|
|
TCP |
8500 · CONSUL
|
consul
|
Sonde Elasticsearch
elasticsearch probe · via CONSUL:8500 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CONSUL
WAF
—
Recommandation
Surveiller
Tags
consul_emulated
consul_payload
consul_probe
elastic_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8500
Chemin / cible
—
Service
CONSUL
Payload
GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 56%
Confiance classification
56%
Risque capteur
Faible
· 33
Confiance : Confiance 56 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Infra Elastic Cat
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:8500
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74",
"emulator_response_len": 138,
"bytes_in": 103,
"payload_entropy": 4.94525366001495,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "consul",
"app_proto": "consul",
"asn": 14061,
"country": "DE",
"dst_port": 8500,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 33,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7963c7fd6f458e0d60ab88fda8edc7ec63424b7b",
"event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 66,
"precision_signals": [
"INT-INFRA-elastic-cat"
],
"kb_rule_ids": [
"INT-INFRA-elastic-cat"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "consul",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0b2e85cfc41c7c5f9b62b25d8066cced",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 8500,
"service": "consul",
"service_name": "consul",
"risk_score": 33
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0754669ddeab8a2a93b3f9b5ec5fe84b83fd9f2",
"protocol_details": {
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8500,
"service": "consul",
"service_label_fr": "CONSUL"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "elasticsearch probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)",
"target_port_label": "8500 \u00b7 CONSUL",
"emulator_service": "consul",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "consul",
"service_label_fr": "CONSUL",
"dst_port": 8500,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-elastic-cat"
],
"tags_summary_labels_fr": [
"Infra Elastic Cat"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-consul",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8500,
"service": "consul",
"service_label_fr": "CONSUL"
},
"attack_vector": "elasticsearch probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8500 \u00b7 CONSUL",
"emulator_service": "consul",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "consul",
"service_banner": "honeypot-consul",
"service_os": "linux",
"dst_port": "8500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"consul_emulated",
"consul_payload",
"consul_probe",
"elastic_probe",
"http_get_probe",
"net_consul_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
587 · SMTP SUBMISSION
|
smtp-submission
|
Sonde SMTP
smtp probe · via SMTP SUBMISSION:587 · (sonde / probe)
|
Élevée
|
Moyen · 50
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SMTP-SUBMISSION
WAF
—
Recommandation
Investiguer
Tags
net_smtp_probe
smtp_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
587
Chemin / cible
—
Service
SMTP SUBMISSION
Payload
EHLO mail.example.com
Pourquoi cette classification : Type « smtp_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 50
Confiance : Confiance 100 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0401
pat-0629
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SMTP EHLO
SMTPS EHLO
User-Agent
—
Règles WAF
—
Payload (extrait)
EHLO mail.example.com
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a3235302d6d61696c2e6578616d706c652e636f6d0d0a3235302d53495a452035323432383830300d0a3235302048454c500d0a",
"emulator_response_len": 96,
"bytes_in": 23,
"payload_entropy": 3.9690016298759936,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "smtp-submission",
"app_proto": "smtp-submission",
"asn": 14061,
"country": "DE",
"dst_port": 587,
"risk_waf": 8,
"risk_classification": 47,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 50,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "d1de7b843f95d34fe925c9d406cfb487fb4114a5",
"event_fingerprint": "a4eb3bdaea671903d3ce718aa560d7f3c055f5fb",
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 129,
"precision_signals": [
"pat-0401",
"pat-0629",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0401",
"pat-0629",
"INT-upstream"
],
"matched_patterns": [
"pat-0401",
"pat-0629"
],
"matched_pattern_names": [
"SMTP EHLO",
"SMTPS EHLO"
],
"pattern_ids": [
"pat-0401",
"pat-0629"
],
"confidence_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50
},
"named_classification_skipped": false,
"service_name": "smtp-submission",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79aa3f11f06c692c2c257d51726682bc",
"path_pattern_hash": "0585f924ca84c34a681a0e1500b9f97a"
},
"target_context": {
"dst_port": 587,
"service": "smtp-submission",
"service_name": "smtp-submission",
"risk_score": 50
},
"payload_preview": "EHLO mail.example.com\r\n",
"request_sample": "EHLO mail.example.com\r\n",
"payload_snippet": "EHLO mail.example.com",
"evidence": {
"request_sample": "EHLO mail.example.com\r\n",
"payload_snippet": "EHLO mail.example.com",
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dac81480b9f2ad25f9850a706b271a85a781ccd4",
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"payload_preview": "EHLO mail.example.com",
