|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { K0�ހ =��j �� � �� � %/bitcoinj:0.14.4/Bitcoi
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { K0�ހ =��j �� � �� � %/bitcoinj:0.14.4/Bitcoi
Requête brute (extrait)
����version { K0�ހ =��j �� � �� � %/bitcoinj:0.14.4/Bitcoin Wallet:5.30/�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 147,
"payload_entropy": 3.8606157040567446,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0991ec7307d2e10cd84f51a9e3bf9f7a",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000K0\ufffd\u0780\u0011\u0001\u0000\t\f\u0000\u0000\u0000\u0000\u0000\u0000=\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%\/bitcoinj:0.14.4\/Bitcoi",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000K0\ufffd\u0780\u0011\u0001\u0000\t\f\u0000\u0000\u0000\u0000\u0000\u0000=\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%\/bitcoinj:0.14.4\/Bitcoin Wallet:5.30\/\u0004\ufffd\u000e\u0000\u0001",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000K0\ufffd\u0780\u0011\u0001\u0000\t\f\u0000\u0000\u0000\u0000\u0000\u0000=\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%\/bitcoinj:0.14.4\/Bitcoi",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26985143c5d7e60aebc32413983843e5c36aa4af",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000K0\ufffd\u0780\u0011\u0001\u0000\t\f\u0000\u0000\u0000\u0000\u0000\u0000=\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%\/bitcoinj:0.14.4\/Bitcoi",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{K0\ufffd\u0780\t=\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd%\/bitcoinj:0.14.4\/Bitcoi",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000K0\ufffd\u0780\u0011\u0001\u0000\t\f\u0000\u0000\u0000\u0000\u0000\u0000=\ufffd\ufffdj\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000\u0001 \ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%\/bitcoinj:0.14.4\/Bitcoi",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{K0\ufffd\u0780\t=\ufffd\ufffdj\ufffd\ufffd \ufffd\ufffd\ufffd \ufffd%\/bitcoinj:0.14.4\/Bitcoi",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "192072843313e5c6a684018a049dfaa2",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6717da2ef8972b65b0c06783bdd462e8d7f4380",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g �� �
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g �� �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a3b534b5ca214b123653ac08dcdbe7c",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5cd67f4caab1008c971e54b4bfdba7e946aac69a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\ufffd\u001e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "975a16953ee72fadfc6e57ac9d2f7a50",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8018dd1cdbf1c368e5f5b72143d59967637f6e1e",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u000e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f `�k
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f `�k
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a196e2ea67aefd7bdeea4abeb0c363f9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c86b1d346c3957b6552ff07d86b2a96b94ded7b",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf`\ufffdk",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000`\ufffdk\u0010",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf`\ufffdk",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version q U*݅
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version q U*݅
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0c1ba44233a7e02bccbe672589649375",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99c7b2e4552b6d93f97d799b0e2712c40cf518ce",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionqU*\u0745",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000q\u0000\u0000\u0000U*\u0745",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionqU*\u0745",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { a VO
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { a VO
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d29c3550369917d0726d64aaa661102",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c02d42aa3d7b797843fe44010b94a2b5eb7fe85b",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{aVO",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000a\fVO",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{aVO",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i a��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i a��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3cf1e1eef96a150819ee638266039afd",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "372d99379cff15a52ea5e4886c674fe1938cff7d",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionia\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000a\ufffd\u000e\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionia\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ����
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b90c121343edd30b552e82c3576cf3e9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03985a7b9b66d1c7874425edea61063202c2a5f4",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { 4�#G
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { 4�#G
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4dc45cd6bac39addea124f7c2a3b5269",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3a037089b88c9e2d8bddbabb61415a7e03cfd860",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{4\ufffd#G",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u00004\ufffd#G",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{4\ufffd#G",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { -�3
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { -�3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "74deefbcdb314724b15d74dfe3efe573",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3\t",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3\t",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3\t",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61c93278b5aad4e988fb6ab578469ffa23ee1ed6",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{-\ufffd3",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000-\ufffd3",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{-\ufffd3",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version e �
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version e �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb750d67d8f40fe7c70c3da65c8d245e",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "088e92d12176223e3a12d8f38fbdfd1d02468a8b",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione\u03b8\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000\u03b8\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversione\u03b8\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version i ��G
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version i ��G
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ef6906b984c5196a3141af648a141bf",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9ef756f5fa38edfca16bcc4dcf99d36a5e5f7492",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffdG",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000i\u0000\u0000\u0000\ufffd\u0007\ufffdG",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffdG",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version u &��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version u &��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4fa0722b02ff2de6f2cc26b7f5e12dd9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f5c67a4eb95f872164b209bae3791fd9885a6be",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu&\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000&\ufffd\u001b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu&\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f ���=
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f ���=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1aa5bae75b2b129a86872702c0c2de9",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bb0fbc9c78bf41c14f601a0efdbecfeacebd921",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd=",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd=",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd=",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h >�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h >�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c43cbb634b0b2659719ea2f0710801d8",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ece1fa8923073e20ff0da7e90937ce80c63e5ed",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh>\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000>\u0005\u0010\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh>\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { Z��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { Z��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1fa3e671d27208e56729312bf4887f16",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14b1afb7e5e8d8cd851dcbbff791617d400b59b8",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{Z\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0011Z\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{Z\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version u ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version u ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1b8e223c5aa37891ae4a2ae0a0cef528",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8851a73eb421fdc5133a1dafc64c5adcc9566da3",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffd\u0006\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ���L
