Détails IP 143.110.196.222

Synthèse exécutive

Profil de menace

Score de risque 69/100 Élevé

Première observation 24/07/2026 16:48 UTC

Dernière observation 24/07/2026 16:48 UTC

Événements (période) 39

MITRE ATT&CK principal TA0007 36 occurrences

Activité suspecte · risque 34/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « webmin_probe » (signaux protocolaires) · confiance 0%

Confiance 8 % — Score WAF 8 · Bonus corrélation +8

Comparaison ASN / FAI

ASN 14061 · 143.110.192.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 39 événements sur la période pour cette IP.

137.184.32.56 Sonde port 24/07/2026 19:35 UTC
64.23.214.73 Sonde port 24/07/2026 19:34 UTC
143.198.150.150 Sonde port 24/07/2026 19:34 UTC
138.68.93.37 vnc bruteforce 24/07/2026 19:34 UTC
143.198.238.87 Sonde port 24/07/2026 19:33 UTC
146.190.153.30 Cross-site scripting 24/07/2026 19:33 UTC
137.184.13.100 Sonde TLS 24/07/2026 19:33 UTC
209.38.70.156 Sonde port 24/07/2026 19:32 UTC

Événements (filtres)

Première observation

24/07/2026 16:48 UTC

Dernière observation

24/07/2026 16:48 UTC

Dernière activité (filtres)

24/07/2026 16:48 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

WEBMIN TCP 34 HTTP TCP 5

WEBMIN

HTTP

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

DigitalOcean, LLC 0 Port 10000 webmin_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

webmin probe · via WEBMIN:10000 · (sonde / probe)