"port": 587,
"service": "smtp-submission",
"service_label_fr": "SMTP SUBMISSION"
},
"evidence_snippet": "EHLO mail.example.com",
"attack_vector": "smtp probe \u00b7 via SMTP SUBMISSION:587 \u00b7 (sonde \/ probe)",
"target_port_label": "587 \u00b7 SMTP SUBMISSION",
"emulator_service": "smtp-submission",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab smtp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via SMTP SUBMISSION",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 47,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 50
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "smtp-submission",
"service_label_fr": "SMTP SUBMISSION",
"dst_port": 587,
"protocol_emulated": true,
"tags_summary": [
"pat-0401",
"pat-0629",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0401",
"pat-0629",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-smtp-submission",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"payload_preview": "EHLO mail.example.com",
"port": 587,
"service": "smtp-submission",
"service_label_fr": "SMTP SUBMISSION"
},
"attack_vector": "smtp probe \u00b7 via SMTP SUBMISSION:587 \u00b7 (sonde \/ probe)",
"evidence_snippet": "EHLO mail.example.com",
"target_port_label": "587 \u00b7 SMTP SUBMISSION",
"emulator_service": "smtp-submission",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "smtp_submission",
"service_banner": "honeypot-smtp-submission",
"service_os": "linux",
"dst_port": "587"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"net_smtp_probe",
"smtp_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9042 · CASSANDRA
|
cassandra
|
Sonde PostgreSQL
postgres probe · via CASSANDRA:9042 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CASSANDRA
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_native
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9042
Chemin / cible
—
Service
CASSANDRA
Payload
e����Ƹ�#�*�ڑ�hA� �l���� + ���!�Ng]���-R7�N̘A� �?��g��J &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
e����Ƹ�#�*�ڑ�hA� �l���� + ���!�Ng]���-R7�N̘A� �?��g��J &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
e����Ƹ�#�*�ڑ�hA� �l���� + ���!�Ng]���-R7�N̘A� �?��g��J &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ �>2t��]���k��K�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "840000000200000002",
"emulator_response_len": 9,
"bytes_in": 273,
"payload_entropy": 5.729347320695522,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "cassandra",
"app_proto": "cassandra",
"asn": 14061,
"country": "DE",
"dst_port": 9042,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40a95b0e32b0df6949d23e1558297d2ebdc45aed",
"event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cassandra",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dffd0e2ae1adcab047947c5f275ebd97",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 9042,
"service": "cassandra",
"service_name": "cassandra",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\u001f\ufffdl\ufffd\ufffd\u0013\ufffd\ufffd\f\u001e+ \ufffd\ufffd\u0002\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318\u0018A\ufffd\u001e\ufffd\u0003?\ufffd\ufffdg\ufffd\ufffdJ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\u001f\ufffdl\ufffd\ufffd\u0013\ufffd\ufffd\f\u001e+ \ufffd\ufffd\u0002\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318\u0018A\ufffd\u001e\ufffd\u0003?\ufffd\ufffdg\ufffd\ufffdJ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd>2t\ufffd\ufffd]\ufffd\ufffd\ufffdk\ufffd\ufffdK\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\u001f\ufffdl\ufffd\ufffd\u0013\ufffd\ufffd\f\u001e+ \ufffd\ufffd\u0002\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318\u0018A\ufffd\u001e\ufffd\u0003?\ufffd\ufffdg\ufffd\ufffdJ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98e1e6b7133cf91a889fcd831bc07423200a64d0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\u001f\ufffdl\ufffd\ufffd\u0013\ufffd\ufffd\f\u001e+ \ufffd\ufffd\u0002\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318\u0018A\ufffd\u001e\ufffd\u0003?\ufffd\ufffdg\ufffd\ufffdJ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"evidence_snippet": "e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd+ \ufffd\ufffd\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318A\ufffd\ufffd?\ufffd\ufffdg\ufffd\ufffdJ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cassandra",
"service_label_fr": "CASSANDRA",
"dst_port": 9042,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cassandra",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\u001f\ufffdl\ufffd\ufffd\u0013\ufffd\ufffd\f\u001e+ \ufffd\ufffd\u0002\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318\u0018A\ufffd\u001e\ufffd\u0003?\ufffd\ufffdg\ufffd\ufffdJ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"evidence_snippet": "e\ufffd\ufffd\ufffd\ufffd\u01b8\ufffd#\ufffd*\ufffd\u0691\ufffdhA\ufffd\ufffdl\ufffd\ufffd\ufffd\ufffd+ \ufffd\ufffd\ufffd!\ufffdNg]\ufffd\ufffd\ufffd-R7\ufffdN\u0318A\ufffd\ufffd?\ufffd\ufffdg\ufffd\ufffdJ&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cassandra",
"service_banner": "honeypot-cassandra",
"service_os": "linux",
"dst_port": "9042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cassandra_emulated",
"net_cassandra_native",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9042 · CASSANDRA
|
cassandra
|
Sonde PostgreSQL
postgres probe · via CASSANDRA:9042 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
CASSANDRA
WAF
—
Recommandation
Surveiller
Tags
cassandra_emulated
net_cassandra_native
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9042
Chemin / cible
—
Service
CASSANDRA
Payload
>n������=F�zW4A�������U<��<8 nX��PPwԥ�)�� � ����� ��d��o� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
>n������=F�zW4A�������U<��<8 nX��PPwԥ�)�� � ����� ��d��o� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
>n������=F�zW4A�������U<��<8 nX��PPwԥ�)�� � ����� ��d��o� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ �/S]���{6�% 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "840000000200000002",
"emulator_response_len": 9,
"bytes_in": 273,
"payload_entropy": 5.733493720489673,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "cassandra",
"app_proto": "cassandra",
"asn": 14061,
"country": "DE",
"dst_port": 9042,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "40a95b0e32b0df6949d23e1558297d2ebdc45aed",
"event_fingerprint": "a0aaefdb49226dd6e2577aeda4227e02b3ddd691",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "cassandra",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e1dbb923260f5f09d08f8c84460d3eea",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 9042,
"service": "cassandra",
"service_name": "cassandra",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003>n\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd=F\ufffdzW4A\ufffd\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\u000f<\ufffd\ufffd<8 nX\ufffd\ufffdP\u000ePw\u0525\ufffd)\ufffd\ufffd\f\u0016\ufffd\u001c\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdd\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003>n\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd=F\ufffdzW4A\ufffd\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\u000f<\ufffd\ufffd<8 nX\ufffd\ufffdP\u000ePw\u0525\ufffd)\ufffd\ufffd\f\u0016\ufffd\u001c\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdd\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\/S\u0011]\ufffd\ufffd\ufffd{6\ufffd%\u00001",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003>n\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd=F\ufffdzW4A\ufffd\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\u000f<\ufffd\ufffd<8 nX\ufffd\ufffdP\u000ePw\u0525\ufffd)\ufffd\ufffd\f\u0016\ufffd\u001c\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdd\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0d019a85829767e0310a3a7b5842467725b0b54",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003>n\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd=F\ufffdzW4A\ufffd\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\u000f<\ufffd\ufffd<8 nX\ufffd\ufffdP\u000ePw\u0525\ufffd)\ufffd\ufffd\f\u0016\ufffd\u001c\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdd\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"evidence_snippet": ">n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=F\ufffdzW4A\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU<\ufffd\ufffd<8 nX\ufffd\ufffdPPw\u0525\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdo\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "cassandra",
"service_label_fr": "CASSANDRA",
"dst_port": 9042,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-cassandra",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003>n\ufffd\ufffd\ufffd\ufffd\ufffd\u0010\ufffd=F\ufffdzW4A\ufffd\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\u000f<\ufffd\ufffd<8 nX\ufffd\ufffdP\u000ePw\u0525\ufffd)\ufffd\ufffd\f\u0016\ufffd\u001c\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffdd\ufffd\ufffdo\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 9042,
"service": "cassandra",
"service_label_fr": "CASSANDRA"
},
"attack_vector": "postgres probe \u00b7 via CASSANDRA:9042 \u00b7 (sonde \/ probe)",
"evidence_snippet": ">n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=F\ufffdzW4A\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU<\ufffd\ufffd<8 nX\ufffd\ufffdPPw\u0525\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffdo\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "9042 \u00b7 CASSANDRA",
"emulator_service": "cassandra",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "cassandra",
"service_banner": "honeypot-cassandra",
"service_os": "linux",
"dst_port": "9042"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"cassandra_emulated",
"net_cassandra_native",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1911 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:1911 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_sap_diag_probe
sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1911
Chemin / cible
—
Service
SAP Diag
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:1911 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:1911
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"bytes_in": 116,
"payload_entropy": 5.216877742308728,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 14061,
"country": "DE",
"dst_port": 1911,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 48,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "669f91620e4c58bd069f9f604b19f2f3ac5be262",
"event_fingerprint": "7f9e00302d01093535dd87422fd94a553ed73f8e",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86d2936ca093610fe2dfd9f83cd57e15",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 1911,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b49a122e9115dd46b7a0ddb2543e31d705503b2a",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1911,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1911 \u00b7 (sonde \/ probe)",
"target_port_label": "1911 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 1911,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1911,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1911 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1911 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "1911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4891 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4891 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 96458b3de39df5d4
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4891
Chemin / cible
—
Service
TLS
Payload
��-����|��8���f��=5�n.��]�M k4�v.K]�v[��[����]�WE��r� !�ȡ5 &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��-����|��8���f��=5�n.��]�M k4�v.K]�v[��[����]�WE��r� !�ȡ5 &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
��-����|��8���f��=5�n.��]�M k4�v.K]�v[��[����]�WE��r� !�ȡ5 &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ ر�*�ޥ~ ی�Q�
Meta JSON brut
{
"tls_ja3_hash": "96458b3de39df5d47bc5c4a9f10f8f26",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 273,
"payload_entropy": 5.739361537993116,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "DE",
"dst_port": 4891,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7c4901938777a7c142be807a8ae2551bd17e5a29",
"event_fingerprint": "09839e58edfadecc9a33274a264ed6dfee87037f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"payload_hash": "610cc6737936640511aeb6277e62e35c",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4891,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd-\u0015\ufffd\u0001\ufffd\u0010\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\u0001\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\u0014\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd\f!\ufffd\u02215\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd-\u0015\ufffd\u0001\ufffd\u0010\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\u0001\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\u0014\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd\f!\ufffd\u02215\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0631\ufffd*\ufffd\u07a5~\u0011 \u06cc\ufffdQ\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd-\u0015\ufffd\u0001\ufffd\u0010\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\u0001\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\u0014\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd\f!\ufffd\u02215\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d3840e18a02a74bfac54d8bf76b3d489daa65281",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd-\u0015\ufffd\u0001\ufffd\u0010\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\u0001\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\u0014\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd\f!\ufffd\u02215\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd!\ufffd\u02215&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4891,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd-\u0015\ufffd\u0001\ufffd\u0010\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\u0001\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\u0014\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd\f!\ufffd\u02215\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd|\ufffd\ufffd8\ufffd\ufffd\ufffdf\ufffd\ufffd=5\ufffdn.\ufffd\ufffd]\ufffdM k4\ufffdv.K]\ufffdv[\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd]\ufffdWE\ufffd\ufffdr\ufffd!\ufffd\u02215&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4891"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4891 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4891 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 96458b3de39df5d4
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4891
Chemin / cible
—
Service
TLS
Payload
q-�`(-� �~Aъ��ހ�T҂�����6��&f� �Xl�����`"�u�#)Ŵ �.�[� �2�/�8 &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
q-�`(-� �~Aъ��ހ�T҂�����6��&f� �Xl�����`"�u�#)Ŵ �.�[� �2�/�8 &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
q-�`(-� �~Aъ��ހ�T҂�����6��&f� �Xl�����`"�u�#)Ŵ �.�[� �2�/�8 &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ �ͩ�! �N��n `"
Meta JSON brut
{
"tls_ja3_hash": "96458b3de39df5d47bc5c4a9f10f8f26",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 273,
"payload_entropy": 5.737687017809239,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "DE",
"dst_port": 4891,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7c4901938777a7c142be807a8ae2551bd17e5a29",
"event_fingerprint": "09839e58edfadecc9a33274a264ed6dfee87037f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"payload_hash": "fb590da58290b48b50a8163f4fd3f2ba",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4891,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003q-\ufffd`(-\ufffd\u001f\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd\u0001#)\u0174\u001d\ufffd.\ufffd[\ufffd\f\ufffd2\ufffd\u0012\/\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003q-\ufffd`(-\ufffd\u001f\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd\u0001#)\u0174\u001d\ufffd.\ufffd[\ufffd\f\ufffd2\ufffd\u0012\/\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0369\ufffd! \ufffdN\ufffd\ufffd\u001an\u001c`\"",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003q-\ufffd`(-\ufffd\u001f\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd\u0001#)\u0174\u001d\ufffd.\ufffd[\ufffd\f\ufffd2\ufffd\u0012\/\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4817377324673e2268fd017b4ca86bb4fd4b41de",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003q-\ufffd`(-\ufffd\u001f\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd\u0001#)\u0174\u001d\ufffd.\ufffd[\ufffd\f\ufffd2\ufffd\u0012\/\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "q-\ufffd`(-\ufffd\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd#)\u0174\ufffd.\ufffd[\ufffd\ufffd2\ufffd\/\ufffd8&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4891,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003q-\ufffd`(-\ufffd\u001f\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd\u0001#)\u0174\u001d\ufffd.\ufffd[\ufffd\f\ufffd2\ufffd\u0012\/\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "96458b3de39df5d47bc5c4a9f10f8f26",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"evidence_snippet": "q-\ufffd`(-\ufffd\ufffd~A\u044a\ufffd\ufffd\u0780\ufffdT\u0482\ufffd\ufffd\ufffd\ufffd\ufffd6\ufffd\ufffd&f\ufffd \ufffdXl\ufffd\ufffd\ufffd\ufffd\ufffd`\"\ufffdu\ufffd#)\u0174\ufffd.\ufffd[\ufffd\ufffd2\ufffd\/\ufffd8&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4891"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
11434 · OLLAMA
|
ollama
|
Injection PHP
php injection · via OLLAMA:11434 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
OLLAMA
WAF
—
Recommandation
Investiguer
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11434
Chemin / cible
—
Service
OLLAMA
Payload
�~9[�/W,a��n*G���O}H�䫨����$ {�� ��8��.����,�>T��O���SE5� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�~9[�/W,a��n*G���O}H�䫨����$ {�� ��8��.����,�>T��O���SE5� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
�~9[�/W,a��n*G���O}H�䫨����$ {�� ��8��.����,�>T��O���SE5� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ m�lD��%$Zs�
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 273,
"payload_entropy": 5.789352319751754,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "ollama",
"app_proto": "ollama",
"asn": 14061,
"country": "DE",
"dst_port": 11434,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f2a17d825ce172bcf72ac0b1659a0f22375133c0",
"event_fingerprint": "e5de7378bdf0b23e311530c009ea1c8bba9f0677",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"CRS 933135",
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0162",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "ollama",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "beeb31031e0eb0ca2126c13e89b6aeb9",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 11434,
"service": "ollama",
"service_name": "ollama",
"risk_score": 52
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0011\ufffd~9[\u0007\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd\b$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\u0006\ufffd\u0013,\ufffd>\u000fT\ufffd\ufffdO\ufffd\ufffd\ufffd\u001bSE5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0011\ufffd~9[\u0007\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd\b$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\u0006\ufffd\u0013,\ufffd>\u000fT\ufffd\ufffdO\ufffd\ufffd\ufffd\u001bSE5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 m\ufffd\u07b3lD\ufffd\u0002\ufffd%$\u0004Zs\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0011\ufffd~9[\u0007\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd\b$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\u0006\ufffd\u0013,\ufffd>\u000fT\ufffd\ufffdO\ufffd\ufffd\ufffd\u001bSE5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec04dd26e119a6001e5fa999ada87b08339d348c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0011\ufffd~9[\u0007\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd\b$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\u0006\ufffd\u0013,\ufffd>\u000fT\ufffd\ufffdO\ufffd\ufffd\ufffd\u001bSE5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"evidence_snippet": "\ufffd~9[\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd,\ufffd>T\ufffd\ufffdO\ufffd\ufffd\ufffdSE5\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "php injection \u00b7 via OLLAMA:11434 \u00b7 (tentative d'exploit)",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via OLLAMA",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "ollama",
"service_label_fr": "OLLAMA",
"dst_port": 11434,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ollama",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0011\ufffd~9[\u0007\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd\b$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\u0006\ufffd\u0013,\ufffd>\u000fT\ufffd\ufffdO\ufffd\ufffd\ufffd\u001bSE5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"attack_vector": "php injection \u00b7 via OLLAMA:11434 \u00b7 (tentative d'exploit)",
"evidence_snippet": "\ufffd~9[\ufffd\/W,a\ufffd\ufffdn*G\ufffd\ufffd\ufffdO}H\ufffd\u4ae8\ufffd\ufffd\ufffd\ufffd$ {\ufffd\ufffd\t\ufffd\ufffd8\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd,\ufffd>T\ufffd\ufffdO\ufffd\ufffd\ufffdSE5\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ollama",
"service_banner": "honeypot-ollama",
"service_os": "linux",
"dst_port": "11434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11434 · OLLAMA
|
ollama
|
Sonde PostgreSQL
postgres probe · via OLLAMA:11434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
OLLAMA
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11434
Chemin / cible
—
Service
OLLAMA
Payload
S�$� �T��͘����R��>Ƴf��j��� �i�G2�@�3�l��]����iTC~ �� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
S�$� �T��͘����R��>Ƴf��j��� �i�G2�@�3�l��]����iTC~ �� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
S�$� �T��͘����R��>Ƴf��j��� �i�G2�@�3�l��]����iTC~ �� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ j����w��o8�n��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 273,
"payload_entropy": 5.667181386513531,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "ollama",
"app_proto": "ollama",
"asn": 14061,
"country": "DE",
"dst_port": 11434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f2a17d825ce172bcf72ac0b1659a0f22375133c0",
"event_fingerprint": "e5de7378bdf0b23e311530c009ea1c8bba9f0677",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "ollama",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2a3d4d3cb23fbc950950b4b04300c18",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 11434,
"service": "ollama",
"service_name": "ollama",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003S\ufffd$\ufffd\u001c\ufffdT\ufffd\ufffd\u0358\ufffd\u0013\ufffd\u0012\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\u0001\ufffd \ufffdi\ufffdG\u001a2\u05cf\u0003\ufffd@\ufffd3\ufffdl\ufffd\ufffd\u0003]\ufffd\ufffd\ufffd\u0007\ufffdiT\u0012C~\u000b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003S\ufffd$\ufffd\u001c\ufffdT\ufffd\ufffd\u0358\ufffd\u0013\ufffd\u0012\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\u0001\ufffd \ufffdi\ufffdG\u001a2\u05cf\u0003\ufffd@\ufffd3\ufffdl\ufffd\ufffd\u0003]\ufffd\ufffd\ufffd\u0007\ufffdiT\u0012C~\u000b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 j\ufffd\ufffd\ufffd\u0004\ufffdw\ufffd\ufffdo8\ufffdn\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003S\ufffd$\ufffd\u001c\ufffdT\ufffd\ufffd\u0358\ufffd\u0013\ufffd\u0012\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\u0001\ufffd \ufffdi\ufffdG\u001a2\u05cf\u0003\ufffd@\ufffd3\ufffdl\ufffd\ufffd\u0003]\ufffd\ufffd\ufffd\u0007\ufffdiT\u0012C~\u000b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "130bcce94cfe525e9d24bbc5be9a24a5fabbdd96",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003S\ufffd$\ufffd\u001c\ufffdT\ufffd\ufffd\u0358\ufffd\u0013\ufffd\u0012\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\u0001\ufffd \ufffdi\ufffdG\u001a2\u05cf\u0003\ufffd@\ufffd3\ufffdl\ufffd\ufffd\u0003]\ufffd\ufffd\ufffd\u0007\ufffdiT\u0012C~\u000b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"evidence_snippet": "S\ufffd$\ufffd\ufffdT\ufffd\ufffd\u0358\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\ufffd \ufffdi\ufffdG2\u05cf\ufffd@\ufffd3\ufffdl\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdiTC~\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "ollama",
"service_label_fr": "OLLAMA",
"dst_port": 11434,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ollama",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003S\ufffd$\ufffd\u001c\ufffdT\ufffd\ufffd\u0358\ufffd\u0013\ufffd\u0012\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\u0001\ufffd \ufffdi\ufffdG\u001a2\u05cf\u0003\ufffd@\ufffd3\ufffdl\ufffd\ufffd\u0003]\ufffd\ufffd\ufffd\u0007\ufffdiT\u0012C~\u000b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "S\ufffd$\ufffd\ufffdT\ufffd\ufffd\u0358\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffd>\u01b3f\ufffd\ufffdj\ufffd\ufffd\ufffd \ufffdi\ufffdG2\u05cf\ufffd@\ufffd3\ufffdl\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffdiTC~\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ollama",
"service_banner": "honeypot-ollama",
"service_os": "linux",
"dst_port": "11434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
Sonde Kafka
kafka probe · via KAFKA:9092 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
net_kafka_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
sarama����
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0003000700000001000b0000",
"emulator_response_len": 16,
"bytes_in": 25,
"payload_entropy": 2.7248894517332403,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka",
"app_proto": "kafka",
"asn": 14061,
"country": "DE",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5604a3b4a980b044150539d817f4f4e048b2b9c1",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"service_name": "kafka",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a76af04305b29b9c1e423b969d3410bc",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "558b9997df52918cef4c4dc0dda02845953f74ee",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"net_kafka_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
modbus probe
modbus probe · via KAFKA:9092 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
net_kafka_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
sarama����
Pourquoi cette classification : Type « modbus_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 33
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0357
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Modbus TCP header
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0003000700000001000b0000",
"emulator_response_len": 16,
"bytes_in": 25,
"payload_entropy": 2.6115107774877746,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka",
"app_proto": "kafka",
"asn": 14061,
"country": "DE",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 33,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5604a3b4a980b044150539d817f4f4e048b2b9c1",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0357"
],
"kb_rule_ids": [
"pat-0357"
],
"matched_patterns": [
"pat-0357",
"pat-0554"
],
"matched_pattern_names": [
"Modbus TCP header",
"Minecraft varint handshake"
],
"pattern_ids": [
"pat-0357",
"pat-0554"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "kafka",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cdfc5882fd0fe4e2dd0a38e19224d60b",
"path_pattern_hash": "8ae4962b81dca47862d9dd3befc69030"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 33
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d80730300b38f4646acfe24473f9d22876d4c292",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "modbus probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab modbus_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": [
"pat-0357"
],
"tags_summary_labels_fr": [
"pat-0357"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "modbus probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"net_kafka_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
Sonde Kafka
kafka probe · via KAFKA:9092 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
net_kafka_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
sarama����
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0003000700000001000b0000",
"emulator_response_len": 16,
"bytes_in": 25,
"payload_entropy": 2.8048894517332403,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka",
"app_proto": "kafka",
"asn": 14061,
"country": "DE",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5604a3b4a980b044150539d817f4f4e048b2b9c1",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"service_name": "kafka",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7feabb2a82eb6c2d1dd01346551507ce",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c31630728054493480fd946335a95fd284172d00",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"net_kafka_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9092 · KAFKA
|
kafka
|
Sonde Kafka
kafka probe · via KAFKA:9092 · (sonde / probe)
|
Élevée
|
Faible · 32
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KAFKA
WAF
—
Recommandation
Surveiller
Tags
kafka_api_versions
kafka_emulated
net_kafka_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9092
Chemin / cible
—
Service
KAFKA
Payload
sarama����
Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 32
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0532
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
sarama����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0000000c0003000700000001000b0000",
"emulator_response_len": 16,
"bytes_in": 25,
"payload_entropy": 2.8048894517332403,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "kafka",
"app_proto": "kafka",
"asn": 14061,
"country": "DE",
"dst_port": 9092,
"risk_waf": 8,
"risk_classification": 56,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 32,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "5604a3b4a980b044150539d817f4f4e048b2b9c1",
"event_fingerprint": "c474d9c3f8c0776c7c96d4f25d2b0651552d8fad",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0532"
],
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"service_name": "kafka",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0a78e71a9f8645a1d79789b4c4da099d",
"path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
},
"target_context": {
"dst_port": 9092,
"service": "kafka",
"service_name": "kafka",
"risk_score": 32
},
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"evidence": {
"request_sample": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"payload_snippet": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"enterprise_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b53b62b057b922839cd77c6a68bdd3d0508dffab",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 56,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 32
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 32,
"risk_label": "Faible",
"service_name": "kafka",
"service_label_fr": "KAFKA",
"dst_port": 9092,
"protocol_emulated": true,
"tags_summary": [
"pat-0532"
],
"tags_summary_labels_fr": [
"pat-0532"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kafka",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama\ufffd\ufffd\ufffd\ufffd\u0000",
"port": 9092,
"service": "kafka",
"service_label_fr": "KAFKA"
},
"attack_vector": "kafka probe \u00b7 via KAFKA:9092 \u00b7 (sonde \/ probe)",
"evidence_snippet": "sarama\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "9092 \u00b7 KAFKA",
"emulator_service": "kafka",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kafka",
"service_banner": "honeypot-kafka",
"service_os": "linux",
"dst_port": "9092"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kafka_api_versions",
"kafka_emulated",
"net_kafka_probe"
],
"asn_dc_heuristic": true
}
|