ufffdm\\(8l\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1-",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 fbbfc594fdb9cb87
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� �3䴀I��x���"l<���/}=|�߷u� �Y�gMp��i�U��Ԟ�#�����]`�z� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �3䴀I��x���"l<���/}=|�߷u� �Y�gMp��i�U��Ԟ�#�����]`�z� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �3䴀I��x���"l<���/}=|�߷u� �Y�gMp��i�U��Ԟ�#�����]`�z� �,�+̩�0�/̨ � � # + http/1.1 3 & $ �c�D>zQ�=� ��WQ]�w�}�Kv�~c�� -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.912675963791794,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d25d5469d6c48e37fd34573081e01d8c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "fbbfc594fdb9cb877e9cb882b1837b37",
"ja4": "c2208bb8e7d007c71f4e666336cc899e",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "fbbfc594fdb9cb877e9cb882b1837b37",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-11-35-10-23-43-16-51-45,29-23-24,0",
"tls_ja4_hash": "c2208bb8e7d007c71f4e666336cc899e",
"tls_ja4": "t13d0110_34a7fa310d97_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\u4d00I\ufffd\u001b\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=\u0016|\ufffd\u07f7\u07b8\u0004u\u000e\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]\u0014`\ufffdz\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\u4d00I\ufffd\u001b\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=\u0016|\ufffd\u07f7\u07b8\u0004u\u000e\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]\u0014`\ufffdz\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdc\u0012\ufffdD>zQ\ufffd=\ufffd\n\ufffd\ufffdWQ]\ufffdw\ufffd}\ufffd\u0015Kv\ufffd~c\ufffd\u0010\ufffd\u0010\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\u4d00I\ufffd\u001b\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=\u0016|\ufffd\u07f7\u07b8\u0004u\u000e\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]\u0014`\ufffdz\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dcb5014ad3c5e000809a39b6e5871364d19fb16a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\u4d00I\ufffd\u001b\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=\u0016|\ufffd\u07f7\u07b8\u0004u\u000e\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]\u0014`\ufffdz\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "fbbfc594fdb9cb877e9cb882b1837b37",
"tls_ja4": "c2208bb8e7d007c71f4e666336cc899e",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd3\u4d00I\ufffd\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=|\ufffd\u07f7\u07b8u\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]`\ufffdz\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\u4d00I\ufffd\u001b\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=\u0016|\ufffd\u07f7\u07b8\u0004u\u000e\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]\u0014`\ufffdz\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "fbbfc594fdb9cb877e9cb882b1837b37",
"tls_ja4": "c2208bb8e7d007c71f4e666336cc899e",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd3\u4d00I\ufffd\ufffdx\ufffd\ufffd\ufffd\"l<\ufffd\ufffd\ufffd\/}=|\ufffd\u07f7\u07b8u\ufffd \ufffdY\ufffdgMp\ufffd\ufffdi\ufffdU\ufffd\ufffd\u051e\ufffd#\ufffd\ufffd\u05fe\ufffd\ufffd\ufffd]`\ufffdz\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c237e610e90b5306
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ����_�� R�hS�� 1�2f ���FN� `�J � ���R���Xb����Q�� �Ңf���'�� �,�+̩�0�/̨ � � +
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����_�� R�hS�� 1�2f ���FN� `�J � ���R���Xb����Q�� �Ңf���'�� �,�+̩�0�/̨ � � +
Requête brute (extrait)
� ����_�� R�hS�� 1�2f ���FN� `�J � ���R���Xb����Q�� �Ңf���'�� �,�+̩�0�/̨ � � + http/1.1 - 3 & $ >�?�*���Ӽw�u�\#��N��� x�P #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.830807597010071,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bf4e73e8b7cdd3f146128a62852eab2f",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "c237e610e90b53065c2cf17fe0a365ca",
"ja4": "03110b9ecc6a6b9a11057e2aac0a239f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "c237e610e90b53065c2cf17fe0a365ca",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-43-5-16-23-45-51-35-13-10,29-23-24,0",
"tls_ja4_hash": "03110b9ecc6a6b9a11057e2aac0a239f",
"tls_ja4": "t13d0110_6b90ddfe02e2_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0015\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\u0000\ufffd\ufffd\u0010\ufffdFN\ufffd\u0000`\ufffdJ \ufffd\u001f\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\u0003\ufffd'\ufffd\u0013\ufffd\u0019\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0015\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\u0000\ufffd\ufffd\u0010\ufffdFN\ufffd\u0000`\ufffdJ \ufffd\u001f\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\u0003\ufffd'\ufffd\u0013\ufffd\u0019\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 >\ufffd?\ufffd*\ufffd\ufffd\ufffd\u0004\u04fcw\ufffd\u0017u\ufffd\\\u0001#\ufffd\ufffdN\ufffd\ufffd\u001a\ufffd\fx\ufffdP\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0015\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\u0000\ufffd\ufffd\u0010\ufffdFN\ufffd\u0000`\ufffdJ \ufffd\u001f\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\u0003\ufffd'\ufffd\u0013\ufffd\u0019\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c0a8a048d580b88b5d846ab88cc40c413f91e85",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0015\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\u0000\ufffd\ufffd\u0010\ufffdFN\ufffd\u0000`\ufffdJ \ufffd\u001f\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\u0003\ufffd'\ufffd\u0013\ufffd\u0019\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010",
