|
|
TCP |
2053 · CLOUDFLARE TUNNEL
|
cloudflare-tunnel
|
Cross-site scripting
xss attack · via CLOUDFLARE TUNNEL:2053 · (tentative d'exploit)
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
CLOUDFLARE-TUNNEL
WAF
—
Recommandation
Surveiller
Tags
cloudflare_tunnel_emulated
cloudflare_tunnel_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2053
Chemin / cible
—
Service
CLOUDFLARE TUNNEL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2053 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 44
Confiance : Confiance 59 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0284
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2053
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2053 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Charset: GBK,utf-8;q=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 65,
"bytes_in": 323,
"payload_entropy": 5.554821728769643,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "cloudflare-tunnel",
"app_proto": "cloudflare-tunnel",
"asn": 9465,
"country": "HK",
"dst_port": 2053,
"risk_waf": 8,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5004ba207ce4d8d47204e0994c4d5fbe107e9847",
"event_fingerprint": "ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284"
],
"matched_pattern_names": [
"CRS 941130"
],
"pattern_ids": [
"pat-0284"
],
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 44
},
"named_classification_skipped": false,
"service_name": "cloudflare-tunnel",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e58ea1ee80f008dc96ff4c636f8e9c32",
"path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
},
"target_context": {
"dst_port": 2053,
"service": "cloudflare-tunnel",
"service_name": "cloudflare-tunnel",
"risk_score": 44
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q=",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q=",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ca137f94d0aaab60f973ebdf8e7afcdc3222357",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"attack_vector": "xss attack \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (tentative d'exploit)",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via CLOUDFLARE TUNNEL",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 8,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 25,
"risk_score": 44
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL",
"dst_port": 2053,
"protocol_emulated": true,
"tags_summary": [
"pat-0284"
],
"tags_summary_labels_fr": [
"pat-0284"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cloudflare-tunnel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"attack_vector": "xss attack \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cloudflare_tunnel",
"service_banner": "honeypot-cloudflare-tunnel",
"service_os": "linux",
"dst_port": "2053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"cloudflare_tunnel_emulated",
"cloudflare_tunnel_payload",
"http_get_probe",
"mozi_pattern",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
2053 · CLOUDFLARE TUNNEL
|
cloudflare-tunnel
|
Sonde PostgreSQL
postgres probe · via CLOUDFLARE TUNNEL:2053 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
CLOUDFLARE-TUNNEL
WAF
—
Recommandation
Surveiller
Tags
cloudflare_tunnel_emulated
cloudflare_tunnel_payload
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2053
Chemin / cible
—
Service
CLOUDFLARE TUNNEL
Payload
� �O䐪h�U}�͟�����h� :[�;�MA�Q @0XAl��)��1���q�E�ĉC�Jb�Gu� &�+�/�,�0̨̩� �� � � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �O䐪h�U}�͟�����h� :[�;�MA�Q @0XAl��)��1���q�E�ĉC�Jb�Gu� &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �O䐪h�U}�͟�����h� :[�;�MA�Q @0XAl��)��1���q�E�ĉC�Jb�Gu� &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ � $����7��%ՠ���[ۅ n[��ț]r��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 65,
"bytes_in": 247,
"payload_entropy": 5.830362471368617,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "cloudflare-tunnel",
"app_proto": "cloudflare-tunnel",
"asn": 9465,
"country": "HK",
"dst_port": 2053,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "dc5c4af125a614092bbf7942af913f678297e020",
"event_fingerprint": "ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cloudflare-tunnel",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8817455d0ff6dd31277c3cda5bc644c0",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2053,
"service": "cloudflare-tunnel",
