|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet
telnet probe · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Service
Telnet
Payload
��� F��sk�B� ^rM�I6)>F��^�<{��Rrhl�J�K"ڻ$�{s�Z�_�f �5?�7�-��z�|���1�?t�VQuÐYf�� ��5�w�B�� ���_� �*�^�_ F�Y���_�
Pourquoi cette classification : Type « telnet_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��� F��sk�B� ^rM�I6)>F��^�<{��Rrhl�J�K"ڻ$�{s�Z�_�f �5?�7�-��z�|���1�?t�VQuÐYf�� ��5�w�B��
���_�
�*�^�_ F�Y���_�
Requête brute (extrait)
��� F��sk�B� ^rM�I6)>F��^�<{��Rrhl�J�K"ڻ$�{s�Z�_�f �5?�7�-��z�|���1�?t�VQuÐYf�� ��5�w�B�� ���_� �*�^�_ F�Y���_� e,�Wň��*��Avڣ�w�8�� 5�JEx� s5M�V6���ȴG��|
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"bytes_in": 173,
"payload_entropy": 6.691684152417185,
"port_category": "well_known",
"org": "OVH SAS",
"service": "telnet",
"app_proto": "telnet",
"asn": 16276,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"service_name": "telnet",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88eebd13f622a7f7fbb829aa4cb3465c",
"path_pattern_hash": "2c237ea9456e7ca12ad74a6740f8c26b"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 45
},
"payload_preview": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd\u001e",
"request_sample": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd\u001ee,\ufffdW\u0148\ufffd\ufffd*\ufffd\ufffdAv\u06a3\ufffdw\u000f\ufffd8\ufffd\ufffd\u00005\ufffdJEx\ufffd\ns5M\ufffdV6\ufffd\ufffd\ufffd\u0234G\ufffd\ufffd|",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd",
"evidence": {
"request_sample": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd\u001ee,\ufffdW\u0148\ufffd\ufffd*\ufffd\ufffdAv\u06a3\ufffdw\u000f\ufffd8\ufffd\ufffd\u00005\ufffdJEx\ufffd\ns5M\ufffdV6\ufffd\ufffd\ufffd\u0234G\ufffd\ufffd|",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd",
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bb8dd7e971425d75c5c00808622604c89a4376e",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd",
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"evidence_snippet": "\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd",
"attack_vector": "telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab telnet_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011\ufffd\ufffd\u0000\u0000\u0000F\ufffd\u001b\ufffdsk\ufffdB\ufffd\u000b^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\u000b\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\b\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\u001c\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd\b\u0002*\ufffd\u0007^\u0018\ufffd_\u001dF\ufffd\u0006Y\ufffd\ufffd\ufffd_\u0017\ufffd",
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "telnet probe \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdF\ufffd\ufffdsk\ufffdB\ufffd^rM\ufffdI6)>F\ufffd\ufffd^\ufffd<{\ufffd\ufffdRrhl\ufffdJ\ufffdK\"\u06bb$\ufffd{s\ufffdZ\ufffd_\ufffdf\ufffd5?\ufffd7\ufffd-\ufffd\ufffdz\ufffd|\ufffd\ufffd\ufffd1\ufffd?t\ufffdVQu\u00d0Yf\ufffd\ufffd\ufffd\ufffd5\ufffdw\ufffdB\ufffd\ufffd\n\ufffd\ufffd\ufffd_\ufffd\r\ufffd*\ufffd^\ufffd_F\ufffdY\ufffd\ufffd\ufffd_\ufffd",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
20 · FTP DATA
|
ftp-data
|
ftp-data
ftp-data · via FTP DATA:20 · (sonde / probe)
|
Faible
|
Faible · 2
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde protocole FTP
Émulateur
FTP-DATA
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20
Chemin / cible
—
Service
FTP DATA
Payload
�� ��������~�I�R}Q�:�� _�!&_EW��1�`��w6+,vi&g�o�tl����N��S�SS�w� %�&�u� ���p�P�e�P>58Iaᎏ2�`��*5,�7 }� ����-v|3.�
Pourquoi cette classification : Type « ftp-data » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 2
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�� ��������~�I�R}Q�:�� _�!&_EW��1�`��w6+,vi&g�o�tl����N��S�SS�w� %�&�u� ���p�P�e�P>58Iaᎏ2�`��*5,�7 }�
����-v|3.�
Requête brute (extrait)
�� ��������~�I�R}Q�:�� _�!&_EW��1�`��w6+,vi&g�o�tl����N��S�SS�w� %�&�u� ���p�P�e�P>58Iaᎏ2�`��*5,�7 }� ����-v|3.������v�y�֮�� ܤ+t�� ��C"J���o�0&�Na[_��H�9M:� �C懙%+�|ù�311 7��Y |���� )9�y�A�:R�v)(}���ѹ�ѣ �us`��|:�%h��b���s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a",
"emulator_response_len": 32,
"bytes_in": 279,
"payload_entropy": 7.208843847493128,
"port_category": "well_known",
"org": "OVH SAS",
"service": "ftp-data",
"app_proto": "ftp-data",
"asn": 16276,
"country": "US",
"dst_port": 20,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15
},
"risk_score": 2,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "9bb9dc42b71fa9a8b139a710889461505f4a1426",
"event_fingerprint": "c55c392bf4180d88834c6a8329c21cacd4db18d0",
"classification_reason": "Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 2
},
"named_classification_skipped": false,
"service_name": "ftp-data",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48dcb8e67f0c4b4b3b34e7949ca65346",
"path_pattern_hash": "6ca40f5c7aca6091697dee3189e5f9fd"
},
"target_context": {
"dst_port": 20,
"service": "ftp-data",
"service_name": "ftp-data",
"risk_score": 2
},
"payload_preview": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"request_sample": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0007\ufffd\ufffd\ufffd\u0006\ufffd\ufffdv\u0010\ufffdy\ufffd\u05ae\ufffd\ufffd\f\u0724+\u000ft\ufffd\ufffd\u001e\ufffd\ufffdC\"J\ufffd\ufffd\ufffdo\ufffd0&\ufffdNa\u0015[_\ufffd\ufffdH\ufffd9\u0003M:\u001b\ufffd\u0002\u001c\ufffdC\u61d9%+\ufffd|\u00f9\ufffd311\u001d7\ufffd\ufffdY\u001f|\ufffd\ufffd\ufffd\ufffd\f)9\b\ufffdy\ufffdA\ufffd:R\u0002\ufffdv)(}\ufffd\ufffd\ufffd\u0002\u0479\ufffd\u0463\u001d\ufffdus`\ufffd\ufffd|:\ufffd%\u0005h\ufffd\ufffdb\ufffd\ufffd\ufffds",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"evidence": {
"request_sample": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd\u0007\ufffd\ufffd\ufffd\u0006\ufffd\ufffdv\u0010\ufffdy\ufffd\u05ae\ufffd\ufffd\f\u0724+\u000ft\ufffd\ufffd\u001e\ufffd\ufffdC\"J\ufffd\ufffd\ufffdo\ufffd0&\ufffdNa\u0015[_\ufffd\ufffdH\ufffd9\u0003M:\u001b\ufffd\u0002\u001c\ufffdC\u61d9%+\ufffd|\u00f9\ufffd311\u001d7\ufffd\ufffdY\u001f|\ufffd\ufffd\ufffd\ufffd\f)9\b\ufffdy\ufffdA\ufffd:R\u0002\ufffdv)(}\ufffd\ufffd\ufffd\u0002\u0479\ufffd\u0463\u001d\ufffdus`\ufffd\ufffd|:\ufffd%\u0005h\ufffd\ufffdb\ufffd\ufffd\ufffds",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"classification_reason": "Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4fbc0b5f44197a9fca8a28fc596ca08b13cb96b1",
"protocol_details": {
"ftp_auth_fr": "Sonde protocole FTP",
"payload_preview": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"port": 20,
"service": "ftp-data",
"service_label_fr": "FTP DATA"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_EW\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdtl\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\ufffd%\ufffd&\ufffdu\ufffd\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"attack_vector": "ftp-data \u00b7 via FTP DATA:20 \u00b7 (sonde \/ probe)",
"target_port_label": "20 \u00b7 FTP DATA",
"emulator_service": "ftp-data",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab ftp-data \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 2
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 2,
"risk_label": "Faible",
"service_name": "ftp-data",
"service_label_fr": "FTP DATA",
"dst_port": 20,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ftp-data",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"ftp_auth_fr": "Sonde protocole FTP",
"payload_preview": "\u0010\ufffd\u0011\ufffd\u0017\u0001\u0000\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_E\u0005W\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdt\u001al\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\u000e\ufffd\u001e\u0000%\u000f\ufffd&\u0001\ufffdu\ufffd\u001d\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"port": 20,
"service": "ftp-data",
"service_label_fr": "FTP DATA"
},
"attack_vector": "ftp-data \u00b7 via FTP DATA:20 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdI\ufffdR}Q\ufffd:\ufffd\ufffd _\ufffd!&_EW\ufffd\ufffd1\ufffd`\ufffd\ufffdw6+,vi&g\ufffdo\ufffdtl\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffdS\ufffdSS\ufffdw\ufffd%\ufffd&\ufffdu\ufffd\ufffd\ufffd\ufffdp\ufffdP\ufffde\ufffdP>58Ia\u138f2\ufffd`\ufffd\ufffd*5,\ufffd7\t}\ufffd\r\ufffd\ufffd\ufffd\ufffd-v|3.\ufffd",
"target_port_label": "20 \u00b7 FTP DATA",
"emulator_service": "ftp-data",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ftp_data",
"service_banner": "honeypot-ftp-data",
"service_os": "linux",
"dst_port": "20"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
25 · SMTP
|
smtp
|
Sonde SMTP
smtp probe · via SMTP:25 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SMTP
WAF
—
Recommandation
Surveiller
Tags
net_smtp_probe
smtp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
25
Chemin / cible
—
Service
SMTP
Payload
��h ���N�� �j����Ε���}���G�zVm&a(6s�fn�#m����>� 2�,X��LEhff��/��E��X�ɠp��U"`:�}�m�
Pourquoi cette classification : Type « smtp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��h ���N��
�j����Ε���}���G�zVm&a(6s�fn�#m����>� 2�,X��LEhff��/��E��X�ɠp��U"`:�}�m�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a35303220352e352e32204572726f723a20636f6d6d616e64206e6f74207265636f676e697a65640d0a",
"emulator_response_len": 86,
"bytes_in": 104,
"payload_entropy": 6.26755942959635,
"port_category": "well_known",
"org": "OVH SAS",
"service": "smtp",
"app_proto": "smtp",
"asn": 16276,
"country": "US",
"dst_port": 25,
"risk_waf": 8,
"risk_classification": 47,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e2a87a3a55cc3ea4df3dca9c8f4ae41683ef1c36",
"event_fingerprint": "3d09fc52d69030bda96b86438d4460cfb5a981fd",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"service_name": "smtp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e989ad74b5a09f1ca270da89a5308659",
"path_pattern_hash": "0585f924ca84c34a681a0e1500b9f97a"
},
"target_context": {
"dst_port": 25,
"service": "smtp",
"service_name": "smtp",
"risk_score": 45
},
"payload_preview": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"request_sample": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"payload_snippet": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"evidence": {
"request_sample": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"payload_snippet": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50b84b0fae3c050df60bdf4918341c135b54f49c",
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"payload_preview": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"port": 25,
"service": "smtp",
"service_label_fr": "SMTP"
},
"evidence_snippet": "\ufffd\ufffdh\ufffd\ufffd\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd2\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\ufffdX\ufffd\u0260p\ufffd\ufffdU\"`:\ufffd}\ufffdm\ufffd",
"attack_vector": "smtp probe \u00b7 via SMTP:25 \u00b7 (sonde \/ probe)",
"target_port_label": "25 \u00b7 SMTP",
"emulator_service": "smtp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "smtp",
"service_label_fr": "SMTP",
"dst_port": 25,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Postfix ESMTP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"payload_preview": "\u0010\ufffd\u0011\ufffdh\u0000\u0000\u0000\ufffd\ufffd\u0002\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\u000e\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd\u001e2\u0006\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\u0012\u0016\u0001\ufffd\u0007\u0003\u0003X\ufffd\u0260p\ufffd\ufffdU\"`:\u001a\ufffd}\ufffdm\ufffd\u0016",