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ���L
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3aac0c670eb38f13310d9536b9e3382c",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b80866fda9b5a2c094171bcbd5b525b162ef722",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffdL",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffdL",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffdL",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { z� C
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { z� C
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fc265d15437039ac04a2692a8f00b034",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3547221e60308d31f3404a0f68403319e088b78",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{z\ufffdC",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000z\ufffd\u001dC",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{z\ufffdC",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version | ����
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version | ����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2e7aefea2d2c93e6e93f719c0038b193",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba6bf3b41999e999da9c5013b0a13157c96432c9",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion|\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000|\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion|\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { � �
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { � �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0ab83dfc54ae54e04a7f2f86dc2b6eaa",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3024e47ee3c50dd2d1b8a68324663954c2fe7876",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u000b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version z إ�N
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version z إ�N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e46bc4863b79a2d1b1b5125e6f85f25b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b1da51d7918c19ebd40832e7164508373030e04",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionz\u0625\ufffdN",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000z\u0000\u0000\u0000\u0625\ufffdN",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionz\u0625\ufffdN",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version n �>��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version n �>��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "904a6217bf38f90943466022f64e30d4",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b2695a7be6d83ed3371532aaea27607e82435cf",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionn\ufffd>\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000n\u0000\u0000\u0000\ufffd>\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionn\ufffd>\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f �[�s
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f �[�s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2be2bf8d074f02ea730b45553ff653d0",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4e8b29a8c5fba90395d6052db4085e1e6dadf78f",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd[\ufffds",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd[\ufffds",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd[\ufffds",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f ����
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f ����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1dad40acff172493e1b4e61eb5ffd11b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66b9ddda33d6e039bb9e175c271e3b5d5a13afe6",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version u �m'�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version u �m'�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2b14f4ec7f29e46bb93b24ef29d9f91d",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be917e907572d5494acab36df6a112facdcd2e2f",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffdm'\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\ufffdm'\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffdm'\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f c��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f c��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "620589780b18aa9246d0245542bd8305",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9d0d10a0f13d0021735d665b0ccc9ae774451d7",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfc\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000c\u0013\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfc\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f r��y
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f r��y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "94469706222fdaa8d4f065d3c478a6ff",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfab7a14f1e150be64d55582a5c2e10053dd8114",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfr\ufffd\ufffdy",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000r\ufffd\ufffdy",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionfr\ufffd\ufffdy",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �(�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �(�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ee4e34772a6833e8ff04241f6c987ff",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "618e832d237935dcf70c288e10330147df1e86ad",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd(\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u0002(\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd(\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h Y�5
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h Y�5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "08af4a2693f88e34939394f8e4c3b7dc",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ebcb1266dbd8727c96c6c263eb2ee14b9b857c1",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhY\ufffd5",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000Y\ufffd\u000e5",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionhY\ufffd5",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version o ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version o ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "26cd71eddf82f7fbb26df55d3cdc36e4",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89f79f8908efc37bdab6f47c3c4b7e4c603476d8",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiono\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000o\u0000\u0000\u0000\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiono\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �\"�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �\"�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81bb1c6cb50b8d243d87859b44613c35",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5cda270c8752c6bd58db042d6ca02f55977808d",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\\\"\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\\\"\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\\\"\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ����
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eec60b6a5a3130c35df9c3ee2204074f",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66308615a7432e0b3f9fa29245afc9df45fe63b3",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { � ��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { � ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c6b6202524ceaf103282ffa6d43b3401",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d60142e18a29be34f3b50de33ab5bfe0360ed8d",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\f\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ]\t�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ]\t�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "784ebee7aad614f350092a2877e5fd2b",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ba8bf59bb3281ac93b12114c8c748c7f0eb1abe",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{]\\t\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000]\\t\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{]\\t\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version h ȝ9
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version h ȝ9
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5f1ae00d2791a1a066d569f8f0a9a20a",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b70c32c3ae3d3baf1600f059c5e02f59b19c9bd",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\u021d9",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000h\u0000\u0000\u0000\u021d\u00079",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionh\u021d9",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { g��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { g��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "18bac06ec189b2ae6c647040f6876c83",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fbe4fe29ba612bcbcf45159594fa9bac6771d23",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{g\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000g\ufffd\b\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{g\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �-��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �-��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f44d2046153b416db95e6a92f8926a08",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eeef42b472794b63d7922873cf83945dfaa907ac",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd-\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd-\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd-\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version } ց�k
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version } ց�k
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "53e2de24569dd00daf5897087ddcc45e",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8a6e9c6b2abee971648e134d313a8a7524e312a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion}\u0581\ufffdk",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000}\u0000\u0000\u0000\u0581\ufffdk",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion}\u0581\ufffdk",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version f �)�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version f �)�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4312e3d6c8e0c0a2cd9749a45a83402e",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eaf4cae91962a79614346343b24538d61701feb0",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd)\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000f\u0000\u0000\u0000\ufffd)\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionf\ufffd)\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version e g+:
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version e g+:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "213dbc6e44ec4d82195af4af184465e0",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3ff6b37921d8d6fa7280a5dfddcb9e2ba7a6be7",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioneg+:",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000e\u0000\u0000\u0000g+:\u0016",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversioneg+:",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version g ���
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version g ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "22b41f7cb80fbb163c429bb05d8f3686",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d6ebe88814ceb31130064721ed23a6a9a60a3b3",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000\ufffd\u0015\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversiong\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { ��y
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { ��y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5d1a88fff1feda58f2da2dcb69d3a5e",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f566604f44aa162c683d2ad4f528ffc0072e53e2",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdy",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\ufffd\u0012y",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdy",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version j ���j
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version j ���j
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.5016291673878235,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8dddf2b31ecce4cd7767c29a9634a8d6",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af71f3c289722f24f608f2c6230ff5cce057cb1e",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffd\ufffdj",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000j\u0000\u0000\u0000\ufffd\ufffd\ufffdj",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionj\ufffd\ufffd\ufffdj",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �#gw
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �#gw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fafb9cd132ed9c1b58a14f1d280400ab",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fdc3c5d4af1613addbb093137c2fc793b141ccc8",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd#gw",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd#gw",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd#gw",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �f��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �f��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "267237feec9b3ad76529c3f39b700320",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b31b4a2638766478dd08c68893050cc740796b79",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdf\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffdf\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffdf\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version u �.�
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version u �.�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "67a20190c46db1900c35d63740646c61",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0bfe77142adff0f56930be7f196b75fb3b54bfd",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd.\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000u\u0000\u0000\u0000\u0013\ufffd.\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversionu\ufffd.\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { �ǡc
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { �ǡc
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ce5bdb39036ece257f80110458bf1617",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4c2b651f7ff2ae8581115670727540c8ddf9821",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\u01e1c",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u01e1c",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\u01e1c",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|
|
|
TCP |
8333 · BITCOIN
|
bitcoin
|
Sonde Bitcoin
bitcoin probe · via BITCOIN:8333 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
BITCOIN
WAF
—
Recommandation
Surveiller
Tags
bitcoin_emulated
bitcoin_version
net_bitcoin_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8333
Chemin / cible
—
Service
BITCOIN
Payload
����version { � ��
Pourquoi cette classification : Type « bitcoin_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
����version { � ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000",
"emulator_response_len": 130,
"bytes_in": 24,
"payload_entropy": 3.584962500721157,
"port_category": "registered",
"org": "Spruce Creek Networks LLC",
"service": "bitcoin",
"app_proto": "bitcoin",
"asn": 401476,
"country": "US",
"dst_port": 8333,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7",
"event_fingerprint": "34c7621b91cda0c6a21c6948f9570ac241d1b132",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "bitcoin",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 401476,
"org": "Spruce Creek Networks LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "52e3abf2bb4ec369a6c4844edd1cd7aa",
"path_pattern_hash": "d043bc0163534bf0040acf6d6928f6c0"
},
"target_context": {
"dst_port": 8333,
"service": "bitcoin",
"service_name": "bitcoin",
"risk_score": 45
},
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"evidence": {
"request_sample": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"payload_snippet": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cryptominer"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8299effcb513e4b393a8a301c5c518aa8e2d74a",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "bitcoin",
"service_label_fr": "BITCOIN",
"dst_port": 8333,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-bitcoin",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\ufffd\u001d\ufffd\ufffd",
"port": 8333,
"service": "bitcoin",
"service_label_fr": "BITCOIN"
},
"attack_vector": "bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd",
"target_port_label": "8333 \u00b7 BITCOIN",
"emulator_service": "bitcoin",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "bitcoin",
"service_banner": "honeypot-bitcoin",
"service_os": "linux",
"dst_port": "8333"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"bitcoin_emulated",
"bitcoin_version",
"net_bitcoin_probe"
]
}
|