"service_name": "cloudflare-tunnel",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\u442a\u000fh\ufffdU}\u0018\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u001c:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd\b)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\b\ufffdGu\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\u442a\u000fh\ufffdU}\u0018\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u001c:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd\b)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\b\ufffdGu\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t$\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd%\u0560\ufffd\ufffd\ufffd[\u06c5\u001fn[\ufffd\ufffd\u021b]r\ufffd\ufffd\u0012",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\u442a\u000fh\ufffdU}\u0018\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u001c:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd\b)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\b\ufffdGu\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f2348f94bf57f6e7c69d9893446345d142bdb1b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\u442a\u000fh\ufffdU}\u0018\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u001c:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd\b)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\b\ufffdGu\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"evidence_snippet": "\ufffd\ufffdO\u442ah\ufffdU}\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\ufffdGu\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL",
"dst_port": 2053,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cloudflare-tunnel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\u442a\u000fh\ufffdU}\u0018\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u001c:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd\b)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\b\ufffdGu\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"attack_vector": "postgres probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdO\u442ah\ufffdU}\ufffd\u035f\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd:[\ufffd;\ufffdMA\ufffdQ @0XAl\ufffd\ufffd)\ufffd\ufffd1\ufffd\u07bf\ufffd\ufffdq\ufffdE\ufffd\u0109C\ufffdJb\ufffdGu\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cloudflare_tunnel",
"service_banner": "honeypot-cloudflare-tunnel",
"service_os": "linux",
"dst_port": "2053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cloudflare_tunnel_emulated",
"cloudflare_tunnel_payload",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2053 · CLOUDFLARE TUNNEL
|
cloudflare-tunnel
|
Sonde HTTP
Sonde HTTP · via CLOUDFLARE TUNNEL:2053 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CLOUDFLARE-TUNNEL
WAF
—
Recommandation
Surveiller
Tags
cloudflare_tunnel_emulated
cloudflare_tunnel_payload
http_get_probe
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2053
Chemin / cible
—
Service
CLOUDFLARE TUNNEL
Payload
GET / HTTP/1.1 Host: 62.3.50.33:2053 Accept: */*
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2053
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 65,
"bytes_in": 54,
"payload_entropy": 4.453690048339573,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "cloudflare-tunnel",
"app_proto": "cloudflare-tunnel",
"asn": 9465,
"country": "HK",
"dst_port": 2053,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2f1b0715feb2df81fe337850d3122f86250435da",
"event_fingerprint": "ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6b8114776f2f0479661e752576334118",
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "cloudflare-tunnel",
"target_context": {
"dst_port": 2053,
"service": "cloudflare-tunnel",
"service_name": "cloudflare-tunnel",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "028abb2e6e589bc9e757623e74ee5e6b61e9e02d",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"attack_vector": "Sonde HTTP \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL",
"dst_port": 2053,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cloudflare-tunnel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"attack_vector": "Sonde HTTP \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2053\r\nAccept: *\/*",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cloudflare_tunnel",
"service_banner": "honeypot-cloudflare-tunnel",
"service_os": "linux",
"dst_port": "2053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"cloudflare_tunnel_emulated",
"cloudflare_tunnel_payload",
"http_get_probe",
"net_web_probe"
]
}
|
|
|
TCP |
2053 · CLOUDFLARE TUNNEL
|
cloudflare-tunnel
|
Sonde PostgreSQL
postgres probe · via CLOUDFLARE TUNNEL:2053 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
CLOUDFLARE-TUNNEL
WAF
—
Recommandation
Surveiller
Tags
cloudflare_tunnel_emulated
cloudflare_tunnel_payload
net_web_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2053
Chemin / cible
—
Service
CLOUDFLARE TUNNEL
Payload
� �'g�w�]o�(�����a���\��d�S��k� �f �"��R��=#/d�&�C~9| �ޟ��b &�+�/�,�0̨̩� �� � � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �'g�w�]o�(�����a���\��d�S��k� �f �"��R��=#/d�&�C~9| �ޟ��b &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �'g�w�]o�(�����a���\��d�S��k� �f �"��R��=#/d�&�C~9| �ޟ��b &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ �C��Q���LTUM�<�p �Q�JA�s:��Wj �
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a",
"emulator_response_len": 65,
"bytes_in": 247,
"payload_entropy": 5.8075412702888585,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "cloudflare-tunnel",
"app_proto": "cloudflare-tunnel",
"asn": 9465,
"country": "HK",
"dst_port": 2053,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "dc5c4af125a614092bbf7942af913f678297e020",
"event_fingerprint": "ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cloudflare-tunnel",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "19a2d84a267f818473e14fa7976b0770",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2053,
"service": "cloudflare-tunnel",
"service_name": "cloudflare-tunnel",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003'g\ufffdw\ufffd]o\u0005\u0016\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\u0016\ufffdd\ufffdS\ufffd\ufffd\u000fk\ufffd \ufffdf\u001f\ufffd\"\u0005\ufffd\ufffdR\ufffd\ufffd\u0019=#\u0013\/\u0006d\ufffd&\ufffdC~9|\u001f\ufffd\u079f\ufffd\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003'g\ufffdw\ufffd]o\u0005\u0016\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\u0016\ufffdd\ufffdS\ufffd\ufffd\u000fk\ufffd \ufffdf\u001f\ufffd\"\u0005\ufffd\ufffdR\ufffd\ufffd\u0019=#\u0013\/\u0006d\ufffd&\ufffdC~9|\u001f\ufffd\u079f\ufffd\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdC\ufffd\ufffdQ\ufffd\ufffd\ufffdLTUM\ufffd<\ufffdp \ufffdQ\ufffdJA\ufffds:\ufffd\ufffdWj\u001d\ufffd\u001d",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003'g\ufffdw\ufffd]o\u0005\u0016\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\u0016\ufffdd\ufffdS\ufffd\ufffd\u000fk\ufffd \ufffdf\u001f\ufffd\"\u0005\ufffd\ufffdR\ufffd\ufffd\u0019=#\u0013\/\u0006d\ufffd&\ufffdC~9|\u001f\ufffd\u079f\ufffd\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d64db2bb7887d68a2c0ea129d07f5e8b10281aac",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003'g\ufffdw\ufffd]o\u0005\u0016\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\u0016\ufffdd\ufffdS\ufffd\ufffd\u000fk\ufffd \ufffdf\u001f\ufffd\"\u0005\ufffd\ufffdR\ufffd\ufffd\u0019=#\u0013\/\u0006d\ufffd&\ufffdC~9|\u001f\ufffd\u079f\ufffd\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"evidence_snippet": "\ufffd\ufffd'g\ufffdw\ufffd]o\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\ufffdd\ufffdS\ufffd\ufffdk\ufffd \ufffdf\ufffd\"\ufffd\ufffdR\ufffd\ufffd=#\/d\ufffd&\ufffdC~9|\ufffd\u079f\ufffd\ufffdb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL",
"dst_port": 2053,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cloudflare-tunnel",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003'g\ufffdw\ufffd]o\u0005\u0016\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\u0016\ufffdd\ufffdS\ufffd\ufffd\u000fk\ufffd \ufffdf\u001f\ufffd\"\u0005\ufffd\ufffdR\ufffd\ufffd\u0019=#\u0013\/\u0006d\ufffd&\ufffdC~9|\u001f\ufffd\u079f\ufffd\ufffdb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 2053,
"service": "cloudflare-tunnel",
"service_label_fr": "CLOUDFLARE TUNNEL"
},
"attack_vector": "postgres probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd'g\ufffdw\ufffd]o\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\\\ufffd\ufffdd\ufffdS\ufffd\ufffdk\ufffd \ufffdf\ufffd\"\ufffd\ufffdR\ufffd\ufffd=#\/d\ufffd&\ufffdC~9|\ufffd\u079f\ufffd\ufffdb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "2053 \u00b7 CLOUDFLARE TUNNEL",
"emulator_service": "cloudflare-tunnel",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cloudflare_tunnel",
"service_banner": "honeypot-cloudflare-tunnel",
"service_os": "linux",
"dst_port": "2053"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cloudflare_tunnel_emulated",
"cloudflare_tunnel_payload",
"net_web_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9024 · Sonde IoT (Home Assistant/TR-069/Tuya)
|
iot-probe
|
pop3 bruteforce
pop3 bruteforce · via Sonde IoT (Home Assistant/TR-069/Tuya):9024 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
IOT-PROBE
WAF
—
Recommandation
Surveiller
Tags
iot_probe_emulated
net_homeassistant_probe
pop3_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9024
Chemin / cible
—
Service
Sonde IoT (Home Assistant/TR-069/Tuya)
Payload
USER anonymous
Pourquoi cette classification : Type « pop3_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Pop3 User
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
USER anonymous
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420696f745f70726f626520726561647920706f72743d393032340d0a",
"emulator_response_len": 40,
"bytes_in": 16,
"payload_entropy": 3.75,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "iot-probe",
"app_proto": "iot-probe",
"asn": 9465,
"country": "HK",
"dst_port": 9024,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 41,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "34eb739d3765034ebd1a3f9ae938d48106e4f4b1",
"event_fingerprint": "008ac45f58e6eae0adca8fe98c223a325b02770c",
"classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 74,
"precision_signals": [
"INT-EMAIL-pop3-user"
],
"kb_rule_ids": [
"INT-EMAIL-pop3-user"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "iot-probe",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0d14e8dd95e3e871a180c82e1bc78157",
"path_pattern_hash": "3f394465ae666f782f2351014fe4e7c6"
},
"target_context": {
"dst_port": 9024,
"service": "iot-probe",
"service_name": "iot-probe",
"risk_score": 41
},
"payload_preview": "USER anonymous\r\n",
"request_sample": "USER anonymous\r\n",
"payload_snippet": "USER anonymous",
"evidence": {
"request_sample": "USER anonymous\r\n",
"payload_snippet": "USER anonymous",
"classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "108c547e7f010f8cabc2620a37bcf7102e641295",
"protocol_details": {
"payload_preview": "USER anonymous",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"evidence_snippet": "USER anonymous",
"attack_vector": "pop3 bruteforce \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"dst_port": 9024,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-pop3-user"
],
"tags_summary_labels_fr": [
"Email Pop3 User"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iot-probe",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "USER anonymous",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "pop3 bruteforce \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"evidence_snippet": "USER anonymous",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iot_probe",
"service_banner": "honeypot-iot-probe",
"service_os": "linux",
"dst_port": "9024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"iot_probe_emulated",
"net_homeassistant_probe",
"pop3_probe"
]
}
|
|
|
TCP |
9024 · Sonde IoT (Home Assistant/TR-069/Tuya)
|
iot-probe
|
homeassistant probe
homeassistant probe · via Sonde IoT (Home Assistant/TR-069/Tuya):9024 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IOT-PROBE
WAF
—
Recommandation
Surveiller
Tags
iot_probe_emulated
net_homeassistant_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9024
Chemin / cible
—
Service
Sonde IoT (Home Assistant/TR-069/Tuya)
Pourquoi cette classification : Type « homeassistant_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420696f745f70726f626520726561647920706f72743d393032340d0a",
"emulator_response_len": 40,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "iot-probe",
"app_proto": "iot-probe",
"asn": 9465,
"country": "HK",
"dst_port": 9024,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.2,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 21,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c593aa42750262c5e7f59482792fd7c57f33de24",
"event_fingerprint": "008ac45f58e6eae0adca8fe98c223a325b02770c",
"classification_reason": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "iot-probe",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "db74072c13de6f88be8c15a829fdbd32"
},
"target_context": {
"dst_port": 9024,
"service": "iot-probe",
"service_name": "iot-probe",
"risk_score": 21
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88179b8a613661321a094a990de12f0e8a94d61b",
"protocol_details": {
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "homeassistant probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"dst_port": 9024,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iot-probe",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "homeassistant probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iot_probe",
"service_banner": "honeypot-iot-probe",
"service_os": "linux",
"dst_port": "9024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"iot_probe_emulated",
"net_homeassistant_probe"
]
}
|
|
|
TCP |
9024 · Sonde IoT (Home Assistant/TR-069/Tuya)
|
iot-probe
|
Sonde PostgreSQL
postgres probe · via Sonde IoT (Home Assistant/TR-069/Tuya):9024 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
IOT-PROBE
WAF
—
Recommandation
Surveiller
Tags
iot_probe_emulated
net_homeassistant_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9024
Chemin / cible
—
Service
Sonde IoT (Home Assistant/TR-069/Tuya)
Payload
� �S2Kj�w����DC��cښ���o{*��(�|��; ,L� ��^� Sa�X�� }S�z��T�_KR &�+�/�,�0̨̩� �� � � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �S2Kj�w����DC��cښ���o{*��(�|��; ,L� ��^�
Sa�X�� }S�z��T�_KR &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �S2Kj�w����DC��cښ���o{*��(�|��; ,L� ��^� Sa�X�� }S�z��T�_KR &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ ��bӵ�� ��̭Y9��ʆ�@`�u /v��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420696f745f70726f626520726561647920706f72743d393032340d0a",
"emulator_response_len": 40,
"bytes_in": 247,
"payload_entropy": 5.787457779563893,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "iot-probe",
"app_proto": "iot-probe",
"asn": 9465,
"country": "HK",
"dst_port": 9024,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71a8d239fbe213b6cb125734f9da985952217057",
"event_fingerprint": "008ac45f58e6eae0adca8fe98c223a325b02770c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "iot-probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3c573d0b4e41438cbc60f35cd7bfe292",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9024,
"service": "iot-probe",
"service_name": "iot-probe",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S2Kj\ufffdw\ufffd\ufffd\ufffd\ufffd\bDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\u0017\ufffd\rSa\ufffdX\u0003\ufffd\ufffd\u0000}S\b\ufffdz\ufffd\ufffdT\ufffd_\u0013KR\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S2Kj\ufffdw\ufffd\ufffd\ufffd\ufffd\bDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\u0017\ufffd\rSa\ufffdX\u0003\ufffd\ufffd\u0000}S\b\ufffdz\ufffd\ufffdT\ufffd_\u0013KR\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdb\u04f5\ufffd\ue0ae\ufffd\n\ufffd\ufffd\u032dY9\ufffd\ufffd\u0286\ufffd@`\ufffdu\u001e\/v\ufffd\ufffd\t",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S2Kj\ufffdw\ufffd\ufffd\ufffd\ufffd\bDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\u0017\ufffd\rSa\ufffdX\u0003\ufffd\ufffd\u0000}S\b\ufffdz\ufffd\ufffdT\ufffd_\u0013KR\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9068f79c1c3e5e05b5f22c5bed3c562dd2f4f1d5",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S2Kj\ufffdw\ufffd\ufffd\ufffd\ufffd\bDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\u0017\ufffd\rSa\ufffdX\u0003\ufffd\ufffd\u0000}S\b\ufffdz\ufffd\ufffdT\ufffd_\u0013KR\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"evidence_snippet": "\ufffd\ufffdS2Kj\ufffdw\ufffd\ufffd\ufffd\ufffdDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\ufffd\rSa\ufffdX\ufffd\ufffd}S\ufffdz\ufffd\ufffdT\ufffd_KR&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"dst_port": 9024,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iot-probe",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003S2Kj\ufffdw\ufffd\ufffd\ufffd\ufffd\bDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\u0017\ufffd\rSa\ufffdX\u0003\ufffd\ufffd\u0000}S\b\ufffdz\ufffd\ufffdT\ufffd_\u0013KR\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "postgres probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdS2Kj\ufffdw\ufffd\ufffd\ufffd\ufffdDC\ufffd\ufffdc\u069a\ufffd\ufffd\ufffdo{*\ufffd\ufffd(\ufffd|\ufffd\ufffd; ,L\ufffd\t\ufffd\ufffd^\ufffd\rSa\ufffdX\ufffd\ufffd}S\ufffdz\ufffd\ufffdT\ufffd_KR&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iot_probe",
"service_banner": "honeypot-iot-probe",
"service_os": "linux",
"dst_port": "9024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"iot_probe_emulated",
"net_homeassistant_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9024 · Sonde IoT (Home Assistant/TR-069/Tuya)
|
iot-probe
|
homeassistant probe
homeassistant probe · via Sonde IoT (Home Assistant/TR-069/Tuya):9024 · (sonde / probe)
|
Élevée
|
Faible · 21
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
IOT-PROBE
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
iot_probe_emulated
net_homeassistant_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9024
Chemin / cible
—
Service
Sonde IoT (Home Assistant/TR-069/Tuya)
Payload
GET / HTTP/1.1 Host: 62.3.50.33:9024 Accept: */*
Pourquoi cette classification : Type « homeassistant_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 21
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:9024
Accept: */*
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420696f745f70726f626520726561647920706f72743d393032340d0a",
"emulator_response_len": 40,
"bytes_in": 54,
"payload_entropy": 4.550821761262472,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "iot-probe",
"app_proto": "iot-probe",
"asn": 9465,
"country": "HK",
"dst_port": 9024,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 21,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b0c3cc3d50fa30e0d72761b7052807b1e03656b7",
"event_fingerprint": "008ac45f58e6eae0adca8fe98c223a325b02770c",
"classification_reason": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 21
},
"named_classification_skipped": false,
"service_name": "iot-probe",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e72ac7970ced63feee695010220b3255",
"path_pattern_hash": "db74072c13de6f88be8c15a829fdbd32"
},
"target_context": {
"dst_port": 9024,
"service": "iot-probe",
"service_name": "iot-probe",
"risk_score": 21
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"classification_reason": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3eb0f38e4152a14bb8ac1069188407aa19b2ecab",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"attack_vector": "homeassistant probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab homeassistant_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 21
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 21,
"risk_label": "Faible",
"service_name": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"dst_port": 9024,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iot-probe",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "homeassistant probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:9024\r\nAccept: *\/*",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iot_probe",
"service_banner": "honeypot-iot-probe",
"service_os": "linux",
"dst_port": "9024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"iot_probe_emulated",
"net_homeassistant_probe"
]
}
|
|
|
TCP |
9024 · Sonde IoT (Home Assistant/TR-069/Tuya)
|
iot-probe
|
Sonde PostgreSQL
postgres probe · via Sonde IoT (Home Assistant/TR-069/Tuya):9024 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
IOT-PROBE
WAF
—
Recommandation
Surveiller
Tags
iot_probe_emulated
net_homeassistant_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9024
Chemin / cible
—
Service
Sonde IoT (Home Assistant/TR-069/Tuya)
Payload
� �dձ ���qW��"��{=�)4} F���Y �#���y� ���x3g+�l@D�ZBB�z����� &�+�/�,�0̨̩� �� � � � / 5� �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �dձ ���qW��"��{=�)4} F���Y �#���y� ���x3g+�l@D�ZBB�z����� &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �dձ ���qW��"��{=�)4} F���Y �#���y� ���x3g+�l@D�ZBB�z����� &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ ��9\���>��Q�V��5(.�<�&>�l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420696f745f70726f626520726561647920706f72743d393032340d0a",
"emulator_response_len": 40,
"bytes_in": 247,
"payload_entropy": 5.773782133117695,
"port_category": "registered",
"org": "AGOTOZ PTE. LTD.",
"service": "iot-probe",
"app_proto": "iot-probe",
"asn": 9465,
"country": "HK",
"dst_port": 9024,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "71a8d239fbe213b6cb125734f9da985952217057",
"event_fingerprint": "008ac45f58e6eae0adca8fe98c223a325b02770c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "iot-probe",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "HK",
"asn": 9465,
"org": "AGOTOZ PTE. LTD.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "98e6a2d57958cd2b2de8c10a39f84004",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9024,
"service": "iot-probe",
"service_name": "iot-probe",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\u0571\u0000\u000b\u001b\u0001\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}\u0017\u001dF\ufffd\u0001\ufffd\u0001\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\u0571\u0000\u000b\u001b\u0001\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}\u0017\u001dF\ufffd\u0001\ufffd\u0001\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0014\ufffd9\\\ufffd\ufffd\ufffd>\u0015\ufffd\ufffdQ\ufffdV\ufffd\u0011\u0017\ufffd\u00195(.\u0005\ufffd<\ufffd&>\ufffdl\u001f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\u0571\u0000\u000b\u001b\u0001\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}\u0017\u001dF\ufffd\u0001\ufffd\u0001\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a5bb05b36047766ac58ef024224ba777545c1a52",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\u0571\u0000\u000b\u001b\u0001\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}\u0017\u001dF\ufffd\u0001\ufffd\u0001\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"evidence_snippet": "\ufffd\ufffdd\u0571\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}F\ufffd\ufffd\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"attack_vector": "postgres probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"dst_port": 9024,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-iot-probe",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003d\u0571\u0000\u000b\u001b\u0001\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}\u0017\u001dF\ufffd\u0001\ufffd\u0001\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9024,
"service": "iot-probe",
"service_label_fr": "Sonde IoT (Home Assistant\/TR-069\/Tuya)"
},
"attack_vector": "postgres probe \u00b7 via Sonde IoT (Home Assistant\/TR-069\/Tuya):9024 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdd\u0571\ufffd\ufffd\ufffdqW\ufffd\ufffd\"\ufffd\ufffd{=\ufffd)4}F\ufffd\ufffd\ufffdY \ufffd#\ufffd\ufffd\ufffdy\ufffd\t\ufffd\ufffd\ufffdx3g+\ufffdl@D\ufffdZBB\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
"target_port_label": "9024 \u00b7 Sonde IoT (Home Assistant\/TR-069\/Tuya)",
"emulator_service": "iot-probe",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "iot_probe",
"service_banner": "honeypot-iot-probe",
"service_os": "linux",
"dst_port": "9024"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"iot_probe_emulated",
"net_homeassistant_probe",
"tls_clienthello"
]
}
|