"port": 25,
"service": "smtp",
"service_label_fr": "SMTP"
},
"attack_vector": "smtp probe \u00b7 via SMTP:25 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdh\ufffd\ufffd\ufffdN\ufffd\ufffd\n\ufffdj\ufffd\ufffd\ufffd\ufffd\u0395\ufffd\ufffd\ufffd}\ufffd\ufffd\ufffdG\ufffdzVm&a(6s\ufffdfn\ufffd\uf301#m\ufffd\ufffd\ufffd\ufffd>\ufffd2\ufffd,X\ufffd\ufffdLEhff\ufffd\ufffd\/\ufffd\ufffdE\ufffd\ufffdX\ufffd\u0260p\ufffd\ufffdU\"`:\ufffd}\ufffdm\ufffd",
"target_port_label": "25 \u00b7 SMTP",
"emulator_service": "smtp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mail",
"service_banner": "Postfix ESMTP",
"service_os": "linux",
"dst_port": "25"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_smtp_probe",
"smtp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
445 · SMB
|
smb
|
Sonde SMB
smb probe · via SMB:445 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SMB
WAF
—
Recommandation
Surveiller
Tags
net_smb_probe
smb_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
445
Chemin / cible
—
Service
SMB
Payload
��P ��4� YDƀg;���pЧ� �ax� �-��"q/� ��>�x�Q��z�/1�1l���#���?�
Pourquoi cette classification : Type « smb_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��P ��4� YDƀg;���pЧ� �ax�
�-��"q/� ��>�x�Q��z�/1�1l���#���?�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000048",
"emulator_response_len": 4,
"bytes_in": 80,
"payload_entropy": 6.003055907333271,
"port_category": "well_known",
"org": "OVH SAS",
"service": "smb",
"app_proto": "smb",
"asn": 16276,
"country": "US",
"dst_port": 445,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "90eadff6383eb9d1d8f3257adde4c79c467b3287",
"event_fingerprint": "c2dcd725f3d49cc7233ad16d1772dcd2f3d0439d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"service_name": "smb",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9c2a65bd2f1e19714555001de3abbd2",
"path_pattern_hash": "b6c073dc229e6284b4cae7886c46d504"
},
"target_context": {
"dst_port": 445,
"service": "smb",
"service_name": "smb",
"risk_score": 32
},
"payload_preview": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"request_sample": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"payload_snippet": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"evidence": {
"request_sample": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"payload_snippet": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bcbe45eee30f45c45c391ad4836660f12ca18174",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"port": 445,
"service": "smb",
"service_label_fr": "SMB"
},
"evidence_snippet": "\ufffd\ufffdP\ufffd\ufffd4\ufffdYD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\ufffdax\ufffd\n\ufffd-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffdQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd?\ufffd",
"attack_vector": "smb probe \u00b7 via SMB:445 \u00b7 (sonde \/ probe)",
"target_port_label": "445 \u00b7 SMB",
"emulator_service": "smb",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab smb_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "smb",
"service_label_fr": "SMB",
"dst_port": 445,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-smb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011\ufffdP\u0000\u0000\u0000\ufffd\ufffd4\u0014\ufffd\u000b\u0010\u0001YD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\u001c\ufffda\u0018\u0011\u0011x\u0006\ufffd\n\ufffd\b-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffd\u000eQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\u0012\ufffd\ufffd?\ufffd",
"port": 445,
"service": "smb",
"service_label_fr": "SMB"
},