Détails protocole

Aperçu payload

I20100

Port / service

10000 · WEBMIN

Service émulé

WEBMIN

Raison confiance

Confiance 0 % — 2 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

8% Corrélation +8

Famille de menace

enterprise_scan

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

39 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

39 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
24/07/2026 16:48:53 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload I20100 Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) I20100 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 8, "payload_entropy": 2.4056390622295662, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "39fea238df890c005706b34a9316349a", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 34 }, "payload_preview": "\u0001I20100\n", "request_sample": "\u0001I20100\n", "payload_snippet": "\u0001I20100", "evidence": { "request_sample": "\u0001I20100\n", "payload_snippet": "\u0001I20100", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e46da6276ef859ef9cb12e3bb33fb771e6c7d9ee", "protocol_details": { "payload_preview": "\u0001I20100", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "I20100", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0001I20100", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "I20100", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:52 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload �ANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1 Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0577 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �ANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1 Requête brute (extrait) �ANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1@1.2.840.10008.1.2P:Q@R1.2.826.0.1.3680043.2.1396.999U CharruaVista Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 211, "payload_entropy": 3.723542292143943, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0577" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2b2f0f60ab534853bdae51b3f2504307", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_snippet": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1", "evidence": { "request_sample": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1@\u0000\u0000\u00111.2.840.10008.1.2P\u0000\u0000:Q\u0000\u0000\u0004\u0000\u0000@\u0000R\u0000\u0000\u001e1.2.826.0.1.3680043.2.1396.999U\u0000\u0000\fCharruaVista", "payload_snippet": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e54ba806f3c6ddcec375f7604667751aed03a625", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffdANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0577" ], "tags_summary_labels_fr": [ "pat-0577" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\u0000\u0000\ufffd\u0000\u0001\u0000\u0000ANY-SCP\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000FINDSCU\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u00151.2.840.10008.3.1.1.1 \u0000\u0000.\u0001\u0000\u0000\u00000\u0000\u0000\u00111.2.840.10008.1.1", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdANY-SCPFINDSCU1.2.840.10008.3.1.1.1 .01.2.840.10008.1.1", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:52 UTC	TCP	10000 · WEBMIN	webmin	Sonde RDP rdp probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Investiguer Tags net_webmin_probe tor_exit_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload ,'�Cookie: mstshash=Administrator Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Mumble ping Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) ,'�Cookie: mstshash=Administrator Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 51, "payload_entropy": 4.135751247023955, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 50, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1fc230620f0b6687de9d16ed2587a737294a0d91", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0768", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Mumble ping", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0768", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c95ff23a3feaef89ab3569b251ff78d", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87dc5e1ffe4fcef824ea0a68a1cb3a0b4f11d9d8", "protocol_details": { "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": ",'\ufffdCookie: mstshash=Administrator", "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0003\u0000\u0000,'\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": ",'\ufffdCookie: mstshash=Administrator", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_webmin_probe", "tor_exit_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:52 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 5, "payload_entropy": 0, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8855508aade16ec573d21e6a485dfd0a", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2f85c731877dcaba79cbc5300ee57d53422e623f", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:51 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload �+<M��nonebeio Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �+<M��nonebeio Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 156, "payload_entropy": 1.0105311893353954, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ab337a89f397026542899f981012b540", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2a58bd8950ed6086b4ad7cc91e50bfbd7f2df9bb", "protocol_details": { "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonebeio", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\ufffd\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\ufffd\ufffd\u0000\u0001none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000beio\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd+<M\ufffd\ufffdnonebeio", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:51 UTC	TCP	10000 · WEBMIN	webmin	Sonde SMB smb probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0354 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SMB negotiate Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 24, "payload_entropy": 1.0238995733215064, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0354" ], "kb_rule_ids": [ "pat-0354" ], "matched_patterns": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SMB negotiate", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0354", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b54520be3d454f6926b094aac799ac34", "path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 32 }, "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "32e53b6b8fe4c51df579d04c7b49299e35f682d7", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "smb probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0354" ], "tags_summary_labels_fr": [ "pat-0354" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "smb probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:51 UTC	TCP	10000 · WEBMIN	webmin	tor exit probe tor exit probe · via WEBMIN:10000 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0011 TA0011 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe tor_exit_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload �_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46% Confiance classification 54% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 46 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Technique MITRE TA0011 Tactiques MITRE TA0011 Motifs de détection (base) STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA Requête brute (extrait) �_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryAuthMethod=None Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 144, "payload_entropy": 4.322879559217196, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1fc230620f0b6687de9d16ed2587a737294a0d91", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "confidence": 0.54, "classification_confidence": 0.54, "precision_score": 55, "precision_signals": [ "INT-TOR-exit-hint" ], "kb_rule_ids": [ "INT-TOR-exit-hint" ], "matched_patterns": [ "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 46, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c3b76b5602952ca3d678868a2a4dc525", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 35 }, "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A", "request_sample": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000", "payload_snippet": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A", "evidence": { "request_sample": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000AuthMethod=None\u0000\u0000", "payload_snippet": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dfa5b34b4bf9b506320ded1789d9d372a0471c7b", "protocol_details": { "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA", "attack_vector": "tor exit probe \u00b7 via WEBMIN:10000 \u00b7 (commande & contr\u00f4le)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 46 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 54 % \u2014 via WEBMIN \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 54, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint" ], "tags_summary_labels_fr": [ "Tor Exit Hint" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0003\ufffd\u0000\u0000\u0000\u0000\u0000_@\u0000\u00017\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probe\u0000SessionType=Discovery\u0000A", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "tor exit probe \u00b7 via WEBMIN:10000 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "\ufffd_@7InitiatorName=iqn.1991-05.com.microsoft:beio-iscsi-probeSessionType=DiscoveryA", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 46 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "command_and_control", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "tor_exit_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:50 UTC	TCP	10000 · WEBMIN	webmin	Sonde WebSphere websphere probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload GIOP$abcdefget Pourquoi cette classification : Type « websphere_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0605 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) GIOP WebSphere IIOP Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) GIOP$abcdefget Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 48, "payload_entropy": 2.5723387961875535, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0605" ], "kb_rule_ids": [ "pat-0605" ], "matched_patterns": [ "pat-0605", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "GIOP WebSphere IIOP", "Mumble ping", "STUN binding", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0605", "pat-0768", "pat-0771", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 47, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2295e3d24182f08220a2dae2c40ff1c", "path_pattern_hash": "a8ef247ba3612b90c1c670387b185e85" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan", "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3ecb2d6e76c6f3dbe25bfd136e92a8246b0d3a2b", "protocol_details": { "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "GIOP$abcdefget", "attack_vector": "websphere probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab websphere_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0605" ], "tags_summary_labels_fr": [ "pat-0605" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "GIOP\u0001\u0000\u0001\u0000$\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006\u0000\u0000\u0000abcdef\u0000\u0000\u0004\u0000\u0000\u0000get\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "websphere probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GIOP$abcdefget", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:50 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload 87�&�� Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 87�&�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 16, "payload_entropy": 3.0306390622295662, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e522ef50a429f4fc944717d334d0c486", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bfade08a9b37a18ff2a6b8d49c6114295321728d", "protocol_details": { "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "87\ufffd&\ufffd\ufffd\ufffd", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u000e87\ufffd&\b\ufffd\u001b\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "87\ufffd&\ufffd\ufffd\ufffd", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:50 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload LIORL ��c��d `http://192.168.10.100/msmq/priv Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) LIORL ��c��d `http://192.168.10.100/msmq/priv Requête brute (extrait) LIORL ��c��d `http://192.168.10.100/msmq/private$/queuejumperpoc<se:Envelo Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 2380, "payload_entropy": 4.684268227684846, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4e59b427ee6488faa8803fa276e99d84", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_snippet": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000", "evidence": { "request_sample": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000a\u0000t\u0000e\u0000$\u0000\/\u0000q\u0000u\u0000e\u0000u\u0000e\u0000j\u0000u\u0000m\u0000p\u0000e\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000p\u0000o\u0000c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001b\u0002\u0000\u0000<\u0000s\u0000e\u0000:\u0000E\u0000n\u0000v\u0000e\u0000l\u0000o\u0000", "payload_snippet": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94879929fb78317b522c9addde52780a1d9f22e3", "protocol_details": { "payload_preview": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "LIORL\t\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdd `http:\/\/192.168.10.100\/msmq\/priv", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0010\u0000\u0003\u0000LIORL\t\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000c\ufffd\ufffdd\u0001\u0000\u0000\u0000\u0001\u001c \u0002`\u0000h\u0000t\u0000t\u0000p\u0000:\u0000\/\u0000\/\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00001\u00000\u0000.\u00001\u00000\u00000\u0000\/\u0000m\u0000s\u0000m\u0000q\u0000\/\u0000p\u0000r\u0000i\u0000v\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "LIORL\t\ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdd `http:\/\/192.168.10.100\/msmq\/priv", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:49 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Z6,� :�(CONNECT_DATA=(COMMAND=version)) Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Z6,� :�(CONNECT_DATA=(COMMAND=version)) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 89, "payload_entropy": 3.590885939096492, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e6ee9d885892cc379640f5aecf8397b8", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "evidence": { "request_sample": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "payload_snippet": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db429b0b0d914ff4a8a80b0b724151c6b64ee4f1", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "Z6,\ufffd :\ufffd(CONNECT_DATA=(COMMAND=version))", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000Z\u0000\u0000\u0001\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000\ufffd\b\u0000\u0000\u0000\u0001\u0000 \u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\ufffd\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(CONNECT_DATA=(COMMAND=version))", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "Z6,\ufffd :\ufffd(CONNECT_DATA=(COMMAND=version))", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:49 UTC	TCP	10000 · WEBMIN	webmin	Protocole TDS MSSQL mssql tds · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags mssql_tds net_mssql_tds webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload 4 (�UMSSQLServerH Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0519 Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) 4(�UMSSQLServerH Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 52, "payload_entropy": 3.604409845438833, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4f0ae6df497b1f569d6cff6a7cb22c94afe73229", "event_fingerprint": "d80402ad770e4faec0c14a65c8bcf655b998de8e", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 83, "precision_signals": [ "pat-0519", "INT-upstream" ], "kb_rule_ids": [ "pat-0519", "INT-upstream" ], "matched_patterns": [ "pat-0519", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 95, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "23edc99bdfe5fe902f5ff28aa98ef130", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 35 }, "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "evidence": { "request_sample": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "payload_snippet": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21be64fbd4925a7c0acfb35df5e24c15221164b7", "protocol_details": { "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "4(\ufffdUMSSQLServerH", "attack_vector": "mssql tds \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0519", "INT-upstream" ], "tags_summary_labels_fr": [ "pat-0519", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004\ufffd\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "mssql tds \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "4(\ufffdUMSSQLServerH", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mssql_tds", "net_mssql_tds", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:49 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0532 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 18, "payload_entropy": 1.2086489509530647, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0532" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "817773a4a3987fc7642ff30928d792fc", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "evidence": { "request_sample": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "payload_snippet": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "840241accf3a0af4d54a22f275a20e6c24d40cc2", "protocol_details": { "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0532" ], "tags_summary_labels_fr": [ "pat-0532" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u000f\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:48 UTC	TCP	10000 · WEBMIN	webmin	Protocole wire MongoDB mongodb wire protocol · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags mongodb_wire_protocol net_mongodb_wire_protocol rdp_cookie_alt webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload :/@=/@ Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 80% Confiance classification 88% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance 80 % — 4 signal(aux) capteur Protocole émulé 1 Signaux ET-PROTO-MongoDB-Wire Upstream Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) NFS RPC mount Mumble ping Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) :/@=/@ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 60, "payload_entropy": 1.3389205950315934, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 33, "tag_count": 4, "anomaly_count": 0, "campaign_key": "10f8f96c38bd37ecb94798f830860b978b260bcf", "event_fingerprint": "fecec4e041e0cd982cba67fdaa5d156ecf087c64", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "confidence": 0.88, "classification_confidence": 0.88, "precision_score": 90, "precision_signals": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "kb_rule_ids": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "matched_patterns": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "NFS RPC mount", "Mumble ping", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0532", "pat-0768", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "mongodb_probe", "service_name": "webmin", "risk_confidence_factor": 80, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f60433e5ca098d6d06ab4b829e9f35c4", "path_pattern_hash": "9060bd55aeb34075959b54fecab264ea" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 33 }, "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "235c938420888a78a0ce684afc49a286b304b038", "protocol_details": { "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": ":\/@=\/@", "attack_vector": "mongodb wire protocol \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 88, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 33, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "ET-PROTO-MongoDB-Wire", "INT-upstream" ], "tags_summary_labels_fr": [ "ET-PROTO-MongoDB-Wire", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": ":\u0000\u0000\u0000\/\u0000\u0000\u0000\u0002\u0000\u0000@\u0002\u000f\u0000\u0001\u0000=\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\/\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "mongodb wire protocol \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": ":\/@=\/@", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 80 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": "Confiance 88 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_wire_protocol", "net_mongodb_wire_protocol", "rdp_cookie_alt", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:48 UTC	TCP	10000 · WEBMIN	webmin	Sonde Java RMI java rmi probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload JRMIK Pourquoi cette classification : Type « java_rmi_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0604 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Java RMI JRMI User-Agent — Règles WAF — Payload (extrait) JRMIK Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 7, "payload_entropy": 2.807354922057604, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0604" ], "kb_rule_ids": [ "pat-0604" ], "matched_patterns": [ "pat-0604" ], "matched_pattern_names": [ "Java RMI JRMI" ], "pattern_ids": [ "pat-0604" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8c49a0f759e2102fb8fa8368049d06a", "path_pattern_hash": "7a566ca86213ccd15a91c0b5a885a24f" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 32 }, "payload_preview": "JRMI\u0000\u0002K", "request_sample": "JRMI\u0000\u0002K", "payload_snippet": "JRMI\u0000\u0002K", "evidence": { "request_sample": "JRMI\u0000\u0002K", "payload_snippet": "JRMI\u0000\u0002K", "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e8720d37779ce29bc4ce57119ed3585d60351cd", "protocol_details": { "payload_preview": "JRMI\u0000\u0002K", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "JRMIK", "attack_vector": "java rmi probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab java_rmi_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0604" ], "tags_summary_labels_fr": [ "pat-0604" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "JRMI\u0000\u0002K", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "java rmi probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "JRMIK", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:48 UTC	TCP	10000 · WEBMIN	webmin	Sonde Kafka kafka probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload �� MMS�� NSPlayer/9...98; {AA-A-a-AAA- Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key RADIUS Access-Request Minecraft varint handshake TFTP RRQ WireGuard handshake User-Agent — Règles WAF — Payload (extrait) ��MMS��NSPlayer/9...98; {AA-A-a-AAA- Requête brute (extrait) �� MMS�� NSPlayer/9...98; {AA-A-a-AAA-AAAAA}�m�_ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 151, "payload_entropy": 2.9394053309596297, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0577", "pat-0554", "pat-0536", "pat-0623" ], "matched_pattern_names": [ "Kafka ApiVersions key", "RADIUS Access-Request", "Minecraft varint handshake", "TFTP RRQ", "WireGuard handshake" ], "pattern_ids": [ "pat-0556", "pat-0577", "pat-0554", "pat-0536", "pat-0623" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 47, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "40d2dbc3799fc4c078b732b44566c778", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 32 }, "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "evidence": { "request_sample": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000\ufffdm\ufffd_", "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34dab1a32a10abc7514fc33505fa56e32c7a38be", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-", "attack_vector": "kafka probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "kafka probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:47 UTC	TCP	10000 · WEBMIN	webmin	Sonde RDP rdp probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Investiguer Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload � Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0348 pat-0352 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header RDP negotiation ET H.323 setup Mumble ping Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 11, "payload_entropy": 1.6729330318733675, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 50, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0348", "pat-0352" ], "kb_rule_ids": [ "pat-0348", "pat-0352" ], "matched_patterns": [ "pat-0348", "pat-0352", "pat-0868", "pat-0768", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "RDP negotiation", "ET H.323 setup", "Mumble ping", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0352", "pat-0868", "pat-0768", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6771a78868614c6768349c36da4591da", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca774efe1b2bd6f79f575fbaaafc1d2fc3745778", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd", "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0348", "pat-0352" ], "tags_summary_labels_fr": [ "pat-0348", "pat-0352" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:47 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload DmdT�� Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) DmdT�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 23, "payload_entropy": 2.6081816167087406, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "947f08e762562490af13d3254ff011a6", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "evidence": { "request_sample": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "payload_snippet": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1865e36d7460238e4069727dd705a418dbbe89a", "protocol_details": { "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "DmdT\ufffd\ufffd", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "DmdT\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0011\u0011\u0000\ufffd\u0001\ufffd\u0013", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "DmdT\ufffd\ufffd", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:46 UTC	TCP	10000 · WEBMIN	webmin	Sonde LDAP ldap probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload 0 `� Pourquoi cette classification : Type « ldap_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0859 