|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 69a94a6078b8d089
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� �ۀ���9��u��"i �[��>R��J�H\�a�t ���������X^ ���� 4�)�'Kg@�(~ �,�+̩�0�/̨ � � + - #
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ۀ���9��u��"i �[��>R��J�H\�a�t ���������X^ ���� 4�)�'Kg@�(~ �,�+̩�0�/̨ � � + - #
Requête brute (extrait)
� �ۀ���9��u��"i �[��>R��J�H\�a�t ���������X^ ���� 4�)�'Kg@�(~ �,�+̩�0�/̨ � � + - # 3 & $ H'����U��ݼi������mЋ���|$ http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.896195577505359,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "54451be7223e8478c3e731f45f1d4e50",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "69a94a6078b8d089eff245bc7bf4fd95",
"ja4": "f9dc55879f64cb9ff562133705b5d595",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "69a94a6078b8d089eff245bc7bf4fd95",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-45-35-10-11-51-5-16-13-23,29-23-24,0",
"tls_ja4_hash": "f9dc55879f64cb9ff562133705b5d595",
"tls_ja4": "t13d0110_406043c92820_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\u001c\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\u0015\ufffdH\\\ufffda\ufffdt\u000b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\u001d\ufffd\ufffd\u001b\ufffd\ufffd\u00004\ufffd)\ufffd\u000f'\u0017Kg@\ufffd\u0013(~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\u001c\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\u0015\ufffdH\\\ufffda\ufffdt\u000b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\u001d\ufffd\ufffd\u001b\ufffd\ufffd\u00004\ufffd)\ufffd\u000f'\u0017Kg@\ufffd\u0013(~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 H\u0001'\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd\u077c\u0017i\ufffd\ufffd\u0007\ufffd\ufffd\ufffd\u058b\ufffdm\u040b\ufffd\ufffd\ufffd|$\u0004\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\u001c\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\u0015\ufffdH\\\ufffda\ufffdt\u000b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\u001d\ufffd\ufffd\u001b\ufffd\ufffd\u00004\ufffd)\ufffd\u000f'\u0017Kg@\ufffd\u0013(~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c32d5b242eb2d309b4b4b6e77a5a2d6def654c5a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\u001c\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\u0015\ufffdH\\\ufffda\ufffdt\u000b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\u001d\ufffd\ufffd\u001b\ufffd\ufffd\u00004\ufffd)\ufffd\u000f'\u0017Kg@\ufffd\u0013(~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "69a94a6078b8d089eff245bc7bf4fd95",
"tls_ja4": "f9dc55879f64cb9ff562133705b5d595",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\ufffdH\\\ufffda\ufffdt \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\ufffd\ufffd\ufffd\ufffd4\ufffd)\ufffd'Kg@\ufffd(~\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-#",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\u001c\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\u0015\ufffdH\\\ufffda\ufffdt\u000b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\u001d\ufffd\ufffd\u001b\ufffd\ufffd\u00004\ufffd)\ufffd\u000f'\u0017Kg@\ufffd\u0013(~\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u0000#\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000",
"tls_ja3": "69a94a6078b8d089eff245bc7bf4fd95",
"tls_ja4": "f9dc55879f64cb9ff562133705b5d595",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u06c0\ufffd\ufffd\ufffd9\ufffd\ufffdu\ufffd\ufffd\"i\ufffd[\ufffd\ufffd>R\ufffd\ufffdJ\ufffdH\\\ufffda\ufffdt \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdX^\ufffd\ufffd\ufffd\ufffd4\ufffd)\ufffd'Kg@\ufffd(~\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-#",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 57858ec583894ee4
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� �9mZJSI"�%|6���lt���L�����m 1� 젠����-h���u�y�����{2V �2�Rk �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9mZJSI"�%|6���lt���L�����m 1� 젠����-h���u�y�����{2V
�2�Rk �,�+̩�0�/̨ � �
Requête brute (extrait)
� �9mZJSI"�%|6���lt���L�����m 1� 젠����-h���u�y�����{2V �2�Rk �,�+̩�0�/̨ � � - 3 & $ �d��2���R��Ե0�F�M_��Ĝ �r>�{��` # + http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.916329841473275,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "72bc9e5f463bafffbbe09d606efca22d",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "57858ec583894ee40a7d96d836e72d32",
"ja4": "5f79057fa41248afbc827bd5e8417a7d",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "57858ec583894ee40a7d96d836e72d32",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-45-11-10-23-51-35-43-16,29-23-24,0",
"tls_ja4_hash": "5f79057fa41248afbc827bd5e8417a7d",