"attack_vector": "smb probe \u00b7 via SMB:445 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdP\ufffd\ufffd4\ufffdYD\u0180g;\ufffd\ufffd\ufffdp\u0427\ufffd\ufffdax\ufffd\n\ufffd-\ufffd\ufffd\"q\/\ufffd \ufffd\ufffd>\ufffdx\ufffdQ\ufffd\ufffdz\ufffd\/1\ufffd1l\ufffd\ufffd\ufffd#\ufffd\ufffd\ufffd?\ufffd",
"target_port_label": "445 \u00b7 SMB",
"emulator_service": "smb",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "smb",
"service_banner": "honeypot-smb",
"service_os": "linux",
"dst_port": "445"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_smb_probe",
"smb_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
3389 · RDP
|
rdp
|
Sonde RDP
rdp probe · via RDP:3389 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RDP
WAF
—
Recommandation
Surveiller
Tags
net_rdp_probe
rdp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3389
Chemin / cible
—
Service
RDP
Payload
�^1 @z���DE�a����@|� ���4FG�[ �=����8���r
Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�^1 @z���DE�a����@|� ���4FG�[ �=����8���r
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 49,
"payload_entropy": 5.3952223440710565,
"port_category": "registered",
"org": "OVH SAS",
"service": "rdp",
"app_proto": "rdp",
"asn": 16276,
"country": "US",
"dst_port": 3389,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "aa4bea48009056c8c3884e795b29aa79232ecca7",
"event_fingerprint": "707be242ce71f14fac23ca7fdd82d854dc2752d8",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"service_name": "rdp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bf256828f9c646fb952dcd0df3d26a0b",
"path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
},
"target_context": {
"dst_port": 3389,
"service": "rdp",
"service_name": "rdp",
"risk_score": 45
},
"payload_preview": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"request_sample": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"payload_snippet": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"evidence": {
"request_sample": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"payload_snippet": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "310940207abab5366817123618c7b9222c9439e8",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"evidence_snippet": "\ufffd^1@z\ufffd\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\ufffd\ufffd\ufffd4FG\ufffd[\ufffd=\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdr",
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "rdp",
"service_label_fr": "RDP",
"dst_port": 3389,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Windows RDP",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0011^1\u0000\u0000\u0000@\u0006z\ufffd\u0003\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\u001c\ufffd\ufffd\ufffd4FG\ufffd[\u001e\ufffd=\ufffd\ufffd\ufffd\u001b\ufffd8\ufffd\ufffd\ufffdr",
"port": 3389,
"service": "rdp",
"service_label_fr": "RDP"
},
"attack_vector": "rdp probe \u00b7 via RDP:3389 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd^1@z\ufffd\ufffd\ufffdDE\ufffda\ufffd\ufffd\ufffd\ufffd@|\ufffd\ufffd\ufffd\ufffd4FG\ufffd[\ufffd=\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdr",
"target_port_label": "3389 \u00b7 RDP",
"emulator_service": "rdp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rdp",
"service_banner": "Windows RDP",
"service_os": "windows",
"dst_port": "3389"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rdp_probe",
"rdp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
110 · POP3
|
pop3
|
Sonde port 110/TCP
port 110 tcp · via POP3:110 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
POP3
WAF
—
Recommandation
Surveiller
Tags
net_pop3_probe
pop3_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
110
Chemin / cible
—
Preuve honeypot — Sonde port 110/TCP
Connexion détectée sur le port 110 (TCP) du capteur simulé.
Service
POP3
Payload
�� K��� ,� �BLO'o�����9��N!~M��ŹS�$��a��9�.���n^��-��iw�拕l0�����Q铛M�b�:6���5ד5#+5k�є�$�U�U ���(� ��"
Pourquoi cette classification : Type « port_110_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�� K���
,� �BLO'o�����9��N!~M��ŹS�$��a��9�.���n^��-��iw�拕l0�����Q铛M�b�:6���5ד5#+5k�є�$�U�U
���(� ��"
Requête brute (extrait)
�� K��� ,� �BLO'o�����9��N!~M��ŹS�$��a��9�.���n^��-��iw�拕l0�����Q铛M�b�:6���5ד5#+5k�є�$�U�U ���(� ��"/曪t.D��J!ɷ� �6e۴��� �2�e����z����a��#K�ݭ� Tg@z*컖N<�_�B ��ԑ��1�5m(9����r�V�]�08�V��E�V���pB4��ڀ���:�e:Ш�>H�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
"emulator_response_len": 25,
"bytes_in": 401,
"payload_entropy": 7.48918095775688,
"port_category": "well_known",
"org": "OVH SAS",
"service": "pop3",
"app_proto": "pop3",
"asn": 16276,
"country": "US",
"dst_port": 110,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0bc29430209a1501e4a4048f59725d53efecdcd6",
"event_fingerprint": "8d5f083aa812a6762c3b48b8375cd32260924478",
"classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "pop3_probe",
"service_name": "pop3",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c9a361de219b688825ac29dbc23b5f1b",
"path_pattern_hash": "dc4164b66ff59a3b1d171afce3368aeb"
},
"target_context": {
"dst_port": 110,
"service": "pop3",
"service_name": "pop3",
"risk_score": 38
},
"payload_preview": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f",
"request_sample": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f\/\u66eat.D\ufffd\ufffdJ!\u000f\u0277\ufffd\n\ufffd6e\u06f4\ufffd\ufffd\ufffd\f\ufffd2\ufffde\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\u0002a\ufffd\ufffd#K\ufffd\u076d\ufffd\u001cTg@z*\uced6N<\ufffd_\u0016\ufffdB\u000b\ufffd\ufffd\u0511\ufffd\ufffd1\u000e\ufffd5m\u001a(9\u001a\ufffd\ufffd\ufffd\ufffdr\u0010\ufffdV\ufffd]\ufffd08\ufffdV\ufffd\u0017\ufffdE\ufffdV\ufffd\ufffd\ufffdpB4\ufffd\ufffd\u0680\ufffd\ufffd\ufffd:\u0001\ufffde:\u0428\ufffd\u0014>H\ufffd",
"payload_snippet": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f",
"evidence": {
"request_sample": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f\/\u66eat.D\ufffd\ufffdJ!\u000f\u0277\ufffd\n\ufffd6e\u06f4\ufffd\ufffd\ufffd\f\ufffd2\ufffde\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\u0002a\ufffd\ufffd#K\ufffd\u076d\ufffd\u001cTg@z*\uced6N<\ufffd_\u0016\ufffdB\u000b\ufffd\ufffd\u0511\ufffd\ufffd1\u000e\ufffd5m\u001a(9\u001a\ufffd\ufffd\ufffd\ufffdr\u0010\ufffdV\ufffd]\ufffd08\ufffdV\ufffd\u0017\ufffdE\ufffdV\ufffd\ufffd\ufffdpB4\ufffd\ufffd\u0680\ufffd\ufffd\ufffd:\u0001\ufffde:\u0428\ufffd\u0014>H\ufffd",
"payload_snippet": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f",
"classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "793d9d1cb77f02d5e74d60c783a18e3187f6b829",
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"payload_preview": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f",
"port": 110,
"service": "pop3",
"service_label_fr": "POP3"
},
"evidence_snippet": "\ufffd\ufffdK\ufffd\ufffd\ufffd\n\n,\ufffd\ufffdBLO'o\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffdN!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd9\ufffd.\ufffd\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5l0\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\ufffd:6\ufffd\ufffd\ufffd5\u05d35#+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\"",
"attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
"target_port_label": "110 \u00b7 POP3",
"emulator_service": "pop3",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "pop3",
"service_label_fr": "POP3",
"dst_port": 110,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pop3",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"payload_preview": "\u0010\ufffd\u0010\ufffd\u0001\u0000\u0000K\ufffd\ufffd\u001b\ufffd\n\n\b,\ufffd\u001d\ufffdBLO\b'o\ufffd\ufffd\ufffd\u0011\ufffd\ufffd9\ufffd\ufffd\u0011N!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd\u00169\ufffd.\ufffd\u0016\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5\u0014l0\b\u0004\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\u0013\ufffd:6\ufffd\ufffd\ufffd5\u05d35#\u001a+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\u001c\ufffd\ufffd\"\u0015\u000f",
"port": 110,
"service": "pop3",
"service_label_fr": "POP3"
},
"attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdK\ufffd\ufffd\ufffd\n\n,\ufffd\ufffdBLO'o\ufffd\ufffd\ufffd\ufffd\ufffd9\ufffd\ufffdN!~M\ufffd\ufffd\u0179S\ufffd$\ufffd\ufffda\ufffd\ufffd9\ufffd.\ufffd\ufffd\ufffdn^\ufffd\ufffd-\ufffd\ufffdiw\ufffd\u62d5l0\ufffd\ufffd\ufffd\ufffd\ufffdQ\u94dbM\ufffdb\ufffd:6\ufffd\ufffd\ufffd5\u05d35#+5k\ufffd\u0454\ufffd$\ufffdU\ufffdU\r\ufffd\ufffd\ufffd(\ufffd\ufffd\ufffd\"",
"target_port_label": "110 \u00b7 POP3",
"emulator_service": "pop3",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pop3",
"service_banner": "honeypot-pop3",
"service_os": "linux",
"dst_port": "110"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_pop3_probe",
"pop3_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
22 · SSH
|
ssh
|
Sonde SSH
Sonde SSH · via SSH:22 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SSH
WAF
—
Recommandation
Surveiller
Tags
net_ssh_probe
ssh_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
22
Chemin / cible
—
Service
SSH
Payload
�.� Ƴ���s�q���w5/���ѱ�m��AjO#�!��1���.������=��[ )�V��)��A\ �rՖ�Y���Ҧ�"~�z>��O���#�Eh`�0Ŋ�[P�VK�q�� to��
Pourquoi cette classification : Type « ssh_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�.� Ƴ���s�q���w5/���ѱ�m��AjO#�!��1���.������=��[
)�V��)��A\ �rՖ�Y���Ҧ�"~�z>��O���#�Eh`�0Ŋ�[P�VK�q�� to��
Requête brute (extrait)
�.� Ƴ���s�q���w5/���ѱ�m��AjO#�!��1���.������=��[ )�V��)��A\ �rՖ�Y���Ҧ�"~�z>��O���#�Eh`�0Ŋ�[P�VK�q�� to�����_�� ����a �=�8�I2f;4�̢�]��#=�ZU��-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
"emulator_response_len": 40,
"bytes_in": 171,
"payload_entropy": 6.875197617111205,
"port_category": "well_known",
"org": "OVH SAS",
"service": "ssh",
"app_proto": "ssh",
"asn": 16276,
"country": "US",
"dst_port": 22,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ec742e1f26595cf120b330e5f862965c23dfeeb2",
"event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"service_name": "ssh",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "957e75f7b76e513baa1cb75507ab1494",
"path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
},
"target_context": {
"dst_port": 22,
"service": "ssh",
"service_name": "ssh",
"risk_score": 45
},
"payload_preview": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"request_sample": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffda\u001c\ufffd=\ufffd8\ufffdI2f\u000f;4\ufffd\u0322\ufffd\u0005]\ufffd\ufffd#=\ufffdZU\u0004\ufffd\ufffd-",
"payload_snippet": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"evidence": {
"request_sample": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffda\u001c\ufffd=\ufffd8\ufffdI2f\u000f;4\ufffd\u0322\ufffd\u0005]\ufffd\ufffd#=\ufffdZU\u0004\ufffd\ufffd-",
"payload_snippet": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "add536979395171869637518a9bae56edc7e7345",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"evidence_snippet": "\ufffd.\ufffd\u01b3\ufffd\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\ufffd\ufffd\u0471\ufffdm\ufffd\ufffdAjO#\ufffd!\ufffd\ufffd1\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd[\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffdEh`\ufffd0\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "ssh",
"service_label_fr": "SSH",
"dst_port": 22,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0010\ufffd\u0010.\ufffd\u0000\u0000\u0000\u01b3\ufffd\u0004\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\u001a\u0005\ufffd\ufffd\u0471\ufffdm\ufffd\u0012\ufffdAjO#\ufffd!\ufffd\ufffd1\u0001\u0015\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffd=\ufffd\ufffd[\u001b\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\u0015\\\u001e\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\u0017\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffd\u000e\u0005Eh`\ufffd0\u000e\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"port": 22,
"service": "ssh",
"service_label_fr": "SSH"
},
"attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd.\ufffd\u01b3\ufffd\ufffd\ufffds\ufffdq\ufffd\ufffd\ufffdw5\/\ufffd\ufffd\ufffd\u0471\ufffdm\ufffd\ufffdAjO#\ufffd!\ufffd\ufffd1\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd[\r)\ufffdV\ufffd\ufffd)\ufffd\ufffdA\\\ufffdr\u0556\ufffdY\ufffd\ufffd\ufffd\u04a6\ufffd\"~\ufffdz>\ufffd\ufffdO\ufffd\ufffd\ufffd#\ufffdEh`\ufffd0\u014a\ufffd[P\ufffdVK\ufffdq\ufffd\ufffd to\ufffd\ufffd",
"target_port_label": "22 \u00b7 SSH",
"emulator_service": "ssh",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ssh",
"service_banner": "OpenSSH_8.9p1 Ubuntu",
"service_os": "linux",
"dst_port": "22"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_ssh_probe",
"ssh_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
21 · FTP
|
ftp
|
Sonde FTP
ftp probe · via FTP:21 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde protocole FTP
Émulateur
FTP
WAF
—
Recommandation
Surveiller
Tags
ftp_emulated
net_ftp_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
21
Chemin / cible
—
Pourquoi cette classification : Type « ftp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a",
"emulator_response_len": 54,
"bytes_in": 9,
"payload_entropy": 2.4193819456463714,
"port_category": "well_known",
"org": "OVH SAS",
"service": "ftp",
"app_proto": "ftp",
"asn": 16276,
"country": "US",
"dst_port": 21,
"risk_waf": 8,
"risk_classification": 46,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0e3137812f19bf14aa1acaa110935b990e3b112f",
"event_fingerprint": "07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45
},
"service_name": "ftp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 16276,
"org": "OVH SAS",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72eeae6d56e89e45fa0f2daac80ed921",
"path_pattern_hash": "927e5cb33ffc245351b0aac1c306b95c"
},
"target_context": {
"dst_port": 21,
"service": "ftp",
"service_name": "ftp",
"risk_score": 45
},
"payload_preview": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000\t",
"request_sample": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000\t",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000\t",
"payload_snippet": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000",
"classification_reason": "Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a167fd382e50d4871115a74cf973edcbdb3a3b2",
"protocol_details": {
"ftp_auth_fr": "Sonde protocole FTP",
"payload_preview": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000",
"port": 21,
"service": "ftp",
"service_label_fr": "FTP"
},
"evidence_snippet": "\ufffd\ufffd",
"attack_vector": "ftp probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)",
"target_port_label": "21 \u00b7 FTP",
"emulator_service": "ftp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "ftp",
"service_label_fr": "FTP",
"dst_port": 21,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ftp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"ftp_auth_fr": "Sonde protocole FTP",
"payload_preview": "\u0010\ufffd\u0011\ufffd\t\u0000\u0000\u0000",
"port": 21,
"service": "ftp",
"service_label_fr": "FTP"
},
"attack_vector": "ftp probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd",
"target_port_label": "21 \u00b7 FTP",
"emulator_service": "ftp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ftp",
"service_banner": "honeypot-ftp",
"service_os": "linux",
"dst_port": "21"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"ftp_emulated",
"net_ftp_probe"
],
"asn_dc_heuristic": true
}
|