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) ET LDAP anon bind Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) 0`� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 14, "payload_entropy": 2.9852281360342516, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0859" ], "kb_rule_ids": [ "pat-0859" ], "matched_patterns": [ "pat-0859", "pat-0554" ], "matched_pattern_names": [ "ET LDAP anon bind", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0859", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "548b3df94bdc85e8b94b0de75b5e0379", "path_pattern_hash": "79ba87c92cce1f6abf5b6560fb8afdba" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "evidence": { "request_sample": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "payload_snippet": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67f1250b10d4c45f1a503c8bc8a4c719a815ac37", "protocol_details": { "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "0`\ufffd", "attack_vector": "ldap probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab ldap_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0859" ], "tags_summary_labels_fr": [ "pat-0859" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000\ufffd\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "ldap probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "0`\ufffd", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:46 UTC	TCP	10000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:10000 · (tentative d'exploit) · → sip:nm	Élevée	Élevé · 69
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole OPTIONS sip:nm Émulateur HTTP WAF 28 Recommandation Investiguer Tags 950318:lfi-14 950326:rce-0 950382:rce-14 950470:nosqli-3 Cible HTTP OPTIONS sip:nm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode OPTIONS Port 10000 Chemin / cible sip:nm Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 69 Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL SIP protocol Ligne de requête `OPTIONS sip:nm HTTP/1.1` User-Agent — Règles WAF lfi-14 rce-0 rce-14 nosqli-3 Payload (extrait) OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 Requête brute (extrait) OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 OPTIONS Max-Forwards: 70 Content-Length: 0 Contact: <sip:nm@nm> Accept: application/sdp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "edfbcd9ebc2dbd247c08b04deff9a93e0b578f9b", "http_referer_hash": null, "http_method": "OPTIONS", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 223, "payload_entropy": 5.197167462839961, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 6, "anomaly_count": 0, "campaign_key": "d38976d688a9623249131de32a25d74d0ab33a27", "event_fingerprint": "e50b1ac1eb4c8201001fefb4b0545c2e5776d8a8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0384" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "SIP protocol" ], "pattern_ids": [ "pat-0842", "pat-0384" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 69, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0712a7f81d9d033f2caa8a8a90bbc4a8", "path_pattern_hash": "c8c6658a580b8c0b34d72503515b4d60" }, "target_context": { "dst_port": 10000, "service": "http", "service_name": "http", "risk_score": 69 }, "payload_preview": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 ", "method": "OPTIONS", "path": "sip:nm", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950382:rce-14", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-14", "rce-0", "rce-14", "nosqli-3" ], "request_line": "OPTIONS sip:nm HTTP\/1.1", "request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42", "evidence": { "method": "OPTIONS", "path": "sip:nm", "waf_tags": [ "950318:lfi-14", "950326:rce-0", "950382:rce-14", "950470:nosqli-3" ], "waf_rule_names": [ "lfi-14", "rce-0", "rce-14", "nosqli-3" ], "request_line": "OPTIONS sip:nm HTTP\/1.1", "request_sample": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nMax-Forwards: 70\r\nContent-Length: 0\r\nContact: <sip:nm@nm>\r\nAccept: application\/sdp\r\n\r\n", "payload_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6662489a93d62ab3286c716e9c4f17a0d46d777b", "protocol_details": { "http_method": "OPTIONS", "http_path": "sip:nm", "request_line": "OPTIONS sip:nm HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42", "attack_vector": "http smuggling probe \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit) \u00b7 \u2192 sip:nm", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 69, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 69, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "OPTIONS", "http_path": "sip:nm", "request_line": "OPTIONS sip:nm HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit) \u00b7 \u2192 sip:nm", "evidence_snippet": "OPTIONS sip:nm SIP\/2.0\r\nVia: SIP\/2.0\/TCP nm;branch=foo\r\nFrom: <sip:nm@nm>;tag=root\r\nTo: <sip:nm2@nm2>\r\nCall-ID: 50000\r\nCSeq: 42", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950318:lfi-14", "950326:rce-0", "950382:rce-14", "950470:nosqli-3", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
24/07/2026 16:48:46 UTC	TCP	10000 · WEBMIN	webmin	Protocole TDS MSSQL mssql tds · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload TNMPTNME Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0356 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) TNMPTNME Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 16, "payload_entropy": 2.5306390622295662, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0356" ], "kb_rule_ids": [ "pat-0356" ], "matched_patterns": [ "pat-0356", "pat-0554" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0356", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4128f0bf8d86360e67d6f2d54987a8fb", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 32 }, "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "request_sample": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "payload_snippet": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "evidence": { "request_sample": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "payload_snippet": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9bdbeb6874ba2ee9dcddb0b3a1e130fcc874791a", "protocol_details": { "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "TNMPTNME", "attack_vector": "mssql tds \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0356" ], "tags_summary_labels_fr": [ "pat-0356" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "TNMP\u0004\u0000\u0000\u0000TNME\u0000\u0000\u0004\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "mssql tds \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "TNMPTNME", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:45 UTC	TCP	10000 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:10000 · (tentative d'exploit) · → /nice%20ports%2C/Tri%6Eity.txt%2ebak	Élevée	Moyen · 55
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /nice%20ports%2C/Tri%6Eity.txt%2ebak Émulateur HTTP WAF 14 Recommandation Investiguer Tags 950468:nosqli-3 950521:leak-8 http_backup_file_scan http_backup_path Cible HTTP GET /nice%20ports%2C/Tri%6Eity.txt%2ebak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10000 Chemin / cible /nice%20ports%2C/Tri%6Eity.txt%2ebak Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 97 % — 2 tag(s) WAF Protocole émulé 1 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.1` User-Agent — Règles WAF nosqli-3 leak-8 Payload (extrait) GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "txt%2ebak", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "d066bf27e875af60909a0d3da6a23b2b7d239bc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 53, "payload_entropy": 4.704058897836964, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 64, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 55, "tag_count": 6, "anomaly_count": 0, "campaign_key": "ea619b95aa05415c8684be6fcdd64d44df8e828a", "event_fingerprint": "130d51ca9750d07a61f7e9f77c4a44d7b6876bfb", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 1, "classification_confidence": 1, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 55, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "08bd34a37b11f5c307f84418e0c2a579", "path_pattern_hash": "cfd59874d5012ef46657dbcaa1c15090" }, "target_context": { "dst_port": 10000, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "waf_tags": [ "950468:nosqli-3", "950521:leak-8" ], "waf_rule_names": [ "nosqli-3", "leak-8" ], "request_line": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.1", "request_sample": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0", "evidence": { "method": "GET", "path": "\/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "waf_tags": [ "950468:nosqli-3", "950521:leak-8" ], "waf_rule_names": [ "nosqli-3", "leak-8" ], "request_line": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.1", "request_sample": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c788ba7562368918ee6f1ba08dc77971dbe5d56", "protocol_details": { "http_method": "GET", "http_path": "\/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "request_line": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0", "attack_vector": "config file probe \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 64, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 55, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "request_line": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:10000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/nice%20ports%2C\/Tri%6Eity.txt%2ebak", "evidence_snippet": "GET \/nice%20ports%2C\/Tri%6Eity.txt%2ebak HTTP\/1.0", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950468:nosqli-3", "950521:leak-8", "http_backup_file_scan", "http_backup_path", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