"tls_ja3": "c237e610e90b53065c2cf17fe0a365ca",
"tls_ja4": "03110b9ecc6a6b9a11057e2aac0a239f",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\ufffd\ufffd\ufffdFN\ufffd`\ufffdJ \ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd_\ufffd\u0015\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\u0000\ufffd\ufffd\u0010\ufffdFN\ufffd\u0000`\ufffdJ \ufffd\u001f\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\u0003\ufffd'\ufffd\u0013\ufffd\u0019\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010",
"tls_ja3": "c237e610e90b53065c2cf17fe0a365ca",
"tls_ja4": "03110b9ecc6a6b9a11057e2aac0a239f",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\tR\ufffdhS\ufffd\ufffd\t1\ufffd2f\ufffd\ufffd\ufffdFN\ufffd`\ufffdJ \ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd\ufffdXb\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd \ufffd\u04a2f\ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 13e23a693375d389
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��NeT�3�'"�y����*`�v��eBV��8 �k�vGt��E�+݁͑�� �H�q�nn6n �,�+̩�0�/̨ � � + - 3 &
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��NeT�3�'"�y����*`�v��eBV��8 �k�vGt��E�+݁͑�� �H�q�nn6n �,�+̩�0�/̨ � � + - 3 &
Requête brute (extrait)
� ��NeT�3�'"�y����*`�v��eBV��8 �k�vGt��E�+݁͑�� �H�q�nn6n �,�+̩�0�/̨ � � + - 3 & $ ��$�&n ��?e��8< ��� cf��,� http/1.1 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.84060363932063,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "90333af73ee762be49ed9d941a3d4b68",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "13e23a693375d3891468437e360bbbf2",
"ja4": "3447dfa25ead6c7965813a1b0e2ce5f8",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "13e23a693375d3891468437e360bbbf2",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-45-51-16-35-10-23-5-13,29-23-24,0",
"tls_ja4_hash": "3447dfa25ead6c7965813a1b0e2ce5f8",
"tls_ja4": "t13d0110_cfbd22fe1987_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdNe\u0002T\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\u000f\ufffd\u0017v\ufffd\ufffdeBV\ufffd\ufffd8 \u0006\ufffdk\ufffd\u0007vGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\u0003\ufffd\u001d\ufffdH\ufffdq\ufffdn\bn6n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdNe\u0002T\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\u000f\ufffd\u0017v\ufffd\ufffdeBV\ufffd\ufffd8 \u0006\ufffdk\ufffd\u0007vGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\u0003\ufffd\u001d\ufffdH\ufffdq\ufffdn\bn6n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b\ufffd\ufffd$\ufffd&n\f\ufffd\ufffd?e\ufffd\u0014\ufffd8<\u000b\ufffd\ufffd\ufffd\u001fcf\ufffd\ufffd,\ufffd\u0007\u0007\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdNe\u0002T\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\u000f\ufffd\u0017v\ufffd\ufffdeBV\ufffd\ufffd8 \u0006\ufffdk\ufffd\u0007vGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\u0003\ufffd\u001d\ufffdH\ufffdq\ufffdn\bn6n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0fb0d136b9aee00e69f18a0562f401f27775f224",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdNe\u0002T\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\u000f\ufffd\u0017v\ufffd\ufffdeBV\ufffd\ufffd8 \u0006\ufffdk\ufffd\u0007vGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\u0003\ufffd\u001d\ufffdH\ufffdq\ufffdn\bn6n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"tls_ja3": "13e23a693375d3891468437e360bbbf2",
"tls_ja4": "3447dfa25ead6c7965813a1b0e2ce5f8",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdNeT\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\ufffdv\ufffd\ufffdeBV\ufffd\ufffd8 \ufffdk\ufffdvGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\ufffd\ufffdH\ufffdq\ufffdnn6n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-3&",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdNe\u0002T\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\u000f\ufffd\u0017v\ufffd\ufffdeBV\ufffd\ufffd8 \u0006\ufffdk\ufffd\u0007vGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\u0003\ufffd\u001d\ufffdH\ufffdq\ufffdn\bn6n\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"tls_ja3": "13e23a693375d3891468437e360bbbf2",
"tls_ja4": "3447dfa25ead6c7965813a1b0e2ce5f8",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdNeT\ufffd3\ufffd'\"\ufffdy\ufffd\ufffd\ufffd\ufffd*`\ufffdv\ufffd\ufffdeBV\ufffd\ufffd8 \ufffdk\ufffdvGt\ufffd\ufffdE\ufffd+\u0741\u0351\ufffd\ufffd\ufffdH\ufffdq\ufffdnn6n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-3&",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a967673832b8c3df
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� �ٞ�=$*�(Q��5xf��1��ݬ��v���� ��ꯇ쌮2 ���}�V��E�W�#n�� �,�+̩�0�/̨ � � + http/1.1
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ٞ�=$*�(Q��5xf��1��ݬ��v���� ��ꯇ쌮2 ���}�V��E�W�#n�� �,�+̩�0�/̨ � � + http/1.1
Requête brute (extrait)
� �ٞ�=$*�(Q��5xf��1��ݬ��v���� ��ꯇ쌮2 ���}�V��E�W�#n�� �,�+̩�0�/̨ � � + http/1.1 # - 3 & $ ���뿗��/.Ac�״H%�{�D����Ĥ�=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.864435936894237,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2719b97d8024d783dfe822eec8305673",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "a967673832b8c3df524f05c6bc7a177d",
"ja4": "e371d72e7bc43baabe4104796fd7ee1f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "a967673832b8c3df524f05c6bc7a177d",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-16-10-13-5-11-35-45-51-23,29-23-24,0",
"tls_ja4_hash": "e371d72e7bc43baabe4104796fd7ee1f",
"tls_ja4": "t13d0110_f7639ceb5c52_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065e\ufffd=$*\ufffd(\u0004Q\ufffd\ufffd5x\u0018f\ufffd\ufffd\u00031\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\u000b\ufffd\ufffd\ufffd}\ufffdV\u0002\ufffd\u0006\u0018\u000e\u0017\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065e\ufffd=$*\ufffd(\u0004Q\ufffd\ufffd5x\u0018f\ufffd\ufffd\u00031\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\u000b\ufffd\ufffd\ufffd}\ufffdV\u0002\ufffd\u0006\u0018\u000e\u0017\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ubfd7\ufffd\ufffd\/.Ac\ufffd\u05f4H%\ufffd{\ufffdD\ufffd\ufffd\ufffd\ufffd\u0124\ufffd=\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065e\ufffd=$*\ufffd(\u0004Q\ufffd\ufffd5x\u0018f\ufffd\ufffd\u00031\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\u000b\ufffd\ufffd\ufffd}\ufffdV\u0002\ufffd\u0006\u0018\u000e\u0017\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3e8abd704a1910bdb02da2795455facba0974e44",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065e\ufffd=$*\ufffd(\u0004Q\ufffd\ufffd5x\u0018f\ufffd\ufffd\u00031\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\u000b\ufffd\ufffd\ufffd}\ufffdV\u0002\ufffd\u0006\u0018\u000e\u0017\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000",
"tls_ja3": "a967673832b8c3df524f05c6bc7a177d",
"tls_ja4": "e371d72e7bc43baabe4104796fd7ee1f",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\u065e\ufffd=$*\ufffd(Q\ufffd\ufffd5xf\ufffd\ufffd1\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\ufffd\ufffd\ufffd}\ufffdV\ufffd\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\thttp\/1.1",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u065e\ufffd=$*\ufffd(\u0004Q\ufffd\ufffd5x\u0018f\ufffd\ufffd\u00031\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\u000b\ufffd\ufffd\ufffd}\ufffdV\u0002\ufffd\u0006\u0018\u000e\u0017\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000",
"tls_ja3": "a967673832b8c3df524f05c6bc7a177d",
"tls_ja4": "e371d72e7bc43baabe4104796fd7ee1f",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u065e\ufffd=$*\ufffd(Q\ufffd\ufffd5xf\ufffd\ufffd1\ufffd\ufffd\u076c\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\uabc7\uc32e2\ufffd\ufffd\ufffd}\ufffdV\ufffd\ufffdE\ufffdW\ufffd#n\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+\thttp\/1.1",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 598ba558fd7a2065
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ���v�d]�MIdϘ�L���Tp�A;ǰKϔJ B��O�2�I��j\������ đ f'�G#i �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���v�d]�MIdϘ�L���Tp�A;ǰKϔJ B��O�2�I��j\������ đ f'�G#i �,�+̩�0�/̨ � �
Requête brute (extrait)
� ���v�d]�MIdϘ�L���Tp�A;ǰKϔJ B��O�2�I��j\������ đ f'�G#i �,�+̩�0�/̨ � � # 3 & $ �2R� /��p� �1L���l���7�1�p�CL, - http/1.1 +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 241,
"payload_entropy": 5.860333462981058,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "kerberos",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a046007fef2ba91cda10578b5c579aa4",
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6",
"ja3": "598ba558fd7a2065226e11bf66bec974",
"ja4": "e4652ef6c805c98152b82347f42c7602",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "598ba558fd7a2065226e11bf66bec974",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-35-51-23-11-45-10-16-43,29-23-24,0",
"tls_ja4_hash": "e4652ef6c805c98152b82347f42c7602",
"tls_ja4": "t13d0110_4f1359799548_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffd\u0007L\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u0003\u03d4J\b B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffd\u0007L\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u0003\u03d4J\b B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd2R\ufffd\u001f\/\ufffd\ufffd\u0007p\ufffd\u001d\ufffd1L\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd7\ufffd1\ufffdp\ufffdCL,\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffd\u0007L\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u0003\u03d4J\b B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abf7e08b4b9bdb6685697554c6f5a4749e913633",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffd\u0007L\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u0003\u03d4J\b B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "598ba558fd7a2065226e11bf66bec974",
"tls_ja4": "e4652ef6c805c98152b82347f42c7602",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffdL\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u03d4J B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffd\u0007L\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u0003\u03d4J\b B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\u0017\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005",
"tls_ja3": "598ba558fd7a2065226e11bf66bec974",
"tls_ja4": "e4652ef6c805c98152b82347f42c7602",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdv\ufffdd]\ufffdMId\u03d8\ufffdL\ufffd\ufffd\ufffdTp\ufffdA;\u01f0K\u03d4J B\ufffd\ufffdO\ufffd2\ufffdI\ufffd\ufffdj\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0086\t\u0111\tf'\ufffdG#i\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /html/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /html/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 101,
"payload_entropy": 5.015027271163485,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eadf113e9baa15a28b1e3e497602e1a4",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "65810e569b15996d83b10eb8a6150386f8d4f0eb",
"protocol_details": {
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /backend/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /backend/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 104,
"payload_entropy": 4.990230680638121,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da3076944adb78263ec3993bd9aafdbd",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f99c5883b552f2cfe12cc43ea20ca1c8c569984",
"protocol_details": {
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 96,
"payload_entropy": 4.955255934407698,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "43467c7a51c81c3918b90de46b844335",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dda7d180cfb05108d4bf5b2cffc3de3b7c2783c1",
"protocol_details": {
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /app/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /app/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5289ee3bd54791e18f3d34837bdde927",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1fffeb884d28cc5dc49348ddb9437a2f89a89c88",
"protocol_details": {
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /var/www/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /var/www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 104,
"payload_entropy": 4.973142397239314,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eae7e57fb7e62a9c0ef880bcb032629a",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb5e69e7246a2ebe7fe7d7573ae334b1814cdb1e",
"protocol_details": {
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /src/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /src/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 100,
"payload_entropy": 4.932787665793271,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "97f170c67617728c639503ddf1ff45a8",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d315a58dbfbacaa2dab829b31f5b47f37d32d183",
"protocol_details": {
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /site/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /site/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 101,
"payload_entropy": 4.9368081174021965,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cf3368aab4fce6395f1c98c3e532ef68",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ce5d429153db040a007f5ba76c0d9cd35063583",
"protocol_details": {
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /htdocs/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /htdocs/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 103,
"payload_entropy": 4.957748383100416,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "edc1b4a24a1c89ef3e202effa3a71466",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cdc7cd6fe31ee8ccb074bba22b1dd172586590c",
"protocol_details": {
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde port 88/TCP
port 88 tcp · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_redis_probe
redis_config_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Preuve honeypot — Sonde port 88/TCP
Connexion détectée sur le port 88 (TCP) du capteur simulé.
Service
KERBEROS
Payload
GET /www/.git/config HTTP/1.1 accept: */* user-agent: crusader-worker/1.0 host: 62.3.50.33:88
Pourquoi cette classification : Type « port_88_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 41
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:88
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 100,
"payload_entropy": 4.9603365408149065,
"port_category": "well_known",
"org": "Google LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 396982,
"country": "SG",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d83bf6bbff44805d76460dbd96732842f0a7ba9c",
"event_fingerprint": "8cf3b94b891f2b7250661c966e78abe6b11ace29",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "kerberos",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f1a197a1a9277d7a0a475e32465e5803",
"path_pattern_hash": "a8cbe6f02b63cccf4b38727aecb1757a"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 41
},
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"evidence": {
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ab96a4aab535ebed084072ee352f13b8d64ded2",
"protocol_details": {
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_88_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "port 88 tcp \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:88",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_redis_probe",
"redis_config_probe"
],
"asn_dc_heuristic": true
}
|