"tls_ja4": "t13d0110_d90356b5ac9b_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039mZJSI\"\ufffd%|6\ufffd\ufffd\ufffd\u0017lt\ufffd\u0012\u000e\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\u001b\u001b\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\u0012\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039mZJSI\"\ufffd%|6\ufffd\ufffd\ufffd\u0017lt\ufffd\u0012\u000e\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\u001b\u001b\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\u0012\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdd\ufffd\ufffd2\ufffd\ufffd\ufffdR\ufffd\ufffd\u05350\ufffdF\ufffdM_\ufffd\ufffd\u011c\u001c\ufffdr>\ufffd{\ufffd\ufffd`\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039mZJSI\"\ufffd%|6\ufffd\ufffd\ufffd\u0017lt\ufffd\u0012\u000e\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\u001b\u001b\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\u0012\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c70c5a9251ac9458b128bef8cb0a98084b4c5e2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039mZJSI\"\ufffd%|6\ufffd\ufffd\ufffd\u0017lt\ufffd\u0012\u000e\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\u001b\u001b\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\u0012\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "57858ec583894ee40a7d96d836e72d32",
"tls_ja4": "5f79057fa41248afbc827bd5e8417a7d",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd9mZJSI\"\ufffd%|6\ufffd\ufffd\ufffdlt\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00039mZJSI\"\ufffd%|6\ufffd\ufffd\ufffd\u0017lt\ufffd\u0012\u000e\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\u001b\u001b\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\u0012\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "57858ec583894ee40a7d96d836e72d32",
"tls_ja4": "5f79057fa41248afbc827bd5e8417a7d",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9mZJSI\"\ufffd%|6\ufffd\ufffd\ufffdlt\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdm\t1\ufffd \uc820\ufffd\ufffd\ufffd\ufffd-h\ufffd\ufffd\ufffdu\ufffdy\ufffd\ufffd\ufffd\ufffd\ufffd{2V\r\ufffd2\ufffdRk\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 73b1e2cfc78848e0
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��x�� 2R�.�"wwe��4N�V�+����ӫ ~'�-6~5W��{fA���K�l��� �ej� �,�+̩�0�/̨ � � - h
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Mumble ping
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��x�� 2R�.�"wwe��4N�V�+����ӫ ~'�-6~5W��{fA���K�l��� �ej� �,�+̩�0�/̨ � � -
h
Requête brute (extrait)
� ��x�� 2R�.�"wwe��4N�V�+����ӫ ~'�-6~5W��{fA���K�l��� �ej� �,�+̩�0�/̨ � � - http/1.1 + 3 & $ �l9�s_�Vj�h� ��.� Xc��IK�f #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.8364181005071565,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0768",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Mumble ping",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0768",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "307089c3dcc50bd835b53f75b4aff1b0",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "73b1e2cfc78848e014dbce5ae3e6f96f",
"ja4": "811eeece218713b6e78816a73d15ebe9",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "73b1e2cfc78848e014dbce5ae3e6f96f",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-10-16-43-23-51-11-35-13-5,29-23-24,0",
"tls_ja4_hash": "811eeece218713b6e78816a73d15ebe9",
"tls_ja4": "t13d0110_24b2cbbbfe69_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx\ufffd\u0010\ufffd\u0000\u00122R\ufffd.\ufffd\"w\u0016we\ufffd\ufffd4N\ufffdV\ufffd\u0011+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-\u00016~5W\ufffd\ufffd{fA\u0002\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\u000b\u001f\ufffdej\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bh",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx\ufffd\u0010\ufffd\u0000\u00122R\ufffd.\ufffd\"w\u0016we\ufffd\ufffd4N\ufffdV\ufffd\u0011+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-\u00016~5W\ufffd\ufffd{fA\u0002\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\u000b\u001f\ufffdej\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdl\u00199\u0016\ufffds_\ufffdV\u0005j\ufffd\u0012h\ufffd\u001f\ufffd\ufffd.\ufffd\u001cXc\ufffd\ufffdIK\ufffdf\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx\ufffd\u0010\ufffd\u0000\u00122R\ufffd.\ufffd\"w\u0016we\ufffd\ufffd4N\ufffdV\ufffd\u0011+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-\u00016~5W\ufffd\ufffd{fA\u0002\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\u000b\u001f\ufffdej\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bh",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd447e8969efde460d2c062d1b1b3ff12a15f9fa",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx\ufffd\u0010\ufffd\u0000\u00122R\ufffd.\ufffd\"w\u0016we\ufffd\ufffd4N\ufffdV\ufffd\u0011+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-\u00016~5W\ufffd\ufffd{fA\u0002\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\u000b\u001f\ufffdej\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bh",
"tls_ja3": "73b1e2cfc78848e014dbce5ae3e6f96f",
"tls_ja4": "811eeece218713b6e78816a73d15ebe9",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdx\ufffd\ufffd2R\ufffd.\ufffd\"wwe\ufffd\ufffd4N\ufffdV\ufffd+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-6~5W\ufffd\ufffd{fA\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\ufffdej\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\n\th",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx\ufffd\u0010\ufffd\u0000\u00122R\ufffd.\ufffd\"w\u0016we\ufffd\ufffd4N\ufffdV\ufffd\u0011+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-\u00016~5W\ufffd\ufffd{fA\u0002\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\u000b\u001f\ufffdej\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bh",
"tls_ja3": "73b1e2cfc78848e014dbce5ae3e6f96f",
"tls_ja4": "811eeece218713b6e78816a73d15ebe9",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdx\ufffd\ufffd2R\ufffd.\ufffd\"wwe\ufffd\ufffd4N\ufffdV\ufffd+\ufffd\ufffd\ufffd\ufffd\u04eb ~'\ufffd-6~5W\ufffd\ufffd{fA\ufffd\ufffd\ufffdK\ufffdl\ufffd\ufffd\ufffd\ufffdej\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\n\th",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a4a94baaa7bb911e
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��`�t�:���Xѻ�W�ڎY������c , ^�fJ�&�WT� �s��R9(o��W��� �,�+̩�0�/̨ � � 3 & $ ��Ţ����l ��e��
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��`�t�:���Xѻ�W�ڎY������c
, ^�fJ�&�WT� �s��R9(o��W��� �,�+̩�0�/̨ � � 3 & $ ��Ţ����l ��e��
Requête brute (extrait)
� ��`�t�:���Xѻ�W�ڎY������c , ^�fJ�&�WT� �s��R9(o��W��� �,�+̩�0�/̨ � � 3 & $ ��Ţ����l ��e��r�̝zo����� �Z5 + http/1.1 - #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.881055575464926,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "216beddcd453ee3b3033d96728a937ea",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "a4a94baaa7bb911eb094d07da30a20fa",
"ja4": "98fa2bec99e240a1a00d818f52b30ad7",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "a4a94baaa7bb911eb094d07da30a20fa",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-43-13-16-45-23-35-5-10-11,29-23-24,0",
"tls_ja4_hash": "98fa2bec99e240a1a00d818f52b30ad7",
"tls_ja4": "t13d0110_d69305f91c46_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd`\ufffd\u0016t\u0015\ufffd:\ufffd\ufffd\u0019\ufffdX\u047b\ufffdW\ufffd\u068eY\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,\u0000^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\u000e\ufffd\u0015R9\u0001(o\ufffd\ufffdW\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\u001c\ufffd\ufffde\ufffd\ufffd\u0011",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd`\ufffd\u0016t\u0015\ufffd:\ufffd\ufffd\u0019\ufffdX\u047b\ufffdW\ufffd\u068eY\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,\u0000^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\u000e\ufffd\u0015R9\u0001(o\ufffd\ufffdW\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\u001c\ufffd\ufffde\ufffd\ufffd\u0011r\ufffd\u031dzo\ufffd\ufffd\ufffd\ufffd\u0011\ufffd \ufffdZ5\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u0000\u0017\u0000\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd`\ufffd\u0016t\u0015\ufffd:\ufffd\ufffd\u0019\ufffdX\u047b\ufffdW\ufffd\u068eY\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,\u0000^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\u000e\ufffd\u0015R9\u0001(o\ufffd\ufffdW\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\u001c\ufffd\ufffde\ufffd\ufffd\u0011",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "433684a4b19be5ef0ca3140e34fe65ca92061d9a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd`\ufffd\u0016t\u0015\ufffd:\ufffd\ufffd\u0019\ufffdX\u047b\ufffdW\ufffd\u068eY\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,\u0000^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\u000e\ufffd\u0015R9\u0001(o\ufffd\ufffdW\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\u001c\ufffd\ufffde\ufffd\ufffd\u0011",
"tls_ja3": "a4a94baaa7bb911eb094d07da30a20fa",
"tls_ja4": "98fa2bec99e240a1a00d818f52b30ad7",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd`\ufffdt\ufffd:\ufffd\ufffd\ufffdX\u047b\ufffdW\ufffd\u068eY\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\ufffdR9(o\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffde\ufffd\ufffd",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd`\ufffd\u0016t\u0015\ufffd:\ufffd\ufffd\u0019\ufffdX\u047b\ufffdW\ufffd\u068eY\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,\u0000^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\u000e\ufffd\u0015R9\u0001(o\ufffd\ufffdW\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\u001c\ufffd\ufffde\ufffd\ufffd\u0011",
"tls_ja3": "a4a94baaa7bb911eb094d07da30a20fa",
"tls_ja4": "98fa2bec99e240a1a00d818f52b30ad7",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd`\ufffdt\ufffd:\ufffd\ufffd\ufffdX\u047b\ufffdW\ufffd\u068eY\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdc\n ,^\ufffdfJ\ufffd&\ufffdWT\ufffd\t\ufffds\ufffd\ufffdR9(o\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd\u0162\ufffd\ufffd\ufffd\ufffdl\ufffd\ufffde\ufffd\ufffd",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7dcc7e322254e8fc
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��c �̷��y^���#�<�,ې��KA��" Lޙ����@,f8_��+�pG�ܘ���7�� �,�+̩�0�/̨ � � http/1.1
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��c �̷��y^���#�<�,ې��KA��" Lޙ����@,f8_��+�pG�ܘ���7�� �,�+̩�0�/̨ � � http/1.1
Requête brute (extrait)
� ��c �̷��y^���#�<�,ې��KA��" Lޙ����@,f8_��+�pG�ܘ���7�� �,�+̩�0�/̨ � � http/1.1 - # 3 & $ ���Y����5+����l�O��c?B��;n +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.844334701084602,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2bf16c300d4d7b32a6fbdfcfba1df137",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "7dcc7e322254e8fc0e95eb8e00fdd23d",
"ja4": "d6d280dc189c3e739298dc7333cab16a",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "7dcc7e322254e8fc0e95eb8e00fdd23d",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-13-23-45-11-35-51-43-5-10,29-23-24,0",
"tls_ja4_hash": "d6d280dc189c3e739298dc7333cab16a",
"tls_ja4": "t13d0110_48c1b36e29e2_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u001d\ufffd\u001a\u0337\ufffd\ufffdy^\ufffd\ufffd\u0002\ufffd#\ufffd<\ufffd,\u06d0\u0013\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\u0019\u0006\ufffdpG\ufffd\u0718\ufffd\u0013\ufffd\ufffd7\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u001d\ufffd\u001a\u0337\ufffd\ufffdy^\ufffd\ufffd\u0002\ufffd#\ufffd<\ufffd,\u06d0\u0013\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\u0019\u0006\ufffdpG\ufffd\u0718\ufffd\u0013\ufffd\ufffd7\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd\ufffd5+\u0004\ufffd\ufffd\ufffd\u0015\ufffdl\ufffdO\u0001\ufffd\ufffdc?B\ufffd\ufffd;n\u0012\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u001d\ufffd\u001a\u0337\ufffd\ufffdy^\ufffd\ufffd\u0002\ufffd#\ufffd<\ufffd,\u06d0\u0013\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\u0019\u0006\ufffdpG\ufffd\u0718\ufffd\u0013\ufffd\ufffd7\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a0a240f45564c6a957e17190d478aeda1888f40",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u001d\ufffd\u001a\u0337\ufffd\ufffdy^\ufffd\ufffd\u0002\ufffd#\ufffd<\ufffd,\u06d0\u0013\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\u0019\u0006\ufffdpG\ufffd\u0718\ufffd\u0013\ufffd\ufffd7\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"tls_ja3": "7dcc7e322254e8fc0e95eb8e00fdd23d",
"tls_ja4": "d6d280dc189c3e739298dc7333cab16a",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\u0337\ufffd\ufffdy^\ufffd\ufffd\ufffd#\ufffd<\ufffd,\u06d0\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\ufffdpG\ufffd\u0718\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdc\u001d\ufffd\u001a\u0337\ufffd\ufffdy^\ufffd\ufffd\u0002\ufffd#\ufffd<\ufffd,\u06d0\u0013\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\u0019\u0006\ufffdpG\ufffd\u0718\ufffd\u0013\ufffd\ufffd7\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004",
"tls_ja3": "7dcc7e322254e8fc0e95eb8e00fdd23d",
"tls_ja4": "d6d280dc189c3e739298dc7333cab16a",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdc\ufffd\u0337\ufffd\ufffdy^\ufffd\ufffd\ufffd#\ufffd<\ufffd,\u06d0\ufffd\ufffd\u0380KA\ufffd\ufffd\" L\u0799\ufffd\ufffd\ufffd\ufffd@,f8_\ufffd\ufffd+\ufffdpG\ufffd\u0718\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 b00454dea35b7772
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� �� j� �9�q�s��־��-Mũ�멘cnO� �ue�>*'D ��(�'gaAY}w��˷I; �,�+̩�0�/̨ � � + #
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� j�
�9�q�s��־��-Mũ�멘cnO� �ue�>*'D ��(�'gaAY}w��˷I; �,�+̩�0�/̨ � �
+ #
Requête brute (extrait)
� �� j� �9�q�s��־��-Mũ�멘cnO� �ue�>*'D ��(�'gaAY}w��˷I; �,�+̩�0�/̨ � � + # - http/1.1 3 & $ �&�1��xd�|V�������#v�{
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.873609856817389,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0b09c904b407267e2ae674967f760be0",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "b00454dea35b77722dd55b76822cbaaf",
"ja4": "c37c8b5c736636f350acbdc32ac4de55",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "b00454dea35b77722dd55b76822cbaaf",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-43-35-11-45-16-5-51-23-13,29-23-24,0",
"tls_ja4_hash": "c37c8b5c736636f350acbdc32ac4de55",
"tls_ja4": "t13d0110_873bc1a2fb52_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\f\u001ej\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>\u0011*'D\u0015\u0000\ufffd\ufffd(\ufffd'\u001bgaAY}w\ufffd\u0010\ufffd\u02f7I;\u0015\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\f\u001ej\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>\u0011*'D\u0015\u0000\ufffd\ufffd(\ufffd'\u001bgaAY}w\ufffd\u0010\ufffd\u02f7I;\u0015\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd&\u0013\b\ufffd1\ufffd\u0017\ufffdxd\ufffd|V\ufffd\ufffd\u0002\ufffd\ufffd\u0011\u0016\ufffd\ufffd\ufffd#v\u0018\ufffd{\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\f\u001ej\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>\u0011*'D\u0015\u0000\ufffd\ufffd(\ufffd'\u001bgaAY}w\ufffd\u0010\ufffd\u02f7I;\u0015\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "348f56599c68f89c024142c096832e25bedcf5c1",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\f\u001ej\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>\u0011*'D\u0015\u0000\ufffd\ufffd(\ufffd'\u001bgaAY}w\ufffd\u0010\ufffd\u02f7I;\u0015\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000",
"tls_ja3": "b00454dea35b77722dd55b76822cbaaf",
"tls_ja4": "c37c8b5c736636f350acbdc32ac4de55",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>*'D\ufffd\ufffd(\ufffd'gaAY}w\ufffd\ufffd\u02f7I;\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+#",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\f\u001ej\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>\u0011*'D\u0015\u0000\ufffd\ufffd(\ufffd'\u001bgaAY}w\ufffd\u0010\ufffd\u02f7I;\u0015\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000",
"tls_ja3": "b00454dea35b77722dd55b76822cbaaf",
"tls_ja4": "c37c8b5c736636f350acbdc32ac4de55",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdj\ufffd\n\ufffd9\ufffdq\ufffds\ufffd\ufffd\u05be\ufffd\ufffd-M\u0169\ufffd\uba58cnO\ufffd \ufffdue\ufffd>*'D\ufffd\ufffd(\ufffd'gaAY}w\ufffd\ufffd\u02f7I;\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n+#",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 922a774aeafe5c1b
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ���IN�Ƿ���T�|��~�L=͐(�#XϏ�u/� f�<�K���K�k�����X��ND�Cͨ���V �,�+̩�0�/̨ � � + # -
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���IN�Ƿ���T�|��~�L=͐(�#XϏ�u/� f�<�K���K�k�����X��ND�Cͨ���V �,�+̩�0�/̨ � � + # -
Requête brute (extrait)
� ���IN�Ƿ���T�|��~�L=͐(�#XϏ�u/� f�<�K���K�k�����X��ND�Cͨ���V �,�+̩�0�/̨ � � + # - 3 & $ ��i�x��h<�E�a��VA��I` F��OR http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.942150665234784,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e33f5959f36a541854eb5066daa05721",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "922a774aeafe5c1b2c4e885f9436f88a",
"ja4": "ce7888705d7ba449c35e70b6fa0798d6",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "922a774aeafe5c1b2c4e885f9436f88a",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-35-5-45-51-10-11-16-23-13,29-23-24,0",
"tls_ja4_hash": "ce7888705d7ba449c35e70b6fa0798d6",
"tls_ja4": "t13d0110_e4024c0ffe69_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\u001b\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\u000f\ufffd<\ufffdK\ufffd\ufffd\ufffd\u0004K\ufffdk\ufffd\ufffd\ufffd\u0014\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\u001b\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\u000f\ufffd<\ufffdK\ufffd\ufffd\ufffd\u0004K\ufffdk\ufffd\ufffd\ufffd\u0014\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdi\ufffdx\ufffd\ufffdh\u07bf<\ufffdE\ufffda\ufffd\ufffdVA\ufffd\ufffd\u0005I` F\ufffd\ufffd\u0018OR\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\u001b\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\u000f\ufffd<\ufffdK\ufffd\ufffd\ufffd\u0004K\ufffdk\ufffd\ufffd\ufffd\u0014\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7554cc3ee91d4d0b048d65d8dae4f0afdff9a5e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\u001b\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\u000f\ufffd<\ufffdK\ufffd\ufffd\ufffd\u0004K\ufffdk\ufffd\ufffd\ufffd\u0014\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"tls_ja3": "922a774aeafe5c1b2c4e885f9436f88a",
"tls_ja4": "ce7888705d7ba449c35e70b6fa0798d6",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\ufffd<\ufffdK\ufffd\ufffd\ufffdK\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#-",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\u001b\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\u000f\ufffd<\ufffdK\ufffd\ufffd\ufffd\u0004K\ufffdk\ufffd\ufffd\ufffd\u0014\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002",
"tls_ja3": "922a774aeafe5c1b2c4e885f9436f88a",
"tls_ja4": "ce7888705d7ba449c35e70b6fa0798d6",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdIN\ufffd\u01f7\ufffd\ufffd\ufffdT\ufffd|\ufffd\ufffd~\ufffdL=\u0350(\ufffd#X\u03cf\ufffdu\/\ufffd f\ufffd<\ufffdK\ufffd\ufffd\ufffdK\ufffdk\ufffd\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffdND\ufffdC\u0368\ufffd\ufffd\ufffdV\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+#-",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 7f3a4225ac7d91d3
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��� Q���ޣ�Dy[� �,�(Q�� � ����PXl��m;�F�l �C�z�� �h[G= �,�+̩�0�/̨ � � - #
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��� Q���ޣ�Dy[� �,�(Q�� � ����PXl��m;�F�l �C�z�� �h[G= �,�+̩�0�/̨ � � - #
Requête brute (extrait)
� ��� Q���ޣ�Dy[� �,�(Q�� � ����PXl��m;�F�l �C�z�� �h[G= �,�+̩�0�/̨ � � - # http/1.1 3 & $ ؏T$�oږ��ª��㛧�\���8v���w +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.900291903222063,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2be4c5c7164ed5f2d51aab185874c435",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "7f3a4225ac7d91d355518251f9d9a02a",
"ja4": "b56d0307f03aee780b48ef1f23bbbbd5",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "7f3a4225ac7d91d355518251f9d9a02a",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-5-35-13-16-51-10-23-43,29-23-24,0",
"tls_ja4_hash": "b56d0307f03aee780b48ef1f23bbbbd5",
"tls_ja4": "t13d0110_999c1f35c551_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\u0018\ufffd\u0002\u001cQ\ufffd\ufffd\u0003\u0007\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd\u0014(Q\ufffd\u000f\u0002\ufffd\u001d\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffd\u0016m;\ufffdF\ufffdl\u001f\ufffdC\ufffdz\ufffd\u000f\ufffd\u001d\ufffdh[G=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\u0018\ufffd\u0002\u001cQ\ufffd\ufffd\u0003\u0007\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd\u0014(Q\ufffd\u000f\u0002\ufffd\u001d\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffd\u0016m;\ufffdF\ufffdl\u001f\ufffdC\ufffdz\ufffd\u000f\ufffd\u001d\ufffdh[G=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \u060fT$\ufffdo\u0696\ufffd\u0005\ufffd\u00aa\ufffd\ufffd\u36e7\ufffd\\\ufffd\ufffd\ufffd8v\ufffd\ufffd\ufffdw\u001f\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\u0018\ufffd\u0002\u001cQ\ufffd\ufffd\u0003\u0007\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd\u0014(Q\ufffd\u000f\u0002\ufffd\u001d\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffd\u0016m;\ufffdF\ufffdl\u001f\ufffdC\ufffdz\ufffd\u000f\ufffd\u001d\ufffdh[G=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fadf424afa43b3757cbd10d4b774ba6bd02da7d4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\u0018\ufffd\u0002\u001cQ\ufffd\ufffd\u0003\u0007\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd\u0014(Q\ufffd\u000f\u0002\ufffd\u001d\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffd\u0016m;\ufffdF\ufffdl\u001f\ufffdC\ufffdz\ufffd\u000f\ufffd\u001d\ufffdh[G=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000",
"tls_ja3": "7f3a4225ac7d91d355518251f9d9a02a",
"tls_ja4": "b56d0307f03aee780b48ef1f23bbbbd5",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd(Q\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffdm;\ufffdF\ufffdl\ufffdC\ufffdz\ufffd\ufffd\ufffdh[G=\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u001b\u0018\ufffd\u0002\u001cQ\ufffd\ufffd\u0003\u0007\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd\u0014(Q\ufffd\u000f\u0002\ufffd\u001d\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffd\u0016m;\ufffdF\ufffdl\u001f\ufffdC\ufffdz\ufffd\u000f\ufffd\u001d\ufffdh[G=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000",
"tls_ja3": "7f3a4225ac7d91d355518251f9d9a02a",
"tls_ja4": "b56d0307f03aee780b48ef1f23bbbbd5",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd\ufffd\u07a3\ufffdDy[\ufffd\t\ufffd,\ufffd(Q\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdPXl\ufffd\ufffdm;\ufffdF\ufffdl\ufffdC\ufffdz\ufffd\ufffd\ufffdh[G=\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-#",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 f46981d75ffc5e21
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ���a��'c VuZB~ P7�W�/I�f��hL� W��s���Ψ���]����vg�R��j}�q�j_� �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���a��'c VuZB~
P7�W�/I�f��hL� W��s���Ψ���]����vg�R��j}�q�j_� �,�+̩�0�/̨ � � #
Requête brute (extrait)
� ���a��'c VuZB~ P7�W�/I�f��hL� W��s���Ψ���]����vg�R��j}�q�j_� �,�+̩�0�/̨ � � # http/1.1 3 & $ u�=ƕ����AF1�84��0,KK7r` - +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.9134920697862485,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "184fee55883b732d9099be58dbd60cca",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "f46981d75ffc5e2170917d7ee2b556bf",
"ja4": "4f2d41b24a8f7764b4767a4f5d1b7cc1",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "f46981d75ffc5e2170917d7ee2b556bf",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-35-23-11-16-51-45-43-13-10,29-23-24,0",
"tls_ja4_hash": "4f2d41b24a8f7764b4767a4f5d1b7cc1",
"tls_ja4": "t13d0110_af99ed5385e8_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\ufffda\ufffd\ufffd'c\u000bVuZB\u0001~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\u0004\ufffd\u0003hL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\u001c\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\ufffda\ufffd\ufffd'c\u000bVuZB\u0001~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\u0004\ufffd\u0003hL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\u001c\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0004u\ufffd=\u000f\u0195\ufffd\u0006\ufffd\ufffd\ufffdAF1\ufffd84\ufffd\ufffd0,K\u001aK\u000f\u00127r`\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\ufffda\ufffd\ufffd'c\u000bVuZB\u0001~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\u0004\ufffd\u0003hL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\u001c\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52111b9179c9485504ff666e62b6a4218aea4eab",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\ufffda\ufffd\ufffd'c\u000bVuZB\u0001~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\u0004\ufffd\u0003hL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\u001c\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"tls_ja3": "f46981d75ffc5e2170917d7ee2b556bf",
"tls_ja4": "4f2d41b24a8f7764b4767a4f5d1b7cc1",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd'cVuZB~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\ufffdhL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0018\ufffd\ufffda\ufffd\ufffd'c\u000bVuZB\u0001~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\u0004\ufffd\u0003hL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\u001c\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000",
"tls_ja3": "f46981d75ffc5e2170917d7ee2b556bf",
"tls_ja4": "4f2d41b24a8f7764b4767a4f5d1b7cc1",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffda\ufffd\ufffd'cVuZB~\nP7\ufffdW\ufffd\/I\ufffdf\ufffd\ufffdhL\ufffd W\ufffd\ufffds\ufffd\ufffd\ufffd\u03a8\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdvg\ufffdR\ufffd\ufffdj}\ufffdq\ufffdj_\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 09da0a7939292d8c
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��e%0�0lJ �B�t�m��I��53+ӑ�3t ��_���B��^�,}���<�j�hW���4�8 �,�+̩�0�/̨ � � 3 & $ y��e�!fco��RL��
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��e%0�0lJ �B�t�m��I��53+ӑ�3t ��_���B��^�,}���<�j�hW���4�8 �,�+̩�0�/̨ � � 3 & $ y��e�!fco��RL��
Requête brute (extrait)
� ��e%0�0lJ �B�t�m��I��53+ӑ�3t ��_���B��^�,}���<�j�hW���4�8 �,�+̩�0�/̨ � � 3 & $ y��e�!fco��RL�ݝJF�vZvgb��V��n - + http/1.1 #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.849592547033723,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3e8206bb52f244145c5aa3cfaf5e2027",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "09da0a7939292d8c9cf372f46d8c5035",
"ja4": "b57b71abe53b645a90225e5c860970e6",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "09da0a7939292d8c9cf372f46d8c5035",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-45-43-11-5-13-16-10-35-23,29-23-24,0",
"tls_ja4_hash": "b57b71abe53b645a90225e5c860970e6",
"tls_ja4": "t13d0110_ff2366a7b908_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde%0\ufffd0\u0018lJ\u001f\ufffdB\ufffdt\u0002\ufffdm\ufffd\ufffdI\u0001\ufffd\ufffd53+\u04d1\u0004\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,\u0001}\ufffd\ufffd\ufffd<\ufffdj\b\ufffdhW\ufffd\ufffd\u0002\ufffd4\ufffd8\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde%0\ufffd0\u0018lJ\u001f\ufffdB\ufffdt\u0002\ufffdm\ufffd\ufffdI\u0001\ufffd\ufffd53+\u04d1\u0004\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,\u0001}\ufffd\ufffd\ufffd<\ufffdj\b\ufffdhW\ufffd\ufffd\u0002\ufffd4\ufffd8\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\u075dJF\ufffdvZvgb\ufffd\ufffdV\u0011\ufffd\ufffdn\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000\u0000\u0017\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde%0\ufffd0\u0018lJ\u001f\ufffdB\ufffdt\u0002\ufffdm\ufffd\ufffdI\u0001\ufffd\ufffd53+\u04d1\u0004\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,\u0001}\ufffd\ufffd\ufffd<\ufffdj\b\ufffdhW\ufffd\ufffd\u0002\ufffd4\ufffd8\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de1847a51a0103db3a2c3fd889bde9ae8e2a6135",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde%0\ufffd0\u0018lJ\u001f\ufffdB\ufffdt\u0002\ufffdm\ufffd\ufffdI\u0001\ufffd\ufffd53+\u04d1\u0004\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,\u0001}\ufffd\ufffd\ufffd<\ufffdj\b\ufffdhW\ufffd\ufffd\u0002\ufffd4\ufffd8\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"tls_ja3": "09da0a7939292d8c9cf372f46d8c5035",
"tls_ja4": "b57b71abe53b645a90225e5c860970e6",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffde%0\ufffd0lJ\ufffdB\ufffdt\ufffdm\ufffd\ufffdI\ufffd\ufffd53+\u04d1\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,}\ufffd\ufffd\ufffd<\ufffdj\ufffdhW\ufffd\ufffd\ufffd4\ufffd8\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde%0\ufffd0\u0018lJ\u001f\ufffdB\ufffdt\u0002\ufffdm\ufffd\ufffdI\u0001\ufffd\ufffd53+\u04d1\u0004\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,\u0001}\ufffd\ufffd\ufffd<\ufffdj\b\ufffdhW\ufffd\ufffd\u0002\ufffd4\ufffd8\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0002y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"tls_ja3": "09da0a7939292d8c9cf372f46d8c5035",
"tls_ja4": "b57b71abe53b645a90225e5c860970e6",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffde%0\ufffd0lJ\ufffdB\ufffdt\ufffdm\ufffd\ufffdI\ufffd\ufffd53+\u04d1\ufffd3t \ufffd\ufffd_\ufffd\ufffd\ufffdB\ufffd\ufffd^\ufffd,}\ufffd\ufffd\ufffd<\ufffdj\ufffdhW\ufffd\ufffd\ufffd4\ufffd8\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ y\ufffd\ufffde\ufffd!fco\ufffd\ufffdRL\ufffd\ufffd",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
2376 · DOCKER TLS
|
docker-tls
|
Sonde Docker TLS
docker tls probe · via DOCKER TLS:2376 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 e0cace2c970b67f4
Émulateur
DOCKER-TLS
WAF
—
Recommandation
Surveiller
Tags
docker_api_probe
docker_tls_emulated
docker_tls_payload
net_docker_tls_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2376
Chemin / cible
—
Service
DOCKER TLS
Payload
� ��ӝ3�yh�},�f]��c a<���Px���3� �����J.��-��ڐt "���3_;E�i: �,�+̩�0�/̨ � � -
Pourquoi cette classification : Type « docker_tls_probe » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Docker Tls
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ӝ3�yh�},�f]��c a<���Px���3� �����J.��-��ڐt "���3_;E�i: �,�+̩�0�/̨ � � -
Requête brute (extrait)
� ��ӝ3�yh�},�f]��c a<���Px���3� �����J.��-��ڐt "���3_;E�i: �,�+̩�0�/̨ � � - + 3 & $ U�tK9e�������f�+�ʇ71�n~��h # http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 241,
"payload_entropy": 5.817752244833288,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "docker-tls",
"app_proto": "docker-tls",
"asn": 31898,
"country": "SG",
"dst_port": 2376,
"risk_waf": 8,
"risk_classification": 44,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b17215afa683664673e4e271716fbb0ba8f91d8",
"event_fingerprint": "0e1c691ada97ecfe1cd84524e4db6b819b7ed10b",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"INT-docker-tls",
"INT-upstream"
],
"kb_rule_ids": [
"INT-docker-tls",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "docker-tls",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ac73154873c87a3a6735609752d8e01",
"path_pattern_hash": "d32a2cff6903ffd31fff36df36da58ae",
"ja3": "e0cace2c970b67f4932ab7f09460cdd5",
"ja4": "ed3333da9027900d4f7e8b5ba229cba3",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "e0cace2c970b67f4932ab7f09460cdd5",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-13-10-43-51-5-35-23-16,29-23-24,0",
"tls_ja4_hash": "ed3333da9027900d4f7e8b5ba229cba3",
"tls_ja4": "t13d0110_e3cc982a240f_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 2376,
"service": "docker-tls",
"service_name": "docker-tls",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u04dd3\u001a\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdc\fa<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\u0002\ufffd\ufffd\u0016\ufffdJ.\ufffd\ufffd\u0018-\ufffd\ufffd\u0005\u0690t\f\"\ufffd\ufffd\ufffd3_\u0006;E\ufffdi:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u04dd3\u001a\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdc\fa<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\u0002\ufffd\ufffd\u0016\ufffdJ.\ufffd\ufffd\u0018-\ufffd\ufffd\u0005\u0690t\f\"\ufffd\ufffd\ufffd3_\u0006;E\ufffdi:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 U\ufffdtK9e\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\u0014\ufffd+\ufffd\u0287\u001071\ufffd\u0001\b\u001bn~\ufffd\ufffdh\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u04dd3\u001a\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdc\fa<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\u0002\ufffd\ufffd\u0016\ufffdJ.\ufffd\ufffd\u0018-\ufffd\ufffd\u0005\u0690t\f\"\ufffd\ufffd\ufffd3_\u0006;E\ufffdi:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003",
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e41925a714d0886521833ce85a1f284ea964981",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u04dd3\u001a\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdc\fa<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\u0002\ufffd\ufffd\u0016\ufffdJ.\ufffd\ufffd\u0018-\ufffd\ufffd\u0005\u0690t\f\"\ufffd\ufffd\ufffd3_\u0006;E\ufffdi:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003",
"tls_ja3": "e0cace2c970b67f4932ab7f09460cdd5",
"tls_ja4": "ed3333da9027900d4f7e8b5ba229cba3",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u04dd3\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdca<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdJ.\ufffd\ufffd-\ufffd\ufffd\u0690t\"\ufffd\ufffd\ufffd3_;E\ufffdi:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 44,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "docker-tls",
"service_label_fr": "DOCKER TLS",
"dst_port": 2376,
"protocol_emulated": true,
"tags_summary": [
"INT-docker-tls",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Docker Tls",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-docker-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u04dd3\u001a\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdc\fa<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\u0002\ufffd\ufffd\u0016\ufffdJ.\ufffd\ufffd\u0018-\ufffd\ufffd\u0005\u0690t\f\"\ufffd\ufffd\ufffd3_\u0006;E\ufffdi:\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003",
"tls_ja3": "e0cace2c970b67f4932ab7f09460cdd5",
"tls_ja4": "ed3333da9027900d4f7e8b5ba229cba3",
"port": 2376,
"service": "docker-tls",
"service_label_fr": "DOCKER TLS"
},
"attack_vector": "docker tls probe \u00b7 via DOCKER TLS:2376 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u04dd3\ufffdyh\ufffd},\ufffdf]\ufffd\ufffdca<\ufffd\ufffd\ufffdPx\ufffd\ufffd\ufffd3\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdJ.\ufffd\ufffd-\ufffd\ufffd\u0690t\"\ufffd\ufffd\ufffd3_;E\ufffdi:\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-",
"target_port_label": "2376 \u00b7 DOCKER TLS",
"emulator_service": "docker-tls",
"confidence_reason": "Confiance 62 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "docker_tls",
"service_banner": "honeypot-docker-tls",
"service_os": "linux",
"dst_port": "2376"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"docker_api_probe",
"docker_tls_emulated",
"docker_tls_payload",
"net_docker_tls_probe",
"tls_clienthello"
]
}
|