24/07/2026 16:48:45 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload default Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0577 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) default Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 9, "payload_entropy": 3.169925001442312, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0577" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "39b37e76df338b7381ea8bb116701c98", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0001default\n", "request_sample": "\u0001default\n", "payload_snippet": "\u0001default", "evidence": { "request_sample": "\u0001default\n", "payload_snippet": "\u0001default", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a50246d74d7a9d23f94d3a79de352225abe67a75", "protocol_details": { "payload_preview": "\u0001default", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "default", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0577" ], "tags_summary_labels_fr": [ "pat-0577" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0001default", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "default", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:45 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload 0�-c�$ d� objectClass0� Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 0�-c�$ d�objectClass0� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 51, "payload_entropy": 3.7946877264252636, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "edc124f1d34ba290330abcac2736b204", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "request_sample": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "payload_snippet": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "payload_snippet": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "684e3c9f6d863710cc9f7f954223b2e4b1351af6", "protocol_details": { "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "0\ufffd\u0000\u0000\u0000-\u0002\u0001\u0007c\ufffd\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000\ufffd\u000bobjectClass0\ufffd\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "0\ufffd-c\ufffd$\n\nd\ufffdobjectClass0\ufffd", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:44 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload ��SMBr@@�PC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1. Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��SMBr@@�PC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1. Requête brute (extrait) ��SMBr@@�PC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1.2X002SambaNT LANMAN 1.0NT LM 0.12 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 168, "payload_entropy": 4.517824025292926, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4c8b954e7bc1bc076c8d1bd64820e67f", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.", "request_sample": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000", "payload_snippet": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.", "evidence": { "request_sample": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000", "payload_snippet": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9a86e603d8b65ed0eebe4a651d89ad65dbab323d", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd\ufffdSMBr@@\ufffdPC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1.", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\ufffd\ufffdSMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000\ufffd\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdSMBr@@\ufffdPC NETWORK PROGRAM 1.0MICROSOFT NETWORKS 1.03MICROSOFT NETWORKS 3.0LANMAN1.0LM1.", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
24/07/2026 16:48:44 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload l Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) l Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 12, "payload_entropy": 0.8166890883150209, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad33d13d6bc3bd05c9957f130811a989", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "04e0f0843cddfa0dc7f7abc5c98ae5d8697734a8", "protocol_details": { "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "l", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "l", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:43 UTC	TCP	10000 · WEBMIN	webmin	Sonde RDP rdp probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Investiguer Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload %�Cookie: mstshash=beio Pourquoi cette classification :* Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) %�Cookie: mstshash=beio Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 42, "payload_entropy": 3.9511430177077895, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 50, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "daf7ed9941f61ac36c18c46b936b1ada", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f14f6597a9f06d891aa8d07379bd6c58ba3aaed3", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "%\ufffdCookie: mstshash=beio", "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via WEBMIN \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0003\u0000\u0000%\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=beio\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "rdp probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "%\ufffdCookie: mstshash=beio", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:43 UTC	TCP	10000 · WEBMIN	webmin	Sonde port 10000/TCP port 10000 tcp · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 16ee84a07b55074c Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe tls_clienthello webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Preuve honeypot — Sonde port 10000/TCP Connexion détectée sur le port 10000 (TCP) du capteur simulé. Service WEBMIN Payload ieU��random1random2random3random4 / 9�0 ,* Pourquoi cette classification : Type « port_10000_tcp » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ieU��random1random2random3random4/ 9�0 ,* Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 110, "payload_entropy": 4.269606220838881, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 38, "tag_count": 3, "anomaly_count": 0, "campaign_key": "057b029733d5bbef26dee9cdf5812e9cf38e44c8", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 38, "correlation_boost": 8 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4ad5dce8143f2bcf1242885cff6e93f8", "path_pattern_hash": "9a8ae7dc4f9b9c9bcf8869225ee3580f", "ja3": "16ee84a07b55074cb2751329bf1c8811", "ja4": "011b865e5f91ae5e1836c88110724dcb", "tls_version": "0x0303", "tls_cipher_count": 6, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "16ee84a07b55074cb2751329bf1c8811", "tls_ja3": "771,47-10-19-57-4-255,13,,", "tls_ja4_hash": "011b865e5f91ae5e1836c88110724dcb", "tls_ja4": "t13d0106_3fdba35f04dc_d03502c43d74", "tls_version": "0x0303", "tls_cipher_count": 6, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 38 }, "payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002", "evidence": { "request_sample": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002", "payload_snippet": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002", "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07e712d95eebac39836fe953d4f50c5f409d0fab", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002", "tls_ja3": "16ee84a07b55074cb2751329bf1c8811", "tls_ja4": "011b865e5f91ae5e1836c88110724dcb", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,", "attack_vector": "port 10000 tcp \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 38, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c\ufffd\ufffdrandom1random2random3random4\u0000\u0000\f\u0000\/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000\ufffd\u0001\u0000\u00000\u0000\r\u0000,\u0000\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002", "tls_ja3": "16ee84a07b55074cb2751329bf1c8811", "tls_ja4": "011b865e5f91ae5e1836c88110724dcb", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "port 10000 tcp \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "ieU\ufffd\ufffdrandom1random2random3random4\/\n9\ufffd0\r,*", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "tls_clienthello", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:43 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload qj�n0�k�� ^0\�P��NM�0��0 krbtgtNM�19700101000000Z��٨0 Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) qj�n0�k�� ^0\�P��NM�0��0krbtgtNM�19700101000000Z��٨0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 117, "payload_entropy": 5.017384795565958, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cadb0423aaf435668f733a341f057883", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "request_sample": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "payload_snippet": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "evidence": { "request_sample": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "payload_snippet": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9db69e7022efaa6342d00c824aeb6740d03f2ad", "protocol_details": { "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "qj\ufffdn0\ufffdk\ufffd\ufffd\n\ufffd\ufffd^0\\\ufffdP\ufffd\ufffdNM\ufffd0\ufffd\ufffd0krbtgtNM\ufffd19700101000000Z\ufffd\ufffd\u06680", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u0000\u0000qj\ufffdn0\ufffdk\ufffd\u0003\u0002\u0001\u0005\ufffd\u0003\u0002\u0001\n\ufffd\ufffd^0\\\ufffd\u0007\u0003\u0005\u0000P\ufffd\u0000\u0010\ufffd\u0004\u001b\u0002NM\ufffd\u00170\u0015\ufffd\u0003\u0002\u0001\u0000\ufffd\u000e0\f\u001b\u0006krbtgt\u001b\u0002NM\ufffd\u0011\u0018\u000f19700101000000Z\ufffd\u0006\u0002\u0004\u001f\u001e\ufffd\u0668\u00170\u0015\u0002\u0001\u0012\u0002\u0001\u0011\u0002\u0001\u0010\u0002\u0001\u0017\u0002\u0001\u0001\u0002\u0001\u0003\u0002\u0001\u0002", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "qj\ufffdn0\ufffdk\ufffd\ufffd\n\ufffd\ufffd^0\\\ufffdP\ufffd\ufffdNM\ufffd0\ufffd\ufffd0krbtgtNM\ufffd19700101000000Z\ufffd\ufffd\u06680", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:42 UTC	TCP	10000 · WEBMIN	webmin	Sonde OPC-UA opcua probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload HELP Pourquoi cette classification : Type « opcua_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0626 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) OPC UA HEL User-Agent — Règles WAF — Payload (extrait) HELP Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 6, "payload_entropy": 2.584962500721156, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0626" ], "kb_rule_ids": [ "pat-0626" ], "matched_patterns": [ "pat-0626" ], "matched_pattern_names": [ "OPC UA HEL" ], "pattern_ids": [ "pat-0626" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 47, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fb323af48498fcb3974ce6b1881c8797", "path_pattern_hash": "9665a326f7d8f70f1661dab78807b951" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 35 }, "payload_preview": "HELP\r\n", "request_sample": "HELP\r\n", "payload_snippet": "HELP", "evidence": { "request_sample": "HELP\r\n", "payload_snippet": "HELP", "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87bec6a4d466dc92c9bc12a75e507835ac663553", "protocol_details": { "payload_preview": "HELP", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "HELP", "attack_vector": "opcua probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab opcua_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0626" ], "tags_summary_labels_fr": [ "pat-0626" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "HELP", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "opcua probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "HELP", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:42 UTC	TCP	10000 · WEBMIN	webmin	Sonde port 10000/TCP port 10000 tcp · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe tls_clienthello webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Preuve honeypot — Sonde port 10000/TCP Connexion détectée sur le port 10000 (TCP) du capteur simulé. Service WEBMIN Payload SO?G��,��`~��{�Ֆ�w��<=�o�n( fedcba` Pourquoi cette classification : Type « port_10000_tcp » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 38 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) SO?G��,��`~��{�Ֆ�w��<=�o�n( fedcba` Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 88, "payload_entropy": 4.71356415999113, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 38, "tag_count": 3, "anomaly_count": 0, "campaign_key": "057b029733d5bbef26dee9cdf5812e9cf38e44c8", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0348" ], "kb_rule_ids": [ "pat-0348" ], "matched_patterns": [ "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 38, "correlation_boost": 8 }, "named_classification_skipped": true, "named_candidate": "rdp_probe", "service_name": "webmin", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "80ab07029d5f302cd55bfd003a3a37f1", "path_pattern_hash": "9a8ae7dc4f9b9c9bcf8869225ee3580f" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 38 }, "payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "payload_snippet": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c44de6ccd35c7ba58f55e180370809707ee1af66", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`", "attack_vector": "port 10000 tcp \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab port_10000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 38, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 38, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0348" ], "tags_summary_labels_fr": [ "pat-0348" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\u0000\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffd\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "port 10000 tcp \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "SO?G\ufffd\ufffd\ufffd,\ufffd\ufffd`~\ufffd\ufffd\ufffd{\ufffd\u0556\ufffdw\ufffd\ufffd\ufffd\ufffd<=\ufffdo\ufffdn(\nfedcba`", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "tls_clienthello", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:41 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload versionbind Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) versionbind Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 32, "payload_entropy": 3.309196364505181, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f373b5f5cafd9af5e2c2fd8ac069ea6c", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "request_sample": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "payload_snippet": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "evidence": { "request_sample": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "payload_snippet": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10fb99572a38a561e723df90b6a09bbd63cfa111", "protocol_details": { "payload_preview": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "versionbind", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\u001e\u0000\u0006\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0007version\u0004bind\u0000\u0000\u0010\u0000\u0003", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "versionbind", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:41 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 14, "payload_entropy": 0.7345299214394703, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4e22f28763980c307f0449194c0e0a42", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "46b45c03490725947ae7c291055609d8f04580d0", "protocol_details": { "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0000\f\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:40 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 4, "payload_entropy": 1, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 34 }, "payload_preview": "\r\n\r\n", "request_sample": "\r\n\r\n", "evidence": { "request_sample": "\r\n\r\n", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "316103e9f00ede5c7fab37f0944c9f4d88215872", "protocol_details": { "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:40 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags mongodb_probe net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload �(r��\| Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0532 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �(r��\| Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "bytes_in": 44, "payload_entropy": 1.9235205817738175, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "31df6a85484a2e8c2bdf6101afeaa13cf4dfd5a2", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0532" ], "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "service_name": "webmin", "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2a177602bee0d039f41fbd6da5240e04", "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 45 }, "payload_preview": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "request_sample": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e961ea1500675bb6b6549acedc800aedfca2eb3", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "evidence_snippet": "\ufffd(r\ufffd\ufffd\ufffd\ufffd\|", "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0532" ], "tags_summary_labels_fr": [ "pat-0532" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\ufffd\u0000\u0000(r\ufffd\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001\ufffd\ufffd\u0000\u0001\ufffd\|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000", "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd(r\ufffd\ufffd\ufffd\ufffd\|", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "mongodb_probe", "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }
24/07/2026 16:48:39 UTC	TCP	10000 · HTTP	http	Sonde RTSP rtsp probe · via HTTP:10000 · (sonde / probe)	Élevée	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole OPTIONS / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_web_probe Cible HTTP OPTIONS / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode OPTIONS Port 10000 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 49 % — Motif catalogue confirmé · 1 tag(s) WAF Protocole émulé 1 Signaux pat-0382 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RTSP protocol Ligne de requête `OPTIONS / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) OPTIONS / RTSP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "OPTIONS", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 22, "payload_entropy": 3.73215889136457, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 20, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1eb25ad28a9f40973f3f317f3cf4bfe1050a0921", "event_fingerprint": "e030594e2b0061d9267cfce7635150aa48ff6569", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0382" ], "kb_rule_ids": [ "pat-0382" ], "matched_patterns": [ "pat-0382" ], "matched_pattern_names": [ "RTSP protocol" ], "pattern_ids": [ "pat-0382" ], "confidence_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b9373ea592d67ff8b93af91f8352abc2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 10000, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "OPTIONS \/ RTSP\/1.0\r\n\r\n", "method": "OPTIONS", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "OPTIONS \/ HTTP\/1.1", "request_sample": "OPTIONS \/ RTSP\/1.0\r\n\r\n", "payload_snippet": "OPTIONS \/ RTSP\/1.0", "evidence": { "method": "OPTIONS", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "OPTIONS \/ HTTP\/1.1", "request_sample": "OPTIONS \/ RTSP\/1.0\r\n\r\n", "payload_snippet": "OPTIONS \/ RTSP\/1.0", "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4d0b9552ef3ecc0dbe9ffd968bba1fcd695209e3", "protocol_details": { "http_method": "OPTIONS", "http_path": "\/", "request_line": "OPTIONS \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "OPTIONS \/ RTSP\/1.0", "attack_vector": "rtsp probe \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 49%", "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 20, "classification": 42, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10000, "protocol_emulated": true, "tags_summary": [ "pat-0382" ], "tags_summary_labels_fr": [ "pat-0382" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "OPTIONS", "http_path": "\/", "request_line": "OPTIONS \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "rtsp probe \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS \/ RTSP\/1.0", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
24/07/2026 16:48:38 UTC	TCP	10000 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:10000 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10000 Chemin / cible / Service HTTP Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 20 · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) GET / HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 18, "payload_entropy": 3.461320140211008, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1eb25ad28a9f40973f3f317f3cf4bfe1050a0921", "event_fingerprint": "e030594e2b0061d9267cfce7635150aa48ff6569", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ec63b40bcbc26b71deda762dfd844f0", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 10000, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "GET \/ HTTP\/1.0\r\n\r\n", "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "evidence": { "method": "GET", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.0", "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%" }, "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7d4e2c2472367b45ffa71e8fa6dda57240b06abc", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.0", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
24/07/2026 16:48:38 UTC	TCP	10000 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:10000 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole OPTIONS / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua net_web_probe Cible HTTP OPTIONS / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode OPTIONS Port 10000 Chemin / cible / Service HTTP Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 20 · 1 tag(s) WAF Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `OPTIONS / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) OPTIONS / HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "OPTIONS", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 22, "payload_entropy": 3.697845823084412, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 20, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "1eb25ad28a9f40973f3f317f3cf4bfe1050a0921", "event_fingerprint": "e030594e2b0061d9267cfce7635150aa48ff6569", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "76336738f875e41be8e6c44e3126e069", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "service_name": "http", "target_context": { "dst_port": 10000, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "OPTIONS \/ HTTP\/1.0\r\n\r\n", "method": "OPTIONS", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "OPTIONS \/ HTTP\/1.1", "request_sample": "OPTIONS \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "OPTIONS \/ HTTP\/1.0", "evidence": { "method": "OPTIONS", "path": "\/", "waf_tags": [ "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sap-sapcontrol-path" ], "request_line": "OPTIONS \/ HTTP\/1.1", "request_sample": "OPTIONS \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "OPTIONS \/ HTTP\/1.0", "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%" }, "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "82792ae213a88dbd82f252abaa863e3ab8d7f953", "protocol_details": { "http_method": "OPTIONS", "http_path": "\/", "request_line": "OPTIONS \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "OPTIONS \/ HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 20, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "OPTIONS", "http_path": "\/", "request_line": "OPTIONS \/ HTTP\/1.1", "port": 10000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": "OPTIONS \/ HTTP\/1.0", "target_port_label": "10000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "webmin" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950734:sap-sapcontrol-path", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
24/07/2026 16:48:36 UTC	TCP	10000 · WEBMIN	webmin	webmin probe webmin probe · via WEBMIN:10000 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_webmin_probe webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Pourquoi cette classification : Type « webmin_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 126, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "webmin", "app_proto": "webmin", "asn": 14061, "country": "US", "dst_port": 10000, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "05155c94b6ce9a7dd51d118a425ffa94685b3bda", "event_fingerprint": "83e82b58065c5570a7498a8fd14536fe84737d4f", "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "webmin", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "b46fd003e51c0a01e40c7ab5041156a5" }, "target_context": { "dst_port": 10000, "service": "webmin", "service_name": "webmin", "risk_score": 34 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a8b6d4c7124c6456d3b60dc6357e121f8780e03", "protocol_details": { "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab webmin_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "webmin", "service_label_fr": "WEBMIN", "dst_port": 10000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-webmin", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 10000, "service": "webmin", "service_label_fr": "WEBMIN" }, "attack_vector": "webmin probe \u00b7 via WEBMIN:10000 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10000 \u00b7 WEBMIN", "emulator_service": "webmin", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "webmin", "service_banner": "honeypot-webmin", "service_os": "linux", "dst_port": "10000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_webmin_probe", "webmin_emulated" ], "asn_dc_heuristic": true }

143.110.196.222

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence